From 125caec99f6029356515688b68045493f3db90b8 Mon Sep 17 00:00:00 2001
From: Matt Romanelli <matt.romanelli@ibm.com>
Date: Thu, 24 Sep 2026 13:22:38 -0500
Subject: [PATCH] Added support to assert against exact instance IDs

---
 testing/e2e_host_assumerole_test.go | 15 +++++++++++++++
 testing/e2e_host_test.go            |  9 ++++++++-
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/testing/e2e_host_assumerole_test.go b/testing/e2e_host_assumerole_test.go
index f589540..719b3be 100644
--- a/testing/e2e_host_assumerole_test.go
+++ b/testing/e2e_host_assumerole_test.go
@@ -54,6 +54,21 @@ func tagFilterSetAttrs(tags []string) map[string]any {
 	}
 }
 
+// requireTagInstancesMatchProvisioned asserts that every instance ID in tagInstancesMap
+// is present in provisionedIds (the raw []any slice from a Terraform output).
+func requireTagInstancesMatchProvisioned(t *testing.T, provisionedIds []any, tagInstancesMap map[string][]string) {
+	t.Helper()
+	idSet := make(map[string]struct{}, len(provisionedIds))
+	for _, id := range provisionedIds {
+		idSet[id.(string)] = struct{}{}
+	}
+	for tag, ids := range tagInstancesMap {
+		for _, id := range ids {
+			require.Contains(t, idSet, id, "instance ID %s in tag bucket %q was not provisioned by Terraform", id, tag)
+		}
+	}
+}
+
 // buildExpectedTagInstancesMap builds a map of tag key to instance IDs from a Terraform instance_tags output map.
 func buildExpectedTagInstancesMap(rawTags map[string]any, expectedTags []string) map[string][]string {
 	tagMap := make(map[string][]string)
diff --git a/testing/e2e_host_test.go b/testing/e2e_host_test.go
index 1f54ed4..6dbb788 100644
--- a/testing/e2e_host_test.go
+++ b/testing/e2e_host_test.go
@@ -164,6 +164,8 @@ func TestHostPlugin(t *testing.T) {
 	// Process the collection of instances and index by expected tag names.
 	expectedTagInstancesMap := buildExpectedTagInstancesMap(ec2InstanceTags, expectedTags)
 
+	requireTagInstancesMatchProvisioned(t, ec2InstanceIds, expectedTagInstancesMap)
+
 	cases := [][]string{
 		{expectedTags[0]},
 		{expectedTags[1]},
@@ -301,10 +303,15 @@ func TestHostPlugin(t *testing.T) {
 		crossAccountTargetNoEc2PermissionArn, err := tf.GetOutputString("cross_account_target_no_ec2_permission_arn")
 		require.NoError(err)
 
+		targetEc2InstanceIds, err := tf.GetOutputSlice("target_instance_ids")
+		require.NoError(err)
+		require.Len(targetEc2InstanceIds, expectedEc2InstanceCount)
+
 		targetEc2InstanceTags, err := tf.GetOutputMap("target_instance_tags")
 		require.NoError(err)
 		expectedTargetTagInstancesMap := buildExpectedTagInstancesMap(targetEc2InstanceTags, expectedTags)
-		require.NotEmpty(expectedTargetTagInstancesMap)
+
+		requireTagInstancesMatchProvisioned(t, targetEc2InstanceIds, expectedTargetTagInstancesMap)
 
 		testOnCreateCatalogCases(ctx, t, p, []onCreateCatalogCase{
 			{name: "cross-account happy path", catalogAttrs: crossRoleAttrs(targetRegion, crossAccountPrincipalArn, crossAccountTargetArn)},