diff --git a/integration/scripts/check_bucket_not_empty b/integration/scripts/check_bucket_not_empty
index 7c124571..f151b3de 100755
--- a/integration/scripts/check_bucket_not_empty
+++ b/integration/scripts/check_bucket_not_empty
@@ -3,6 +3,7 @@ set -euo pipefail
 
 DIE() { echo "$*" 1>&2; exit 1; }
 
-[[ ! -z "${SOURCE}" ]] || DIE "source not set"
+[[ ! -z "${SOURCE:-}" ]] || DIE "source not set"
 
+echo "listing ${SOURCE}"
 [[ ! -z $(aws s3 ls ${SOURCE}) ]] || DIE "bucket is empty"
diff --git a/integration/scripts/check_object_copy b/integration/scripts/check_object_copy
index da1bc07f..ab92ca91 100755
--- a/integration/scripts/check_object_copy
+++ b/integration/scripts/check_object_copy
@@ -18,24 +18,9 @@ TMPNAME=$(basename ${TMPFILE})
 
 echo "{\"hello\": \"world\"}" > "$TMPFILE"
 
-aws s3 cp ${TMPFILE} s3://${SOURCE} --content-type application/json 1>&2
-if [ $? -ne 0 ]; then
-    DIE "failed to copy file to source"
-fi
-
-ORIGINAL=$(aws s3api head-object --bucket ${SOURCE} --key ${TMPNAME} | jq 'del(.LastModified)')
-if [ $? -ne 0 ]; then
-    DIE "failed to read file from source"
-fi
-
-
-COPY=$(aws s3api head-object --bucket ${DESTINATION} --key ${TMPNAME} | jq 'del(.LastModified)')
-if [ $? -ne 0 ]; then
-    DIE "failed to read file from destination"
-fi
-
-if [ "$ORIGINAL" = "$COPY" ]; then
-    echo "ok"
-else
-    DIE "object differs"
-fi
+aws s3 cp ${TMPFILE} s3://${SOURCE} --content-type application/json 1>&2 || DIE "failed to copy file to source"
+
+ORIGINAL=$(aws s3api head-object --bucket ${SOURCE} --key ${TMPNAME} | jq 'del(.LastModified)' || DIE "failed to read file from source")
+COPY=$(aws s3api head-object --bucket ${DESTINATION} --key ${TMPNAME} | jq 'del(.LastModified)' || DIE "failed to read file from destination")
+
+[ "$ORIGINAL" = "$COPY" ] || DIE "object differs"
diff --git a/integration/tests/check/main.tf b/integration/tests/check/main.tf
index 866cb62a..e33b5e98 100644
--- a/integration/tests/check/main.tf
+++ b/integration/tests/check/main.tf
@@ -1,4 +1,4 @@
 data "external" "check" {
-  program = concat(["${path.module}/run"], var.program)
+  program = concat(["${path.module}/run"], [var.command], var.args)
   query   = var.env_vars
 }
diff --git a/integration/tests/check/outputs.tf b/integration/tests/check/outputs.tf
index b5e32da1..f843216e 100644
--- a/integration/tests/check/outputs.tf
+++ b/integration/tests/check/outputs.tf
@@ -1,3 +1,11 @@
-output "result" {
-  value = data.external.check.result
+output "error" {
+  value = data.external.check.result.error
+}
+
+output "exitcode" {
+  value = tonumber(data.external.check.result.exitcode)
+}
+
+output "output" {
+  value = data.external.check.result.output
 }
diff --git a/integration/tests/check/run b/integration/tests/check/run
index 4012f922..0c32f207 100755
--- a/integration/tests/check/run
+++ b/integration/tests/check/run
@@ -21,5 +21,6 @@ if [ $RESULT -ne 0 ]; then
     ERROR=$(echo -n "$OUTPUT" | tail -n1 | jq -Rsa .)
 fi
 
+# terraform external data source expects all arguments to be strings
+echo "{\"error\": ${ERROR}, \"exitcode\": \"${RESULT}\", \"output\": $(echo -n "$OUTPUT" | jq -Rsa .)}"
 # always return 0, let caller decide if error message warrants any action
-echo "{\"error\": ${ERROR}}"
diff --git a/integration/tests/check/variables.tf b/integration/tests/check/variables.tf
index a9b7cb43..b0b7bc03 100644
--- a/integration/tests/check/variables.tf
+++ b/integration/tests/check/variables.tf
@@ -1,15 +1,19 @@
-variable "program" {
+variable "command" {
   description = <<-EOF
-    A list of strings, whose first element is the program to run and whose
-    subsequent elements are optional command line arguments to the program.
-    Terraform does not execute the program through a shell, so it is not
-    necessary to escape shell metacharacters nor add quotes around arguments
-    containing spaces.
+    Command to execute
   EOF
-  type        = list(string)
+  type        = string
   nullable    = false
 }
 
+variable "args" {
+  description = <<-EOF
+    Command line arguments
+  EOF
+  type        = list(string)
+  nullable    = false
+  default     = []
+}
 variable "env_vars" {
   description = <<-EOF
     Environment variables
diff --git a/integration/tests/forwarder.tftest.hcl b/integration/tests/forwarder.tftest.hcl
index 811e4180..67e9abb8 100644
--- a/integration/tests/forwarder.tftest.hcl
+++ b/integration/tests/forwarder.tftest.hcl
@@ -20,6 +20,25 @@ run "install_forwarder" {
   }
 }
 
+run "check_file_not_copied" {
+  module {
+    source = "./tests/check"
+  }
+
+  variables {
+    command = "./scripts/check_object_copy"
+    env_vars = {
+      SOURCE      = run.setup.source.bucket
+      DESTINATION = run.setup.destination.bucket
+    }
+  }
+
+  assert {
+    condition     = output.result.error == "failed to read file from destination"
+    error_message = "Unexpected error"
+  }
+}
+
 run "subscribe_bucket_notifications_to_sqs" {
   module {
     source = "./tests/bucket_subscription"
@@ -31,13 +50,13 @@ run "subscribe_bucket_notifications_to_sqs" {
   }
 }
 
-run "check" {
+run "check_copy_succeeds" {
   module {
     source = "./tests/check"
   }
 
   variables {
-    program  = ["./scripts/check_object_copy"]
+    command  = "./scripts/check_object_copy"
     env_vars = {
       SOURCE      = run.setup.source.bucket
       DESTINATION = run.setup.destination.bucket
diff --git a/integration/tests/simple.tftest.hcl b/integration/tests/simple.tftest.hcl
index 6036bcf2..340de8ab 100644
--- a/integration/tests/simple.tftest.hcl
+++ b/integration/tests/simple.tftest.hcl
@@ -10,14 +10,14 @@ run "check" {
   }
 
   variables {
-    program = ["./scripts/check_bucket_not_empty"]
+    command = "./scripts/check_bucket_not_empty"
     env_vars = {
       SOURCE = run.setup.source.bucket
     }
   }
 
   assert {
-    condition     = output.result.error == ""
+    condition     = output.exitcode == 0
     error_message = "Bucket not empty check failed"
   }
 }