QA plan: Network module (#21)

Story: Network module — per-env VPC, subnets, security group (#21)
Capability: AWS infrastructure (#19)
ADR: RAG001 — no IGW, no NAT; Lambda outside VPC

Test scope

Type	Coverage
IaC lint	terraform validate on modules/network passes
IaC lint	tflint passes
Static (plan review)	VPC has no Internet Gateway resource
Static (plan review)	No NAT Gateway resource in the plan
Static (plan review)	Security group allows inbound only from the RDS Data API service (or is scoped to the Aurora cluster; no public inbound)
Static (plan review)	Private subnets have no map_public_ip_on_launch = true
Security (B4)	No public subnet with route to IGW exists in the plan for the Aurora subnets
Integration (manual, QA)	After apply: VPC exists, subnets are in private state, security group has no inbound from 0.0.0.0/0

Entry criteria

• Story #20 (remote state bootstrap) complete

Exit criteria

• terraform validate and tflint exit 0 on modules/network
• Plan review checklist: no IGW, no NAT, no public inbound on the Aurora security group
• Manual integration (QA apply): resources exist in AWS; aws ec2 describe-security-groups confirms no inbound from 0.0.0.0/0

Environments

IaC lint: CI. Plan review: CI (terraform plan output). Integration check: manual against QA env post-deploy.

Tooling

terraform validate, tflint, terraform plan, AWS CLI for post-deploy verification.

How tests are written

Plan review is a human-readable checklist performed during PR review. Shell assertions where automated:

# Given the network module plan output
# When checked for Internet Gateway resources
terraform -chdir=envs/qa plan -out=plan.tfplan && terraform show -json plan.tfplan \
  | python3 -c "import sys,json; p=json.load(sys.stdin); resources=[r['type'] for r in p.get('resource_changes',[])]; assert 'aws_internet_gateway' not in resources, 'IGW found in plan'"
# Then no IGW resource is present

Risks

• The private subnet routing table must not have a default route to an IGW even if the IGW is absent; verify the route table has no 0.0.0.0/0 entry.
• Aurora may need to be in multi-AZ private subnets even at demo scale; confirm the module provisions at least 2 AZs for the subnet group.

Capability acceptance criteria link

RAG001: VPC with private subnets and security group for Aurora; no IGW or NAT. Exit criteria directly verify this.