From f044678dbdbb46b0208ba31af0d9de9e96b6aa1e Mon Sep 17 00:00:00 2001 From: Raul Cajias Date: Mon, 31 Aug 2026 16:40:20 +0000 Subject: [PATCH] test(terraform): assert backend and ui network configs alongside gateway The two existing tests for `tasks_in_public_subnets` only asserted the gateway's `assign_public_ip` and `subnets`, so flipping backend or ui to `assign_public_ip = false` left the suite green while stranding those tasks in public subnets with no route out once the NAT gateway is gone. Extend both existing `alltrue([...])` assertions to cover all three services with the same expected values, and generalize the error messages. --- .../litellm/aws/tests/byo_infrastructure.tftest.hcl | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/terraform/litellm/aws/tests/byo_infrastructure.tftest.hcl b/terraform/litellm/aws/tests/byo_infrastructure.tftest.hcl index acd2777fff8..03b5b54e748 100644 --- a/terraform/litellm/aws/tests/byo_infrastructure.tftest.hcl +++ b/terraform/litellm/aws/tests/byo_infrastructure.tftest.hcl @@ -83,8 +83,12 @@ run "tasks_in_public_subnets_replaces_the_nat_gateway" { condition = alltrue([ aws_ecs_service.gateway.network_configuration[0].assign_public_ip == true, aws_ecs_service.gateway.network_configuration[0].subnets == toset(["subnet-module-public"]), + aws_ecs_service.backend.network_configuration[0].assign_public_ip == true, + aws_ecs_service.backend.network_configuration[0].subnets == toset(["subnet-module-public"]), + aws_ecs_service.ui.network_configuration[0].assign_public_ip == true, + aws_ecs_service.ui.network_configuration[0].subnets == toset(["subnet-module-public"]), ]) - error_message = "The gateway must land in the public subnets with a public IP, which is the only egress left once the NAT gateway is gone." + error_message = "The gateway, backend, and UI services must all land in the public subnets with a public IP, which is the only egress left once the NAT gateway is gone." } # The private subnets stay for Aurora and ElastiCache, so the route table is @@ -114,8 +118,12 @@ run "tasks_in_public_subnets_is_inert_on_a_caller_supplied_vpc" { condition = alltrue([ aws_ecs_service.gateway.network_configuration[0].assign_public_ip == false, aws_ecs_service.gateway.network_configuration[0].subnets == toset(["subnet-priv-a", "subnet-priv-b"]), + aws_ecs_service.backend.network_configuration[0].assign_public_ip == false, + aws_ecs_service.backend.network_configuration[0].subnets == toset(["subnet-priv-a", "subnet-priv-b"]), + aws_ecs_service.ui.network_configuration[0].assign_public_ip == false, + aws_ecs_service.ui.network_configuration[0].subnets == toset(["subnet-priv-a", "subnet-priv-b"]), ]) - error_message = "tasks_in_public_subnets must be ignored when vpc_id is set, leaving the tasks in the caller's private subnets with no public IP." + error_message = "tasks_in_public_subnets must be ignored when vpc_id is set, leaving all three services in the caller's private subnets with no public IP." } }