KICS vs terraform-plugin-testing

KICS is a free, open-source static analysis solution powered by Checkmarx. It scans Infrastructure as Code for security vulnerabilities, compliance issues, and configuration mistakes across Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, Google Deployment Manager, AWS SAM, Microsoft ARM, Azure Blueprints, OpenAPI, Pulumi, Crossplane, Knative, and Serverless Framework files. Its security queries can be edited, extended, or supplemented with new queries, using OPA Rego policy language. Documented CI and delivery integrations include GitHub Actions, GitLab CI, Jenkins, Azure Pipelines, CircleCI, Bitbucket Pipelines, Terraform Cloud, AWS CodeBuild, pre-commit hooks, and others. A Visual Studio Code extension can scan automatically. KICS runs as a Docker image, from source, or through downloadable Linux, Windows, and macOS releases. Reports can be exported as JSON, SARIF, GitLab SAST, JUnit, HTML, PDF, CycloneDX, ASFF, or CSV. Terraform functions and environment variables are unsupported, and unofficial or custom Terraform modules are not supported.

terraform-plugin-testing is a free Go helper module for testing Terraform providers on Linux and macOS. It supports unit tests that exercise plugin code in isolation without network connections, and acceptance tests that run real Terraform plan, apply, refresh, and destroy operations. Acceptance testing includes Lifecycle, Import, Refresh, and Query modes. The plancheck package can inspect empty or non-empty plans, resource and data source values, and actions. The statecheck package checks known values, sensitive values, and comparisons between resource or data source attributes. The framework uses a local Terraform binary with standard Go testing tools, including go test and the testing package, so tests can run in continuous integration environments such as GitHub Actions. Acceptance runs may create and destroy infrastructure, which can consume quotas and incur expenses. Prerequisites include a recent stable Go release, Terraform CLI 0.12.26 or later, provider and resource access, and TF_ACC set to a value. The project uses Mozilla Public License v2.0.