Added support to assert against exact instance IDs

testing/e2e_host_assumerole_test.go

@@ -54,6 +54,21 @@ func tagFilterSetAttrs(tags []string) map[string]any {
 	}
 }
 
+// requireTagInstancesMatchProvisioned asserts that every instance ID in tagInstancesMap
+// is present in provisionedIds (the raw []any slice from a Terraform output).
+func requireTagInstancesMatchProvisioned(t *testing.T, provisionedIds []any, tagInstancesMap map[string][]string) {
+	t.Helper()
+	idSet := make(map[string]struct{}, len(provisionedIds))
+	for _, id := range provisionedIds {
+		idSet[id.(string)] = struct{}{}
+	}
+	for tag, ids := range tagInstancesMap {
+		for _, id := range ids {
+			require.Contains(t, idSet, id, "instance ID %s in tag bucket %q was not provisioned by Terraform", id, tag)
+		}
+	}
+}
+
 // buildExpectedTagInstancesMap builds a map of tag key to instance IDs from a Terraform instance_tags output map.
 func buildExpectedTagInstancesMap(rawTags map[string]any, expectedTags []string) map[string][]string {
 	tagMap := make(map[string][]string)

testing/e2e_host_test.go

@@ -164,6 +164,8 @@ func TestHostPlugin(t *testing.T) {
 	// Process the collection of instances and index by expected tag names.
 	expectedTagInstancesMap := buildExpectedTagInstancesMap(ec2InstanceTags, expectedTags)
 
+	requireTagInstancesMatchProvisioned(t, ec2InstanceIds, expectedTagInstancesMap)
+
 	cases := [][]string{
 		{expectedTags[0]},
 		{expectedTags[1]},
@@ -301,10 +303,15 @@ func TestHostPlugin(t *testing.T) {
 		crossAccountTargetNoEc2PermissionArn, err := tf.GetOutputString("cross_account_target_no_ec2_permission_arn")
 		require.NoError(err)
 
+		targetEc2InstanceIds, err := tf.GetOutputSlice("target_instance_ids")
+		require.NoError(err)
+		require.Len(targetEc2InstanceIds, expectedEc2InstanceCount)
+
 		targetEc2InstanceTags, err := tf.GetOutputMap("target_instance_tags")
 		require.NoError(err)
 		expectedTargetTagInstancesMap := buildExpectedTagInstancesMap(targetEc2InstanceTags, expectedTags)
-		require.NotEmpty(expectedTargetTagInstancesMap)
+
+		requireTagInstancesMatchProvisioned(t, targetEc2InstanceIds, expectedTargetTagInstancesMap)
 
 		testOnCreateCatalogCases(ctx, t, p, []onCreateCatalogCase{
 			{name: "cross-account happy path", catalogAttrs: crossRoleAttrs(targetRegion, crossAccountPrincipalArn, crossAccountTargetArn)},