Terraform Learning Path

📊 Progress Dashboard

Mon, 01 Jan 0001 00:00:00 +0000

📖 Full Curriculum#

Welcome to the comprehensive Terraform learning curriculum. Use the dashboard above to track your progress across 17 chapters and 7 practice tests.

Foundation (Week 1)#

#	Chapter	Description
01	Introduction to IaC & Terraform	What is IaC, Terraform vs other tools, installation
02	Terraform Core Concepts	Providers, state, lifecycle, core workflow
03	HCL Configuration Language	Syntax, data types, expressions, functions
04	Resources, Data Sources & Meta-Arguments	Resources, data sources, count, for_each, lifecycle

Core Skills (Week 2)#

#	Chapter	Description
05	Variables, Outputs & Locals	Input variables, outputs, locals, validation
06	State Management	Remote state, backends, locking, isolation
07	Terraform Modules	Module structure, registry, versioning
08	Workspaces & Environments	Multi-environment strategies, workspace management

Advanced (Week 3)#

#	Chapter	Description
09	Functions, Expressions & Dynamic Blocks	Built-in functions, for expressions, dynamic blocks
10	Provisioners & Side Effects	local-exec, remote-exec, file, alternatives
11	Terraform Cloud & Enterprise	Remote execution, Sentinel, VCS workflow
12	Importing & Refactoring	Import, moved blocks, state migrations

Production & Exam Prep (Week 4)#

#	Chapter	Description
13	Security & Compliance	Secrets management, IAM, Sentinel policies
14	Production-Grade Terraform	CI/CD, testing, team workflows, disaster recovery
15	Exam Preparation Guide	Sample questions, cheat sheet, study plan

Bonus Chapters#

#	Chapter	Description
16	Interview Questions & Answers	50+ interview questions from beginner to expert level
17	Real-World Scenario Questions	12 practical troubleshooting & design scenarios

Practice Tests#

#	Test	Description
1	Practice Test 1	57 questions — all 7 domains
2	Practice Test 2	57 questions — all 7 domains
3	Practice Test 3	57 questions — all 7 domains
4	Practice Test 4	57 questions — all 7 domains
5	Practice Test 5	57 questions — all 7 domains
6	Practice Test 6	57 questions — all 7 domains
7	Practice Test 7	57 questions — all 7 domains

💡 Pro tip: Start from Chapter 1 and work your way through. Use the dashboard to track your progress and identify weak areas for focused study.

🚀 Start Here

Mon, 01 Jan 0001 00:00:00 +0000

🚀 Start Here: Your Terraform Learning Path#

Welcome! Whether you’re brand new to Terraform or brushing up for the certification, this guide will help you navigate the curriculum efficiently.

🎯 How to Use This Guide#

If you’re completely new to Terraform#

Follow the 4-week study plan below. Start from Chapter 1 and work through sequentially.

If you’re reviewing for the exam#

Go straight to the Exam Prep phase. Take a practice test first to identify weak areas, then focus on those chapters.

Chapter 1: Introduction to Infrastructure as Code & Terraform

Mon, 01 Jan 0001 00:00:00 +0000

Chapter 1: Introduction to Infrastructure as Code & Terraform#

🎯 Learning Objectives#

Understand what Infrastructure as Code (IaC) is and why it matters
Compare Terraform with other IaC tools (CloudFormation, Pulumi, Ansible)
Learn Terraform’s architecture and how it works
Install Terraform and set up AWS credentials
Write your first Terraform configuration
Understand HCL vs JSON configuration formats

1.1 What is Infrastructure as Code?#

Infrastructure as Code (IaC) is the practice of managing and provisioning infrastructure (servers, networks, databases, etc.) through machine-readable definition files, rather than manual processes or interactive configuration tools.

Chapter 2: Terraform Core Concepts

Mon, 01 Jan 0001 00:00:00 +0000

Chapter 2: Terraform Core Concepts#

🎯 Learning Objectives#

Understand Terraform providers, resources, and state
Master the Terraform workflow (init, plan, apply, destroy)
Learn about resource dependencies and the graph
Understand Terraform’s lifecycle and how it manages resources
Grasp the concept of idempotency in Terraform

2.1 Providers#

Providers are plugins that Terraform uses to interact with APIs of cloud providers and other services.

How Providers Work#

Terraform Core → Provider Plugin → API → Cloud Provider
     (HCL)           (Go)       (REST)     (AWS/GCP/Azure)

Important Provider Concepts#

Concept	Explanation
Source	Location where provider is downloaded from (e.g., `hashicorp/aws`)
Version	Provider version constraint (e.g., `~> 5.0`)
Configuration	Provider-level settings (region, credentials, etc.)
Resources	What the provider can create/manage
Data Sources	What the provider can read/query

Provider Example#

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
  # Optionally use a profile
  # profile = "my-profile"

  # Optionally assume a role
  # assume_role {
  #   role_arn     = "arn:aws:iam::ACCOUNT_ID:role/MyRole"
  #   session_name = "TerraformSession"
  # }
}

provider "random" {
  # No configuration needed for random provider
}

Provider Version Constraints (Exam Critical)#

Constraint	Meaning	Example
`= 5.0`	Exact version	`version = "= 5.0.0"`
`~> 5.0`	>= 5.0 and < 6.0 (minor updates allowed)	`version = "~> 5.0"`
`>= 5.0`	Any version >= 5.0	`version = ">= 5.0"`
`>= 5.0, < 5.10`	Range	`version = ">= 5.0, < 5.10"`
`~> 5.4.0`	>= 5.4.0 and < 5.5.0 (patch updates only)	`version = "~> 5.4.0"`

Exam Tip: The ~> (pessimistic constraint) operator is frequently tested. Remember: ~> 5.0 means >= 5.0, < 6.0 and ~> 5.4.0 means >= 5.4.0, < 5.5.0.

Chapter 3: HCL Configuration Language

Mon, 01 Jan 0001 00:00:00 +0000

Chapter 3: HCL Configuration Language#

🎯 Learning Objectives#

Master HCL syntax and structure
Understand Terraform data types
Use expressions and interpolation
Work with collections and for expressions
Understand type constraints and validation

3.1 HCL Syntax Basics#

HCL (HashiCorp Configuration Language) is designed to be human-readable and machine-friendly.

Comments#

# This is a single-line comment

// This is also a single-line comment

/* This is a
   multi-line comment */

Basic Syntax Structure#

<BLOCK TYPE> "<LABEL 1>" "<LABEL 2>" {
  # Body with arguments
  <ARGUMENT NAME> = <VALUE>
  
  # Nested blocks
  <BLOCK TYPE> {
    <ARGUMENT NAME> = <VALUE>
  }
}

Example#

# Block type: resource, Labels: "aws_instance" and "web"
resource "aws_instance" "web" {
  # Argument
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
  
  # Nested block
  ebs_block_device {
    device_name = "/dev/xvda"
    volume_size = 20
  }
  
  # Map argument
  tags = {
    Name        = "Web Server"
    Environment = "Production"
  }
}

3.2 Data Types#

Primitive Types#

Type	Description	Examples
`string`	Text value	`"hello"`, `"ami-12345"`
`number`	Numeric value	`42`, `3.14`, `-7`
`bool`	Boolean	`true`, `false`

Complex Types#

Type	Description	Example
`list(TYPE)`	Ordered collection	`["us-east-1a", "us-east-1b"]`
`map(TYPE)`	Key-value pairs	`{Name = "Web", Env = "Prod"}`
`set(TYPE)`	Unordered unique collection	`["a", "b", "c"]` (no duplicates)
`object({...})`	Structured with named attributes	`{name = "John", age = 30}`
`tuple([...])`	Sequence with different types	`["hello", 42, true]`

Type Examples#

# Strings
variable "name" {
  type    = string
  default = "my-instance"
}

# Numbers
variable "instance_count" {
  type    = number
  default = 3
}

# Booleans
variable "enable_monitoring" {
  type    = bool
  default = true
}

# Lists
variable "availability_zones" {
  type    = list(string)
  default = ["us-east-1a", "us-east-1b", "us-east-1c"]
}

# Maps
variable "instance_tags" {
  type = map(string)
  default = {
    Name        = "WebServer"
    Environment = "Development"
    Owner       = "DevOps"
  }
}

# Objects (structured data)
variable "instance_config" {
  type = object({
    instance_type = string
    ami_id        = string
    root_volume   = number
    environment   = string
  })
  default = {
    instance_type = "t2.micro"
    ami_id        = "ami-0c55b159cbfafe1f0"
    root_volume   = 20
    environment   = "dev"
  }
}

# Tuples (mixed types)
variable "mixed_data" {
  type    = tuple([string, number, bool])
  default = ["us-east-1", 3, true]
}

# Optional type with nullable
variable "optional_value" {
  type     = string
  default  = null
  nullable = true
}

# Any type
variable "flexible" {
  type = any
}

3.3 Expressions and Interpolation#

String Interpolation#

# Basic interpolation: ${ ... }
resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = var.instance_type
  
  tags = {
    Name = "WebServer-${var.environment}"
    #                     ↑ Interpolation
  }
}

# String templates
output "message" {
  value = "Instance ${aws_instance.web.id} is running in ${var.region}"
}

String Heredoc Syntax#

# Heredoc string (preserves formatting)
locals {
  user_data = <<-EOF
    #!/bin/bash
    echo "Hello from ${var.environment}"
    sudo yum install -y httpd
    sudo systemctl enable httpd
    sudo systemctl start httpd
  EOF
}

# JSON heredoc
locals {
  policy = <<JSON
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::${local.bucket_name}/*"
    }
  ]
}
JSON
}

Template Files#

# user_data.sh.tftpl (template file)
#!/bin/bash
echo "Instance ID: ${id}"
echo "Environment: ${environment}"
echo "Region: ${region}"

# In main.tf
resource "aws_instance" "web" {
  user_data = templatefile("${path.module}/user_data.sh.tftpl", {
    id          = aws_instance.web.id
    environment = var.environment
    region      = var.region
  })
}

3.4 Operators#

Arithmetic Operators#

locals {
  sum     = 5 + 3     # 8
  diff    = 10 - 3    # 7
  product = 4 * 2     # 8
  quot    = 10 / 3    # 3 (integer division)
  rem     = 10 % 3    # 1 (remainder)
  neg     = -5        # -5
}

Comparison Operators#

locals {
  a = 5
  b = 10
  
  eq  = a == b     # false
  ne  = a != b     # true
  lt  = a < b      # true
  le  = a <= b     # true
  gt  = a > b      # false
  ge  = a >= b     # false
}

Logical Operators#

variable "enable"  { default = true }
variable "verbose" { default = false }

locals {
  # Logical operators
  and_result = var.enable && var.verbose  # false
  or_result  = var.enable || var.verbose  # true
  not_result = !var.enable                # false
}

Conditional Expressions#

# Syntax: condition ? true_value : false_value

variable "environment" {
  type    = string
  default = "production"
}

locals {
  instance_type = var.environment == "production" ? "t3.large" : "t2.micro"
  #                                 ↑ condition          ↑ true    ↑ false
  
  # Nested condition
  sizing = var.environment == "production" ? "large" : (
    var.environment == "staging" ? "medium" : "small"
  )
}

resource "aws_instance" "web" {
  instance_type = local.instance_type
}

# Conditional resource creation
resource "aws_instance" "monitoring" {
  count = var.enable_monitoring ? 1 : 0
  # Only creates if monitoring is enabled
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t3.nano"
}

3.5 For Expressions#

for expressions transform complex data types.

Chapter 4: Resources, Data Sources & Meta-Arguments

Mon, 01 Jan 0001 00:00:00 +0000

Chapter 4: Resources, Data Sources & Meta-Arguments#

🎯 Learning Objectives#

Master resource configuration and attributes
Use data sources to query existing infrastructure
Understand and apply meta-arguments (count, for_each, depends_on, lifecycle)
Handle resource dependencies and creation order
Use dynamic blocks for flexible configurations

4.1 Resources Deep Dive#

Resource Behavior (Exam Critical)#

Terraform resources have specific behaviors based on which attributes change:

Change Type	Behavior	Example
In-place update	Resource modified without destroying	Changing tags on an instance
Recreation	Destroyed and re-created	Changing AMI on an EC2 instance
Destroy and recreate	Old destroyed, new created (order depends on lifecycle)	Changing immutable field

Resource Behaviors#

resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
  
  # Some changes cause recreation
  # Changing AMI → forces recreation
  # Changing instance_type → forces recreation (for most instance types)
  # Changing tags → in-place update
  
  tags = {
    Name = "WebServer"
  }
}

# What "forces new resource" is documented in each resource's docs
# Example from AWS provider docs:
# "ami" - (Required) ... Forces new resource
# "instance_type" - (Optional) ... Not all instance types force new resource

4.2 Resource Meta-Arguments#

`count` — Create Multiple Resources from a Count#

variable "instance_count" {
  type    = number
  default = 3
}

# Create 3 EC2 instances
resource "aws_instance" "web" {
  count = var.instance_count
  #   ↑ Creates this many instances
  
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
  
  # Use count.index to differentiate instances
  tags = {
    Name = "WebServer-${count.index + 1}"
    #                          ↑ 0, 1, 2 → WebServer-1, WebServer-2, WebServer-3
  }
}

# Accessing resources created with count
output "instance_ids" {
  value = aws_instance.web[*].id
  # Returns all instance IDs as a list
}

output "first_instance" {
  value = aws_instance.web[0].id
  # Access specific index
}

`for_each` — Create Resources from a Map or Set#

# For each from a map
variable "users" {
  type = map(object({
    role        = string
    groups      = list(string)
  }))
  default = {
    "alice" = { role = "developer", groups = ["dev", "read-only"] }
    "bob"   = { role = "admin",      groups = ["admin", "devops"] }
  }
}

resource "aws_iam_user" "this" {
  for_each = var.users
  #   ↑ Creates one resource per map entry
  
  name = each.key
  #     ↑ "alice", "bob"
  
  tags = {
    Role = each.value.role
    #     ↑ "developer", "admin"
  }
}

# For each from a set
resource "aws_iam_user_group_membership" "this" {
  for_each = var.users
  
  user = each.key
  groups = each.value.groups
}

# For each with a list (convert to set first)
variable "instance_names" {
  type    = list(string)
  default = ["web", "app", "db"]
}

resource "aws_instance" "web" {
  for_each = toset(var.instance_names)
  #                ↑ Converts list to set for for_each
  
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
  
  tags = {
    Name = "${each.key}-instance"
    #     ↑ "web-instance", "app-instance", "db-instance"
  }
}

`count` vs `for_each` — When to Use Which (Exam Critical)#

Use Case	Use `count`	Use `for_each`
Simple numbered resources	✅	❌
Resources from a map	❌	✅
Resources need unique names	❌	✅
You need to delete specific items	❌ (shifts indexes)	✅ (stable keys)
Resources from a list	✅	✅ (use `toset()`)
Conditional resource creation	✅ (`count = 0 or 1`)	❌

Important: With count, if you remove an item from the middle of a list, all subsequent resources get recreated (index shift). With for_each, each resource has a stable key, so removing one doesn’t affect others.

Chapter 5: Variables, Outputs & Locals

Mon, 01 Jan 0001 00:00:00 +0000

Chapter 5: Variables, Outputs & Locals#

🎯 Learning Objectives#

Define and use input variables with proper type constraints
Understand variable definition precedence
Use output values to share information
Create local values for cleaner configurations
Implement variable validation and error handling
Handle sensitive data correctly

5.1 Input Variables#

Input variables make Terraform configurations parameterizable and reusable.

Variable Declaration#

# variables.tf
variable "instance_type" {
  description = "EC2 instance type"
  type        = string
  default     = "t2.micro"
}

variable "environment" {
  description = "Deployment environment"
  type        = string
}

Variable Attributes (Exam Critical)#

Attribute	Required	Description
`type`	No (defaults to `any`)	Type constraint (string, number, bool, list, map, object, etc.)
`description`	No	Human-readable description
`default`	No	Default value if none provided (variable is optional if default is set)
`validation`	No	Custom validation rules
`sensitive`	No	Marks value as sensitive in logs/outputs (default: false)
`nullable`	No	Whether variable can be null (default: false)

Variable Definition Precedence (Exam Critical)#

Variables can be set in multiple ways. The order of precedence (highest to lowest) is:

Chapter 6: State Management

Mon, 01 Jan 0001 00:00:00 +0000

Chapter 6: State Management#

🎯 Learning Objectives#

Understand Terraform state and why it’s critical
Configure remote state backends (S3, etc.)
Implement state locking with DynamoDB
Manage state across teams and environments
Handle state migration and recovery
Use terraform_remote_state data source

6.1 What is Terraform State?#

State is the mapping between your Terraform configuration and the real-world infrastructure. It’s stored in terraform.tfstate by default.

What State Contains#

{
  "version": 4,
  "terraform_version": "1.9.0",
  "resources": [
    {
      "module": "",
      "mode": "managed",
      "type": "aws_instance",
      "name": "web",
      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
      "instances": [
        {
          "schema_version": 1,
          "attributes": {
            "id": "i-0abcd1234efgh5678",
            "ami": "ami-0c55b159cbfafe1f0",
            "availability_zone": "us-east-1a",
            "instance_state": "running",
            "instance_type": "t2.micro",
            "private_ip": "10.0.1.5",
            "public_ip": "54.123.45.67",
            "subnet_id": "subnet-12345678",
            "tags": {
              "Name": "WebServer"
            },
            "vpc_security_group_ids": ["sg-12345678"]
          },
          "dependencies": [
            "aws_security_group.web"
          ]
        }
      ]
    }
  ]
}

Why State is Essential (Exam Critical)#

Purpose	Explanation
Mapping	Maps config resources to real-world resources (by ID)
Metadata	Stores resource attributes, dependencies, and provider metadata
Performance	Caches attribute values instead of querying API for every resource
Syncing	Enables team collaboration with remote state
Drift Detection	Compares config vs state vs real-world to detect changes

6.2 Local State (Default)#

How Local State Works#

# Default: state stored in current directory
terraform apply  # Creates terraform.tfstate
                 # Creates terraform.tfstate.backup

Problems with Local State#

Problem	Impact
Single point of failure	Lose the file → lose track of resources
No team collaboration	Only one person can run Terraform at a time
No state locking	Concurrent runs can corrupt state
No version history	Can’t see what changed and when

# terraform { } BACKEND CONFIGURATION IS THE KEY. 
terraform {
  backend "local" {
    path = "terraform.tfstate"
  }
}

6.3 Remote State Backends#

Remote state stores the state file in a shared, durable location.

Chapter 7: Terraform Modules

Mon, 01 Jan 0001 00:00:00 +0000

Chapter 7: Terraform Modules#

🎯 Learning Objectives#

Understand what modules are and why they’re important
Create and use local modules
Publish and consume modules from the Terraform Registry
Design reusable modules with proper interfaces
Implement module versioning and testing
Understand module composition and nesting

7.1 What are Modules?#

Modules are self-contained packages of Terraform configurations that are managed as a group. They’re the primary way to package and reuse infrastructure code.

Chapter 8: Workspaces & Environments

Mon, 01 Jan 0001 00:00:00 +0000

Chapter 8: Workspaces & Environments#

🎯 Learning Objectives#

Understand Terraform workspaces and when to use them
Compare workspace-based vs directory-based environment strategies
Implement multi-environment deployment patterns
Manage environment-specific configurations
Understand the pros and cons of each approach

8.1 What are Workspaces?#

Workspaces allow you to manage multiple distinct sets of infrastructure resources using the same configuration.

Same Terraform Configuration
         │
    ┌────┴────┐
    │         │
  Workspace  Workspace
    dev       prod
    │         │
  State A   State B

Workspace State Storage#

# Default workspace
terraform workspace show  # "default"

# Workspace state files in S3:
# env:/default/my-app/terraform.tfstate
# env:/dev/my-app/terraform.tfstate
# env:/prod/my-app/terraform.tfstate

Basic Workspace Commands#

# Create workspaces
terraform workspace new dev
terraform workspace new staging
terraform workspace new prod

# Switch workspace
terraform workspace select staging

# List all workspaces
terraform workspace list

# Show current workspace
terraform workspace show

# Delete workspace (must be empty of resources)
terraform workspace delete old-workspace

8.2 Using Workspaces in Configuration#

Workspace in Configuration#

# Use terraform.workspace for environment-specific values
locals {
  # The current workspace name
  environment = terraform.workspace
  
  # Environment-specific configurations
  instance_type = {
    default = "t2.micro"
    dev     = "t2.nano"
    staging = "t2.small"
    prod    = "t3.large"
  }
  
  # Look up the current workspace's instance type
  current_instance_type = lookup(local.instance_type, terraform.workspace, "t2.micro")
  
  # Environment-specific tags
  common_tags = {
    Environment = terraform.workspace
    ManagedBy   = "Terraform"
    Name        = "${var.project_name}-${terraform.workspace}"
  }
}

resource "aws_instance" "web" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = local.current_instance_type  # Different per workspace
  
  tags = local.common_tags
}

# Workspace-specific counts
resource "aws_instance" "app" {
  count = terraform.workspace == "prod" ? 3 : 1
  ami   = data.aws_ami.ubuntu.id
  instance_type = "t3.small"
  
  tags = local.common_tags
}

Workspace-Specific Variable Files#

# dev.workspace.tfvars
instance_type = "t2.nano"
instance_count = 1
enable_monitoring = false

# staging.workspace.tfvars
instance_type = "t2.small"
instance_count = 2
enable_monitoring = true

# prod.workspace.tfvars
instance_type = "t3.large"
instance_count = 5
enable_monitoring = true

# Apply with workspace-specific variables
terraform workspace select dev
terraform apply -var-file="dev.workspace.tfvars"

terraform workspace select prod
terraform apply -var-file="prod.workspace.tfvars"

8.3 Workspace Limitations (Exam Critical)#

Limitation	Explanation
No isolation	Workspaces share the same backend configuration
No provider config	Can’t have different providers per workspace
No variable locking per workspace	One lock per entire workspace set
Code branches can diverge	Different workspaces may have different code versions
Testing complexity	Harder to test workspaces in isolation

When to Use Workspaces (Exam Critical)#

✅ Good for:

Chapter 9: Functions, Expressions & Dynamic Blocks

Mon, 01 Jan 0001 00:00:00 +0000

Chapter 9: Functions, Expressions & Dynamic Blocks#

🎯 Learning Objectives#

Master Terraform’s built-in functions
Use conditional expressions effectively
Implement for expressions and splat expressions
Create dynamic blocks for flexible configurations
Understand templatefile and string functions

9.1 Complete Function Reference by Category#

Numeric Functions#

locals {
  # Basic arithmetic
  max_val   = max(5, 12, 3, 8)        # 12
  min_val   = min(5, 12, 3, 8)        # 3
  
  # Rounding
  ceil_val  = ceil(4.3)                # 5
  floor_val = floor(4.7)               # 4
  
  # Absolute value
  abs_val   = abs(-7)                  # 7
  
  # Sign and modulo
  signum_neg = signum(-10)             # -1
  signum_pos = signum(10)              # 1
  signum_zero = signum(0)              # 0
  
  # Parse from string
  parseint_result = parseint("42", 10)  # 42
  parseint_hex    = parseint("FF", 16)  # 255
  
  # Format number
  formatnum_default = formatnum(1234567.89)       # "1234567.89"
  formatnum_compact = formatnum(1234567.89, "compact")  # "1.2M"
}

String Functions#

locals {
  # Case conversion
  upper_case = upper("hello world")     # "HELLO WORLD"
  lower_case = lower("HELLO WORLD")     # "hello world"
  title_case = title("hello world")     # "Hello World"
  
  # Substring
  substr_first3 = substr("hello", 0, 3)  # "hel"
  substr_mid2   = substr("hello", 1, 3)  # "ell"
  
  # Join and split
  joined = join("-", ["a", "b", "c"])    # "a-b-c"
  split  = split(",", "a,b,c")           # ["a", "b", "c"]
  split_csv = split(",", "a,b,c,d,e")    # ["a", "b", "c", "d", "e"]
  
  # Trim
  trim_space = trimspace("  hello  ")    # "hello"
  trim_all   = trim("!hello!", "!")      # "hello"
  trim_prefix = trimprefix("hello_world", "hello_")  # "world"
  trim_suffix = trimsuffix("hello_world", "_world")  # "hello"
  
  # Replace
  replace_simple = replace("hello world", "world", "terraform")  # "hello terraform"
  replace_regex  = replace("hello 123 world", "/[0-9]+/", "###")  # "hello ### world"
  
  # Format
  fmt1 = format("Hello %s!", "World")                      # "Hello World!"
  fmt2 = format("Price: $%.2f", 19.99)                     # "Price: $19.99"
  fmt3 = format("IP: %d.%d.%d.%d", 10, 0, 1, 5)           # "IP: 10.0.1.5"
  
  # Format list
  fmt_list = formatlist("ec2-%s-%02d", ["web", "app"], [1, 2])
  # Result: ["ec2-web-01", "ec2-app-02"]
  
  # Regex
  regex_match = regex("([a-z]+)-([0-9]+)", "web-01")      # ["web", "01"]
  regex_all   = regexall("[a-z]+", "hello 123 world 456")  # ["hello", "world"]
  
  # String contains
  strcontains = strcontains("hello_world", "world")        # true
  
  # Repeat
  repeated = repeat("ab", 3)    # "ababab"
  
  # Reverse
  reversed = strrev("hello")    # "olleh"
  
  # Convert to string
  tostring_val = tostring(42)   # "42"
  
  # Text encoding
  base64enc = textencodebase64("hello", "UTF-8")  # base64 encoded "hello"
  base64dec = textdecodebase64("aGVsbG8=", "UTF-8")  # "hello"
}

Collection Functions#

locals {
  list_a    = ["a", "b", "c"]
  list_b    = ["c", "d", "e"]
  num_list  = [1, 2, 3, 4, 5]
  
  # Length
  len_list = length(local.list_a)           # 3
  
  # Concatenation
  concat_res = concat(local.list_a, local.list_b)  # ["a", "b", "c", "c", "d", "e"]
  
  # Distinct (remove duplicates)
  distinct_res = distinct(local.concat_res)  # ["a", "b", "c", "d", "e"]
  
  # Contains check
  contains_a = contains(local.list_a, "a")   # true
  contains_z = contains(local.list_a, "z")   # false
  
  # Element access
  element_1  = element(local.list_a, 1)       # "b"
  element_5  = element(local.list_a, 5)       # "a" (wraps around!)
  # element_5 with wrap-around: index 5 → 5 % 3 = 2 → local.list_a[2] = "c"
  
  # Index of element
  index_of_b = index(local.list_a, "b")       # 1
  
  # Lookup in map
  my_map     = {a = 1, b = 2, c = 3}
  lookup_a   = lookup(local.my_map, "a", 0)    # 1
  lookup_d   = lookup(local.my_map, "d", 99)   # 99 (default)
  
  # Keys and values
  map_keys   = keys(local.my_map)              # ["a", "b", "c"]
  map_values = values(local.my_map)            # [1, 2, 3]
  
  # Merge maps
  map1 = {a = 1, b = 2}
  map2 = {c = 3, d = 4}
  merged = merge(local.map1, local.map2)       # {a = 1, b = 2, c = 3, d = 4}
  
  # Override merge (later values override earlier)
  map3 = {a = 10, b = 20}
  merged_override = merge(local.map1, local.map3)  # {a = 10, b = 20}
  
  # Flatten nested lists
  nested = [["a", "b"], ["c"], [], ["d", "e"]]
  flat   = flatten(local.nested)              # ["a", "b", "c", "d", "e"]
  
  # All true / any true
  all_true  = alltrue([true, true, false])    # false
  any_true  = anytrue([false, true, false])   # true
  
  # Sum
  sum_nums = sum(local.num_list)              # 15
  
  # Reverse list
  reversed = reverse(local.list_a)            # ["c", "b", "a"]
  
  # Slice
  sliced = slice(local.list_a, 0, 2)          # ["a", "b"]
  
  # Sort
  unsorted = ["c", "a", "b"]
  sorted   = sort(local.unsorted)             # ["a", "b", "c"]
  
  # Zipmap (combine two lists into a map)
  keys_list   = ["a", "b", "c"]
  values_list = [1, 2, 3]
  zipped = zipmap(local.keys_list, local.values_list)  # {a = 1, b = 2, c = 3}
  
  # Chunklist (split into chunks)
  chunks = chunklist([1, 2, 3, 4, 5, 6, 7], 3)  # [[1,2,3], [4,5,6], [7]]
  
  # Compact (remove empty/null)
  with_empty = ["a", "", "b", null, "c"]
  compacted  = compact(local.with_empty)     # ["a", "b", "c"]
  
  # Coalesce (first non-null)
  coalesce_res = coalesce(null, "", "hello")  # "hello"
  
  # Coalescelist (first non-empty list)
  coalescelist_res = coalescelist([], ["a"], ["b"])  # ["a"]
  
  # Matchkeys
  # (advanced: returns elements from list where corresponding element in key list matches values in search set)
}

CIDR/IP Network Functions#

locals {
  # CIDR subnetting
  vpc_cidr = "10.0.0.0/16"
  
  # Create subnets: cidrsubnet(prefix, newbits, netnum)
  subnet_a = cidrsubnet(local.vpc_cidr, 8, 0)   # "10.0.0.0/24"
  subnet_b = cidrsubnet(local.vpc_cidr, 8, 1)   # "10.0.1.0/24"
  subnet_c = cidrsubnet(local.vpc_cidr, 8, 255)  # "10.0.255.0/24"
  
  # Multiple subnets with for expression
  subnets = [for i in range(4) : cidrsubnet("10.0.0.0/16", 8, i)]
  # ["10.0.0.0/24", "10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  
  # CIDR host addresses
  host_10 = cidrhost("10.0.0.0/24", 10)   # "10.0.0.10"
  host_1  = cidrhost("10.0.0.0/24", 1)    # "10.0.0.1"
  
  # CIDR netmask
  netmask_24 = cidrnetmask("10.0.0.0/24")  # "255.255.255.0"
  netmask_16 = cidrnetmask("10.0.0.0/16")  # "255.255.0.0"
  
  # CIDR subnet ranges
  cidr_range = cidrsubnets("10.0.0.0/16", 4, 4, 8, 8)
  # Result: ["10.0.0.0/20", "10.0.16.0/20", "10.0.32.0/24", "10.0.33.0/24"]
  
  # CIDR contains check
  contains10_0 = cidrcontains("10.0.0.0/8", "10.0.1.5")     # true
  contains11   = cidrcontains("10.0.0.0/8", "11.0.0.1")     # false
}

Encoding/Decoding Functions#

locals {
  # Base64
  b64enc  = base64encode("hello world")     # "aGVsbG8gd29ybGQ="
  b64dec  = base64decode("aGVsbG8gd29ybGQ=")  # "hello world"
  
  # Base64 Gzip
  b64gzip = base64gzip("hello world")       # Gzipped then base64 encoded
  
  # JSON
  json_obj = {
    name  = "John"
    age   = 30
    items = ["a", "b"]
  }
  
  json_encoded = jsonencode(local.json_obj)  # '{"age":30,"items":["a","b"],"name":"John"}'
  json_decoded = jsondecode(local.json_encoded)
  
  # YAML
  yaml_encoded = yamlencode({
    name = "John"
    age  = 30
  })
  # "age": 30
  # "name": "John"
  
  yaml_stream = yamlencode([
    { name = "John", age = 30 },
    { name = "Jane", age = 25 }
  ])
  
  yaml_decoded = yamldecode(local.yaml_encoded)
  
  # URL encoding
  url_enc = urlencode("hello world")        # "hello+world"
  url_dec = urldecode("hello+world")        # "hello world"
  
  # CSV decode
  csv_data = csvdecode("name,age\nJohn,30\nJane,25")
  # [{name = "John", age = "30"}, {name = "Jane", age = "25"}]
}

Date and Time Functions#

locals {
  # Current timestamp (UTC)
  now = timestamp()    # "2024-01-15T10:30:00Z"
  
  # Format timestamp
  formatted = formatdate("YYYY-MM-DD hh:mm:ss", local.now)
  # "2024-01-15 10:30:00"
  
  # Date parts
  year    = formatdate("YYYY", local.now)     # "2024"
  month   = formatdate("MM", local.now)       # "01"
  day     = formatdate("DD", local.now)       # "15"
  hour    = formatdate("hh", local.now)       # "10"
  
  # Time arithmetic
  tomorrow    = timeadd(local.now, "24h")
  next_week   = timeadd(local.now, "168h")
  next_month  = timeadd(local.now, "720h")
  last_hour   = timeadd(local.now, "-1h")
  
  # Time comparison
  time1 = "2024-01-15T10:00:00Z"
  time2 = "2024-01-15T11:00:00Z"
  
  # Plantimestamp (epoch seconds)
  epoch = plantimestamp()  # 1705312200 (seconds since epoch)
}

File and Filesystem Functions#

locals {
  # Read file content
  user_data_script = file("${path.module}/scripts/install.sh")
  
  # Read and decode JSON
  policy = file("${path.module}/policies/policy.json")
  policy_decoded = jsondecode(local.policy)
  
  # Read and decode YAML
  config_file = file("${path.module}/config/config.yaml")
  config = yamldecode(local.config_file)
  
  # Template file
  rendered_user_data = templatefile("${path.module}/templates/cloud-init.sh.tftpl", {
    hostname   = var.hostname
    s3_bucket  = aws_s3_bucket.data.bucket
    region     = var.region
  })
  
  # File existence check
  # fileexists("${path.module}/config.yml")
  
  # Template files
  tmpl = templatefile("${path.module}/templates/config.json.tftpl", {
    server_name = var.name
    port        = var.port
    debug       = var.debug
  })
}

Hash and Crypto Functions#

locals {
  # MD5
  md5_hash = md5("hello")    # "5d41402abc4b2a76b9719d911017c592"
  
  # SHA1
  sha1_hash = sha1("hello")  # "aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d"
  
  # SHA256
  sha256_hash = sha256("hello")
  # "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
  
  # SHA512
  sha512_hash = sha512("hello")
  
  # HMAC (keyed-hash)
  hmac_hash = hmac("sha256", "message", "secret")
  
  # UUID
  uuid_result = uuid()        # Random UUID v4
  uuid_v5     = uuidv5("dns", "example.com")  # UUID v5 based on namespace + data
  
  # Base64 SHA
  b64sha256 = base64sha256("hello")
  b64sha512 = base64sha512("hello")
}

9.2 Advanced Conditional Patterns#

Multi-Condition Logic#

variable "environment" {}
variable "instance_count" {}

locals {
  # Complex conditional logic
  config = {
    # Production defaults
    prod = {
      instance_type  = "t3.large"
      min_size      = 3
      max_size      = 20
      multi_az      = true
      monitoring    = true
    }
    # Staging defaults
    staging = {
      instance_type = "t3.medium"
      min_size     = 1
      max_size     = 5
      multi_az     = false
      monitoring   = true
    }
    # Default for everything else
    default = {
      instance_type = "t2.micro"
      min_size     = 1
      max_size     = 3
      multi_az     = false
      monitoring   = false
    }
  }
  
  env_config = lookup(local.config, var.environment, local.config.default)
}

resource "aws_autoscaling_group" "app" {
  min_size         = local.env_config.min_size
  max_size         = local.env_config.max_size
  desired_capacity = local.env_config.min_size
}

Null Checks and Defaults#

variable "optional_config" {
  type = object({
    instance_type = optional(string)
    volume_size   = optional(number)
    ami_id        = optional(string)
  })
  default = null  # Entire variable is optional
}

locals {
  # Handle null with defaults
  instance_type = try(var.optional_config.instance_type, "t2.micro")
  volume_size   = try(var.optional_config.volume_size, 20)
  ami_id        = try(var.optional_config.ami_id, data.aws_ami.default.id)
  
  # Alternative: coalesce
  instance_type2 = coalesce(
    try(var.optional_config.instance_type, null),
    "t2.micro"
  )
}

9.3 For Expressions - Advanced Patterns#

For expressions with collections#

locals {
  # List transformations
  numbers = [1, 2, 3, 4, 5]
  
  # Transform each element
  doubled = [for n in local.numbers : n * 2]  # [2, 4, 6, 8, 10]
  
  # Filter and transform
  even_doubled = [for n in local.numbers : n * 2 if n % 2 == 0]  # [4, 8]
  
  # Map transformations
  name_map = {
    alice = { age = 30, role = "admin" }
    bob   = { age = 25, role = "user" }
    carol = { age = 35, role = "admin" }
  }
  
  # Transform map values
  roles_only = { for k, v in local.name_map : k => v.role }
  # { alice = "admin", bob = "user", carol = "admin" }
  
  # Filter map by value
  admins = { for k, v in local.name_map : k => v if v.role == "admin" }
  # { alice = {...}, carol = {...} }
  
  # Transform values while keeping keys
  names_upper = { for k, v in local.name_map : k => merge(v, { name = upper(k) }) }
  
  # Nested for expressions
  matrix = [[1, 2], [3, 4], [5, 6]]
  flattened_sum = [for row in local.matrix : sum(row)]  # [3, 7, 11]
  
  # For expressions with element index
  indexed = [for i, v in ["a", "b", "c"] : "${i}: ${v}"]
  # ["0: a", "1: b", "2: c"]
}

Practical Example: Security Group Rules from Config#

locals {
  # Complex security rules
  security_rules = [
    { type = "ingress", port = 80,   cidr = "0.0.0.0/0",         desc = "HTTP" },
    { type = "ingress", port = 443,  cidr = "0.0.0.0/0",         desc = "HTTPS" },
    { type = "ingress", port = 22,   cidr = "10.0.0.0/8",        desc = "SSH internal" },
    { type = "egress",  port = 0,    cidr = "0.0.0.0/0",         desc = "All outbound" },
  ]
  
  # Create dynamic security group rules
  ingress_rules = [for rule in local.security_rules : rule if rule.type == "ingress"]
  egress_rules  = [for rule in local.security_rules : rule if rule.type == "egress"]
}

9.4 Dynamic Blocks - Advanced Patterns#

Conditional Dynamic Blocks#

variable "create_eip" {
  type    = bool
  default = false
}

variable "ebs_volumes" {
  type = list(object({
    device_name = string
    size        = number
    type        = string
    encrypted   = bool
  }))
  default = []
}

resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"

  # Conditional EBS block device
  dynamic "ebs_block_device" {
    for_each = var.ebs_volumes
    content {
      device_name = ebs_block_device.value.device_name
      volume_size = ebs_block_device.value.size
      volume_type = ebs_block_device.value.type
      encrypted   = ebs_block_device.value.encrypted
    }
  }
}

# Conditional resource creation with dynamic block on EIP
resource "aws_eip" "web" {
  count    = var.create_eip ? 1 : 0
  instance = aws_instance.web.id
  domain   = "vpc"
}

Nested Dynamic Blocks#

variable "listener_rules" {
  type = list(object({
    port        = number
    protocol    = string
    actions     = list(object({
      type             = string
      target_group_arn = optional(string)
      redirect_config  = optional(object({
        status_code = string
        protocol    = optional(string)
        port        = optional(string)
        host        = optional(string)
        path        = optional(string)
        query       = optional(string)
      }))
    }))
  }))
}

resource "aws_lb_listener" "main" {
  load_balancer_arn = aws_lb.main.arn
  port              = var.listener_rules[0].port
  protocol          = var.listener_rules[0].protocol

  dynamic "default_action" {
    for_each = var.listener_rules[0].actions
    content {
      type = default_action.value.type
      
      dynamic "redirect" {
        for_each = default_action.value.redirect_config != null ? [default_action.value.redirect_config] : []
        content {
          status_code = redirect.value.status_code
          protocol    = try(redirect.value.protocol, null)
          port        = try(redirect.value.port, null)
          host        = try(redirect.value.host, null)
          path        = try(redirect.value.path, null)
          query       = try(redirect.value.query, null)
        }
      }
      
      dynamic "forward" {
        for_each = default_action.value.target_group_arn != null ? [1] : []
        content {
          target_group_arn = default_action.value.target_group_arn
        }
      }
    }
  }
}

9.5 try and can Functions#

try() — Graceful Error Handling#

locals {
  # try attempts each expression, returns first successful result
  result1 = try(local.nonexistent, "default_value")  # "default_value"
  
  # Can chain multiple expressions
  result2 = try(
    var.config.option_a,
    var.config.option_b,
    "ultimate_default"
  )
  
  # Common use: handling missing attributes
  instance_profile = try(
    aws_iam_instance_profile.this.arn,
    null
  )
}

# Using try for resource attribute access
output "instance_ip" {
  value = try(
    aws_eip.web[0].public_ip,           # Try EIP first
    aws_instance.web.public_ip,         # Fall back to instance IP
    "No IP assigned"                    # Ultimate fallback
  )
}

can() — Test if Expression Succeeds#

locals {
  can_access = can(aws_instance.web.public_ip)  # true or false
}

variable "should_create_extra_disk" {
  type    = bool
  default = false
}

# Using can for validation
variable "vpc_id" {
  type = string
  
  validation {
    condition = can(regex("^vpc-", var.vpc_id))
    error_message = "VPC ID must start with 'vpc-'."
  }
}

9.6 Type Conversion Functions#

locals {
  # String conversions
  to_string  = tostring(42)              # "42"
  to_string2 = tostring(true)            # "true"
  
  # Number conversions
  to_number  = tonumber("42")             # 42
  to_number2 = tonumber("3.14")           # 3.14
  to_number3 = tonumber("not_a_number")   # null (doesn't error)
  
  # Boolean conversions
  to_bool_true  = tobool("true")          # true
  to_bool_false = tobool("false")         # false
  
  # List/list conversions
  list_any  = tolist(["a", "b", "c"])     # list(any)
  set_any   = toset(["a", "b", "b", "c"]) # ["a", "b", "c"] (duplicates removed)
  map_any   = tomap({a = 1, b = 2})       # map(any)
  
  # Set to list
  set_to_list = tolist(toset([3, 1, 2]))  # [1, 2, 3] (sorted)
}

9.7 Splat Expressions - The “Any” Splat#

resource "aws_instance" "web" {
  count = 3
  
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
  
  tags = {
    Name = "web-${count.index}"
  }
}

locals {
  # The "any" splat (recommended) — resource[*].attribute
  instance_ids = aws_instance.web[*].id          # ["i-...", "i-...", "i-..."]
  public_ips   = aws_instance.web[*].public_ip    # ["54...", "55...", "56..."]
  private_ips  = aws_instance.web[*].private_ip   # ["10.0.1.5", ...]
  
  # Legacy splat (older syntax)
  legacy_ids = aws_instance.web.*.id  # Same result, less Type-safe
}

# Splat with single resource (wraps in list)
resource "aws_instance" "single" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
}

locals {
  # Single resource with splat always returns a list
  single_splat = aws_instance.single[*].id  # ["i-..."] (list with one element)
  
  # Without splat returns the value directly
  single_direct = aws_instance.single.id     # "i-..." (string)
}

9.8 Complete Practical Example#

# Complete example showing advanced functions and expressions

locals {
  # Environment configuration
  env_config = {
    dev  = { instance_type = "t2.nano",    count = 1, volume = 10 }
    stg  = { instance_type = "t2.medium",  count = 2, volume = 30 }
    prod = { instance_type = "t3.large",   count = 4, volume = 50 }
  }
  
  current_env = lookup(local.env_config, var.environment, local.env_config.dev)
  
  # CIDR calculations
  vpc_cidr = cidrsubnet("10.0.0.0/8", 8, var.az_index)
  
  public_subnets = [
    for i in range(var.az_count) :
    cidrsubnet(local.vpc_cidr, 4, i)
  ]
  
  private_subnets = [
    for i in range(var.az_count) :
    cidrsubnet(local.vpc_cidr, 4, i + var.az_count)
  ]
  
  # Tags
  common_tags = merge({
    Environment = var.environment
    ManagedBy   = "Terraform"
    Project     = var.project_name
    Role        = "web-server"
  }, var.extra_tags)
  
  # Dynamic ingress rules from variable
  ingress_rules = [
    for port, config in var.ingress_ports : {
      port       = port
      protocol   = config.protocol
      cidr_blocks = config.cidr_blocks
      description = config.description
    }
  ]
  
  # # DNS records from list
  # dns_records = {
  #   for record in var.dns_records :
  #   trimprefix(record.name, ".") => record
  # }
  
  # File-based config
  user_data_script = try(
    file("${path.module}/userdata/${var.environment}.sh"),
    file("${path.module}/userdata/default.sh")
  )
}

resource "aws_instance" "web" {
  for_each = toset(["web-a", "web-b", "web-c"])
  
  ami           = data.aws_ami.amazon_linux_2.id
  instance_type = local.current_env.instance_type
  subnet_id     = element(aws_subnet.public[*].id, index(["web-a", "web-b", "web-c"], each.key))
  
  tags = merge(local.common_tags, {
    Name = "${var.project}-${var.environment}-${each.key}"
  })
}

output "instance_info" {
  value = {
    for k, v in aws_instance.web : k => {
      id         = v.id
      public_ip  = v.public_ip
      private_ip = v.private_ip
      az         = v.availability_zone
    }
  }
}

📝 Exam Tips#

try() returns first successful expression, provides graceful fallback
can() returns true if expression succeeds, false otherwise
lookup(map, key, default) safely accesses map keys with default
cidrsubnet(prefix, bits, netnum) calculates subnet CIDR blocks
file(path) reads file contents (useful for user data, policies)
templatefile(path, vars) renders template files with variables
For expressions can transform, filter, and create collections
Splat expressions (resource[*].attr) extract attributes from lists
merge(map1, map2) combines maps (later values override)
Dynamic blocks create repeatable nested blocks

✅ Chapter 9 Quiz#

What does lookup({a = 1, b = 2}, "c", 0) return?

Chapter 10: Provisioners & Side Effects

Mon, 01 Jan 0001 00:00:00 +0000

Chapter 10: Provisioners & Side Effects#

🎯 Learning Objectives#

Understand when and why to use provisioners
Differentiate between local-exec, remote-exec, and file provisioners
Learn why provisioners are a “last resort”
Explore alternatives like user_data and cloud-init
Implement proper null_resource patterns

10.1 What Are Provisioners?#

Provisioners are used to execute scripts or commands on local or remote machines as part of resource creation or destruction.

Provisioner Types#

Provisioner	Runs on	Use Case
`file`	Local	Upload files to remote machine
`remote-exec`	Remote (SSH/WinRM)	Run scripts on remote instance
`local-exec`	Local machine	Run scripts on your own machine

Warning: Provisioners Are a Last Resort (Exam Critical)#

⚠️ HashiCorp says: "Provisioners should be used as a last resort"

Why?

Chapter 11: Terraform Cloud & Enterprise

Mon, 01 Jan 0001 00:00:00 +0000

Chapter 11: Terraform Cloud & Enterprise#

🎯 Learning Objectives#

Understand Terraform Cloud features and architecture
Configure remote execution and state management
Implement VCS-driven workflows
Use Sentinel policy as code
Manage workspaces and teams in Terraform Cloud

11.1 What is Terraform Cloud?#

Terraform Cloud is HashiCorp’s managed service that provides:

Remote state management
Team collaboration
Policy as code (Sentinel)
VCS integration (GitHub, GitLab, etc.)
Private module registry
Run tasks and cost estimation

Terraform Cloud vs Open Source#

Feature	Open Source	Terraform Cloud	Terraform Enterprise
State management	Local/S3/etc.	Managed remote	Managed remote
Team collaboration	Manual	Built-in	Built-in
VCS integration	Manual	Automatic	Automatic
Sentinel policies	❌	Limited	✅ Full
Private module registry	❌	✅	✅
Cost estimation	❌	✅	✅
SSO/SAML	❌	✅	✅
Audit logging	❌	✅	✅
Run tasks	❌	✅	✅
Self-hosted	❌	❌	✅

11.2 Terraform Cloud Architecture#

┌─────────────────────────────────────────────────────────────┐
│                      Your VCS (GitHub/GitLab)                │
└────────────────────┬──────────────────────────────────────┘
                     │ Push/Pull Request
                     ▼
┌─────────────────────────────────────────────────────────────┐
│                    Terraform Cloud                            │
│                                                              │
│  ┌──────────┐  ┌──────────┐  ┌──────────┐  ┌────────────┐ │
│  │ Workspace│  │  Runs    │  │  State   │  │  Policies  │ │
│  │ (Dev)    │  │          │  │  (Shared)│  │ (Sentinel) │ │
│  ├──────────┤  ├──────────┤  ├──────────┤  ├────────────┤ │
│  │ Workspace│  │  Runs    │  │  State   │  │  Policies  │ │
│  │ (Prod)   │  │          │  │  (Shared)│  │ (Sentinel) │ │
│  └──────────┘  └──────────┘  └──────────┘  └────────────┘ │
│                                                              │
│  ┌──────────────────────────────────────────────────────────┐│
│  │                    API / CLI                              ││
│  └──────────────────────────────────────────────────────────┘│
└─────────────────────────────────────────────────────────────┘

11.3 Remote State in Terraform Cloud#

Free Tier State Storage#

# main.tf
terraform {
  cloud {
    organization = "my-company"
    
    workspaces {
      name = "my-app-production"
    }
  }
}

Using Remote State from Other Workspaces#

# Read outputs from another workspace
data "terraform_remote_state" "vpc" {
  backend = "remote"
  
  config = {
    organization = "my-company"
    workspaces = {
      name = "vpc-production"
    }
  }
}

resource "aws_instance" "web" {
  subnet_id = data.terraform_remote_state.vpc.outputs.public_subnet_ids[0]
}

11.4 VCS-Driven Workflow#

Connecting VCS#

# Link a workspace to a VCS repo
# In Terraform Cloud UI:
# 1. Settings → Version Control → Connect to VCS
# 2. Select repository
# 3. Configure working directory

Pull Request Workflow#

Developer creates PR
        ↓
Terraform Cloud runs `terraform plan`
        ↓
Plan comment posted on PR
        ↓
Team reviews PR + plan
        ↓
PR merged to main branch
        ↓
Terraform Cloud runs `terraform apply`
        ↓
Infrastructure updated

Speculatives Plans#

# Trigger a speculative plan on a PR
# Terraform Cloud automatically creates a plan
# Plan output is posted as a PR comment
# Plan is NOT applied until merge

11.5 Workspace Configuration in Terraform Cloud#

Workspace Types#

# CLI-driven workspace
terraform {
  cloud {
    organization = "my-company"
    
    workspaces {
      name = "my-app-dev"
    }
  }
}

# VCS-driven workspace (set in cloud UI)
# Workspace connected to GitHub repo
# Auto-triggers on push to specific branch

Workspace Variables#

# Terraform variables are set in workspace UI or API
# Two types:
# 1. Terraform variables (Terraform inputs)
# 2. Environment variables (for providers, etc.)

# In workspace UI:
# Key:   AWS_ACCESS_KEY_ID
# Value: AKIAIOSFODNN7EXAMPLE
# Type:  Environment Variable (sensitive)

# Key:   instance_type
# Value: t2.micro
# Type:  Terraform Variable

Workspace Settings#

# Workspace execution mode
# - Local: Runs on your machine
# - Remote: Runs on Terraform Cloud
# - Agent: Runs on self-hosted agent

# Workspace terraform version
# - Version specified or "latest"

11.6 Remote Execution#

Local vs Remote Execution#

# Local execution (default for CLI-driven)
terraform {
  cloud {
    organization = "my-company"
    
    workspaces {
      name = "my-app-local"
    }
    
    # Default: Runs plan locally, state stored in cloud
  }
}

# Running locally
terraform plan    # Reads remote state, plans locally
terraform apply   # Applies locally, state stored in cloud

# Remote execution
# Set in workspace settings: Execution Mode = "Remote"
# All runs happen on Terraform Cloud servers

# With remote execution:
# terraform plan/apply runs on Terraform Cloud
# No local credentials needed!

11.7 Sentinel Policy as Code#

Sentinel is HashiCorp’s policy-as-code framework.

Chapter 12: Importing, Refactoring & State Migrations

Mon, 01 Jan 0001 00:00:00 +0000

Chapter 12: Importing, Refactoring & State Migrations#

🎯 Learning Objectives#

Import existing infrastructure into Terraform management
Refactor resources without destroying them
Use moved blocks for safe resource renaming
Manage state operations (state mv, state rm, state pull/push)
Handle module refactoring gracefully

12.1 Why Import?#

Importing brings existing infrastructure under Terraform management without recreating it.

When to Import#

Resources created outside Terraform (console, CLI, SDK)
Legacy infrastructure
Migrating from another IaC tool
Resources created by other teams

The Import Workflow#

1. Write configuration   → main.tf with resource block
2. Run terraform import  → Links state to real resource
3. Run terraform plan    → Should show "No changes"
4. Run terraform apply   → Not needed (already exists)

12.2 The `terraform import` Command#

Basic Import#

# Syntax: terraform import <RESOURCE_TYPE>.<LOCAL_NAME> <ID>
terraform import aws_instance.web i-0abcd1234efgh5678

# Import to resource with count index
terraform import 'aws_instance.web[0]' i-0abcd1234efgh5678

# Import to resource with for_each key
terraform import 'aws_instance.web["web1"]' i-0abcd1234efgh5678

# Import a module resource
terraform import 'module.vpc.aws_vpc.this' vpc-12345678

Step-by-Step Import Example#

# Step 1: Write the configuration
resource "aws_s3_bucket" "data" {
  bucket = "my-existing-data-bucket"  # Must match existing bucket
  
  tags = {
    Name = "My Data Bucket"
  }
}

resource "aws_s3_bucket_versioning" "data" {
  bucket = aws_s3_bucket.data.id
  versioning_configuration {
    status = "Enabled"
  }
}

# Step 2: Import
terraform import aws_s3_bucket.data my-existing-data-bucket

# Step 3: Import dependent resources
terraform import aws_s3_bucket_versioning.data my-existing-data-bucket

# Step 4: Verify
terraform plan
# Should show: "No changes. Your infrastructure matches the configuration."

Importing Resources Created with `count`#

# Configuration using count
resource "aws_instance" "web" {
  count = 3
  
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
}

# Import each instance by index
terraform import 'aws_instance.web[0]' i-0abcd1234efgh5678
terraform import 'aws_instance.web[1]' i-0abcd1234efgh5679
terraform import 'aws_instance.web[2]' i-0abcd1234efgh5680

12.3 The `terraform state` Commands#

state list#

# List all resources in state
terraform state list

# Filter by resource type
terraform state list aws_instance

# List resources in a module
terraform state list module.vpc

# Example output:
# aws_instance.web[0]
# aws_instance.web[1]
# aws_vpc.main
# aws_subnet.public[0]
# data.aws_ami.ubuntu
# module.vpc.aws_vpc.this

state show#

# Show all attributes of a resource
terraform state show aws_instance.web[0]

# Show module resource
terraform state show 'module.vpc.aws_vpc.this'

# Example output:
# # aws_instance.web[0]:
# resource "aws_instance" "web" {
#     ami                          = "ami-0c55b159cbfafe1f0"
#     arn                          = "arn:aws:ec2:us-east-1:123456789012:instance/i-0abcd1234efgh5678"
#     associate_public_ip_address  = true
#     availability_zone            = "us-east-1a"
#     id                           = "i-0abcd1234efgh5678"
#     instance_state               = "running"
#     instance_type                = "t2.micro"
#     private_ip                   = "10.0.1.5"
#     public_ip                    = "54.123.45.67"
#     subnet_id                    = "subnet-12345678"
#     tags                         = {
#         "Name" = "web-0"
#     }
# }

state mv#

# Move/rename resource in state (NOT in config)
# Use before changing the resource name in config

# Rename a resource
terraform state mv aws_instance.web aws_instance.app_server

# Move within a module
terraform state mv aws_instance.web module.compute.aws_instance.app

# Move between modules
terraform state mv module.old.aws_instance.web module.new.aws_instance.web

# Move with indexing
terraform state mv 'aws_instance.web[0]' 'aws_instance.web["web1"]'

# Move address
terraform state mv \
  'module.vpc.aws_subnet.public' \
  'module.network.aws_subnet.public'

state rm#

# Remove resource from state (NOT from real world)
terraform state rm aws_instance.web_to_manage_externally

# Remove resource with index
terraform state rm 'aws_instance.web[2]'

state pull and push#

# Pull state to local file (backup)
terraform state pull > backup.tfstate

# Push state (use with extreme caution!)
terraform state push backup.tfstate

# Check if state is locked
terraform state pull | head -5  # Will fail if locked

12.4 The `moved` Block (Terraform 1.1+)#

The moved block allows refactoring without terraform state mv.

Chapter 13: Security & Compliance

Mon, 01 Jan 0001 00:00:00 +0000

Chapter 13: Security & Compliance#

🎯 Learning Objectives#

Implement secrets management in Terraform
Understand IAM least privilege for Terraform
Use Sentinel policy as code for compliance
Encrypt sensitive data in state and backends
Implement secure CI/CD pipelines

13.1 Secrets Management#

What NOT to Do#

# ❌ NEVER: Hardcode secrets in configuration
variable "db_password" {
  default = "SuperSecret123!"  # TERRIBLE IDEA
}

# ❌ NEVER: Store secrets in terraform.tfvars
# terraform.tfvars
db_password = "SuperSecret123!"  # Committed to git?!

# ❌ NEVER: Commit secrets to version control
# .gitignore should include:
# *.tfvars (except example files)
# terraform.tfstate
# *.pem

Best Practices for Secrets#

# ✅ DO: Use sensitive flag for variables
variable "db_password" {
  description = "Database master password"
  type        = string
  sensitive   = true
}

# ✅ DO: Use environment variables
# export TF_VAR_db_password="SuperSecret123!"

# ✅ DO: Use AWS Secrets Manager
data "aws_secretsmanager_secret_version" "db_password" {
  secret_id = "prod/myapp/db/password"
}

resource "aws_db_instance" "main" {
  master_password = data.aws_secretsmanager_secret_version.db_password.secret_string
}

# ✅ DO: Use HashiCorp Vault
data "vault_kv_secret_v2" "db_creds" {
  mount = "secret"
  name  = "database/prod"
}

resource "aws_db_instance" "main" {
  master_password = data.vault_kv_secret_v2.db_creds.data["password"]
}

Marking Outputs as Sensitive#

# Sensitive outputs are hidden in CLI output
output "db_password" {
  value     = random_password.db.result
  sensitive = true
  description = "Database master password"
}

output "api_key" {
  value     = aws_api_gateway_api_key.main.value
  sensitive = true
}

# Non-sensitive output (safe to display)
output "db_endpoint" {
  value = aws_db_instance.main.endpoint
  # Not sensitive — it's just a DNS name
}

Random Provider for Secrets#

# Generate random passwords
resource "random_password" "db" {
  length           = 24
  special          = true
  override_special = "!#$%&*()-_=+[]{}<>:?"
  min_upper        = 1
  min_lower        = 1
  min_numeric      = 1
  min_special      = 1
}

resource "random_string" "suffix" {
  length  = 8
  special = false
  upper   = false
}

resource "aws_s3_bucket" "app" {
  bucket = "my-app-${random_string.suffix.result}"
}

resource "aws_db_instance" "main" {
  master_password = random_password.db.result
}

13.2 IAM Least Privilege#

Principle of Least Privilege#

The principle of least privilege means giving Terraform only the permissions it needs to perform its work — nothing more.

Chapter 14: Production-Grade Terraform

Mon, 01 Jan 0001 00:00:00 +0000

Chapter 14: Production-Grade Terraform#

🎯 Learning Objectives#

Design scalable Terraform project structures
Implement CI/CD pipelines for infrastructure
Write and run infrastructure tests
Establish code review and collaboration workflows
Adopt incident response and disaster recovery patterns

14.1 Project Structure Patterns#

Monorepo Structure (Recommended for Teams)#

terraform/
├── environments/
│   ├── dev/
│   │   ├── main.tf
│   │   ├── providers.tf
│   │   ├── backend.hcl
│   │   └── terraform.tfvars
│   ├── staging/
│   │   ├── main.tf
│   │   ├── providers.tf
│   │   ├── backend.hcl
│   │   └── terraform.tfvars
│   └── prod/
│       ├── main.tf
│       ├── providers.tf
│       ├── backend.hcl
│       └── terraform.tfvars
├── modules/
│   ├── networking/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   ├── outputs.tf
│   │   └── README.md
│   ├── compute/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   ├── outputs.tf
│   │   └── README.md
│   ├── database/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   ├── outputs.tf
│   │   └── README.md
│   └── monitoring/
│       ├── main.tf
│       ├── variables.tf
│       ├── outputs.tf
│       └── README.md
├── tests/
│   ├── network_test.go
│   └── compliance_test.go
├── scripts/
│   ├── validate.sh
│   └── destroy.sh
├── .github/
│   └── workflows/
│       └── terraform.yml
├── .gitignore
├── README.md
└── terragrunt.hcl

Multi-Repo Structure (for Large Organizations)#

github.com/company/
├── terraform-modules/          # Central module repository
├── terraform-networking/       # Network team's repo
├── terraform-security/         # Security team's repo
├── terraform-platform/         # Platform team's repo
└── terraform-applications/     # App team's repo

14.2 CI/CD Pipeline Design#

GitHub Actions Workflow (Full Example)#

# .github/workflows/terraform.yml
name: 'Terraform Infrastructure'

on:
  push:
    branches:
      - main
      - develop
    paths:
      - 'environments/**'
      - 'modules/**'
  pull_request:
    branches:
      - main
    paths:
      - 'environments/**'
      - 'modules/**'

env:
  TF_VERSION: '1.9.0'
  WORKING_DIR: './environments/${{ github.ref_name }}'

permissions:
  id-token: write
  contents: read
  pull-requests: write

jobs:
  validate:
    name: 'Validate'
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v3
      
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: ${{ env.TF_VERSION }}
      
      - name: Terraform Format Check
        run: terraform fmt -check -recursive
      
      - name: Terraform Init
        run: terraform init -backend=false
        working-directory: ${{ env.WORKING_DIR }}
      
      - name: Terraform Validate
        run: terraform validate
        working-directory: ${{ env.WORKING_DIR }}
      
      - name: Checkov Security Scan
        uses: bridgecrewio/checkov-action@master
        with:
          directory: ${{ env.WORKING_DIR }}
          framework: terraform
  
  plan:
    name: 'Plan'
    needs: validate
    runs-on: ubuntu-latest
    environment: ${{ github.ref_name }}
    
    steps:
      - uses: actions/checkout@v3
      
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v2
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: us-east-1
      
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: ${{ env.TF_VERSION }}
      
      - name: Terraform Init
        id: init
        run: terraform init -backend-config=backend.hcl
        working-directory: ${{ env.WORKING_DIR }}
      
      - name: Terraform Plan
        id: plan
        run: terraform plan -no-color -out=tfplan
        working-directory: ${{ env.WORKING_DIR }}
      
      - name: Post Plan Comment
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v6
        with:
          script: |
            const output = `#### Terraform Plan 📋
            <details><summary>Show Plan</summary>
            
            \`\`\`terraform\n${{ steps.plan.outputs.stdout }}\n\`\`\`
            </details>
            
            *Pusher: @${{ github.actor }}*
            *Action: ${{ github.event_name }}*`;
            
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            })
  
  apply:
    name: 'Apply'
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    needs: plan
    runs-on: ubuntu-latest
    environment: production
    
    steps:
      - uses: actions/checkout@v3
      
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v2
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: us-east-1
      
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: ${{ env.TF_VERSION }}
      
      - name: Terraform Init
        run: terraform init -backend-config=backend.hcl
        working-directory: ${{ env.WORKING_DIR }}
      
      - name: Terraform Apply
        run: terraform apply -auto-approve tfplan
        working-directory: ${{ env.WORKING_DIR }}

GitLab CI Pipeline#

# .gitlab-ci.yml
image: hashicorp/terraform:1.9

cache:
  key: "${CI_PROJECT_NAME}"
  paths:
    - .terraform

variables:
  TF_ROOT: ${CI_PROJECT_DIR}/environments/${CI_COMMIT_REF_NAME}
  TF_IN_AUTOMATION: "true"

before_script:
  - cd ${TF_ROOT}
  - terraform init -backend-config=backend.hcl

stages:
  - validate
  - plan
  - apply
  - destroy

validate:
  stage: validate
  script:
    - terraform fmt -check
    - terraform validate

plan:
  stage: plan
  script:
    - terraform plan -out=tfplan
  artifacts:
    paths:
      - ${TF_ROOT}/tfplan

apply:
  stage: apply
  script:
    - terraform apply tfplan
  when: manual
  only:
    - main

destroy:
  stage: destroy
  script:
    - terraform destroy -auto-approve
  when: manual

14.3 Infrastructure Testing#

Terratest (Go-based Testing)#

// tests/network_test.go
package test

import (
  "testing"
  "github.com/gruntwork-io/terratest/modules/terraform"
  "github.com/gruntwork-io/terratest/modules/aws"
  "github.com/stretchr/testify/assert"
)

func TestVPCDeployment(t *testing.T) {
  t.Parallel()

  terraformOptions := &terraform.Options{
    TerraformDir: "../environments/dev",
    
    Vars: map[string]interface{}{
      "environment": "test",
      "vpc_cidr":    "10.0.0.0/16",
    },
  }

  // Clean up after test
  defer terraform.Destroy(t, terraformOptions)

  // Deploy
  terraform.InitAndApply(t, terraformOptions)

  // Test outputs
  vpcId := terraform.Output(t, terraformOptions, "vpc_id")
  assert.NotEmpty(t, vpcId)

  // Verify VPC exists in AWS
  vpc := aws.GetVpcById(t, vpcId, "us-east-1")
  assert.Equal(t, "10.0.0.0/16", vpc.CidrBlock)
}

terraform test (Built-in, Terraform 1.6+)#

# tests/vpc_test.tftest.hcl
run "test_vpc_creation" {
  # Override variables for test
  variables {
    environment = "test"
    vpc_cidr    = "10.0.0.0/16"
    az_count    = 2
  }

  # Assertions
  assert {
    condition     = aws_vpc.main.cidr_block == "10.0.0.0/16"
    error_message = "VPC CIDR should be 10.0.0.0/16"
  }

  assert {
    condition     = length(aws_subnet.public) == 2
    error_message = "Should create 2 public subnets"
  }

  assert {
    condition     = length(aws_subnet.private) == 2
    error_message = "Should create 2 private subnets"
  }
}

run "test_subnet_connectivity" {
  variables {
    environment = "test"
    vpc_cidr    = "10.0.0.0/16"
    az_count    = 2
  }

  # Verify subnets are in correct CIDR range
  assert {
    condition     = can(regex("^10\\.0\\.", aws_subnet.public[0].cidr_block))
    error_message = "Subnet should be in 10.0.x.x range"
  }
}

Running Tests#

# Run terraform tests
terraform test

# Run terratest
go test -v -timeout 30m ./tests/

# Run with specific test
go test -v -run TestVPCDeployment -timeout 30m

14.4 Code Review Practices#

Pull Request Checklist#

## Terraform PR Checklist

- [ ] `terraform fmt` run and no changes
- [ ] `terraform validate` passes
- [ ] `terraform plan` reviewed — expected changes only
- [ ] New resources have proper tags
- [ ] Variables have descriptions and types
- [ ] No hardcoded values (unless necessary)
- [ ] Secrets are not in version control
- [ ] Backend configuration is correct
- [ ] Module versions are pinned (for registry modules)
- [ ] Security groups follow least privilege
- [ ] IAM policies follow least privilege
- [ ] Resources have lifecycle rules (prevent_destroy for critical)

Plan Review Process#

1. Developer opens PR with Terraform changes
2. CI runs `terraform plan`
3. Plan output is posted as PR comment
4. Reviewer checks:
   - Expected resources are being created
   - No unexpected destructions
   - Sensible configuration for the environment
   - Security implications
5. After approval, PR is merged
6. CI runs `terraform apply` on merge

14.5 Change Management#

Safe Apply Strategies#

# 1. Plan and save to file (for applying later)
terraform plan -out=plan.tfplan
terraform apply plan.tfplan

# 2. Approve with caution
terraform apply  # Interactive approval

# 3. Auto-approve (only in CI/CD)
terraform apply -auto-approve

# 4. Target specific resources (use sparingly)
terraform apply -target=aws_instance.web

Rollback Strategies#

# Strategy 1: Revert the Git commit
git revert HEAD
# Then run terraform apply to rollback

# Strategy 2: Keep previous plan files
terraform plan -out=plan-$(date +%Y%m%d-%H%M).tfplan

# Strategy 3: Use state rollback
terraform state pull > backup.tfstate
# If something goes wrong:
terraform state push backup.tfstate

# Strategy 4: Destroy specific resources
terraform destroy -target=aws_instance.bad_deploy

14.6 Disaster Recovery#

State Backup Strategy#

# 1. Automated backups (S3 versioning)
aws s3api list-object-versions \
  --bucket my-terraform-state \
  --prefix prod/terraform.tfstate

# 2. Regular state exports
AWS_COMMAND="aws s3 cp"
BACKUP_BUCKET="my-terraform-backups"
DATE=$(date +%Y-%m-%d)

aws s3 cp s3://my-terraform-state/prod/terraform.tfstate \
  s3://${BACKUP_BUCKET}/state-backups/${DATE}/terraform.tfstate

Disaster Recovery Plan#

#!/bin/bash
# scripts/disaster-recovery.sh

# 1. Assess damage
echo "1. Checking state file integrity..."
aws s3api head-object --bucket my-terraform-state --key prod/terraform.tfstate

# 2. Restore state from backup
echo "2. Restoring state from latest backup..."
LATEST=$(aws s3api list-object-versions \
  --bucket my-terraform-state \
  --key prod/terraform.tfstate \
  --query 'Versions[?IsLatest].[VersionId]' \
  --output text)

terraform state pull > recovered.tfstate

# 3. Verify recovery
echo "3. Verifying state..."
terraform plan

14.7 Team Workflows#

Git Branching Strategy#

main          ──●────────────────●──────────
                 \              /
staging         ──●────────────●────────────
                   \          /
develop           ──●────────●──────────────
                     \      /
feature/my-feature    ●────●

Branch	Environment	Trigger
`feature/*`	None	Manual plan only
`develop`	Dev	Auto-trigger plan + apply
`staging`	Staging	Auto plan, manual apply
`main`	Production	Auto plan, approved apply

Approval Workflows#

# Require environment approval in GitHub
jobs:
  apply:
    environment:
      name: production
      url: https://console.aws.amazon.com
    # Requires approval from designated reviewers
    # Only runs after approval

14.8 Cost Management#

Cost Estimation Tools#

# Infracost — Cost estimation for Terraform
infracost breakdown --path environments/prod

# Example output:
# NAME                               MONTHLY QTY  UNIT         PRICE   HOURLY COST
# aws_instance.web[0]                         1  months       $56.84        $0.078
# aws_db_instance.main                        1  months      $346.72       $0.475
# aws_s3_bucket.logs                          1  months        $2.30       $0.003
# ───────────────────────────────────────────────────────────────────────────────
# TOTAL                                                             $405.86

Cost Optimization Patterns#

# Use cheaper instances for non-production
locals {
  instance_type = var.environment == "prod" ? "t3.medium" : "t2.nano"
}

# Use reserved instances for production
resource "aws_ec2_capacity_reservation" "prod" {
  count = var.environment == "prod" ? 1 : 0
  # ...
}

# Right-size volumes
locals {
  volume_size = var.environment == "prod" ? 50 : 20
  volume_type = var.environment == "prod" ? "gp3" : "gp2"
}

# Delete non-production resources outside business hours
# (Use AWS Instance Scheduler or similar)

14.9 Incident Response#

Common Terraform Incidents#

Incident	Symptoms	Response
State corruption	`terraform plan` errors	Restore from backup
Lock timeout	“Error acquiring state lock”	Force unlock after verifying
Drift	Unexpected changes in plan	Investigate root cause
API rate limiting	Throttling errors	Implement retries, backoff
Provider bug	Unexpected resource behavior	Pin provider version, report bug

Runbook Template#

# Incident: State File Corruption

## Detection
- terraform plan fails with "Error loading state"
- terraform state list returns errors

## Response
1. Check state file in S3
2. List versions: `aws s3api list-object-versions`
3. Restore previous version
4. Run `terraform plan` to verify
5. If successful, `terraform apply`

## Prevention
- Enable S3 versioning on state bucket
- Regular state exports as backups
- State locking with DynamoDB

📝 Exam Tips#

Monorepo structure works well for small-medium teams
CI/CD pipelines automate validation, planning, and applying
Terratest or terraform test for infrastructure testing
terraform plan -out=plan.tfplan saves plan for later application
Code review — Always review plans before applying
prevent_destroy on critical production resources
Environment isolation — Separate state files per environment
Automated validation — terraform fmt -check in CI
Approval gates — Require approval for production applies
Disaster recovery plan — Backups, recovery procedures

✅ Chapter 14 Quiz#

What is the benefit of saving a plan with terraform plan -out=tfplan?

Chapter 15: Exam Preparation Guide

Mon, 01 Jan 0001 00:00:00 +0000

Chapter 15: Exam Preparation Guide#

🎯 Learning Objectives#

Understand the Terraform Associate certification exam structure
Master the key exam domains and topics
Practice with realistic sample questions
Use study strategies for passing the exam
Access additional resources and practice tests

15.1 Exam Overview#

Terraform Associate 003 (Latest)#

Detail	Information
Exam Name	HashiCorp Certified: Terraform Associate (003)
Format	Multiple choice, multiple select
Duration	60 minutes
Questions	57 questions
Passing Score	70% (approximately)
Cost	$70.50 USD (plus tax)
Delivery	Online proctored
Validity	2 years
Languages	English, Japanese

Exam Domains#

Domain	Weight	Focus Areas
1. Infrastructure as Code	12%	IaC concepts, benefits, best practices
2. Terraform Basics	18%	Installation, providers, resources, state
3. Terraform Workflow	16%	Init, plan, apply, destroy, fmt, validate
4. Terraform Configuration	18%	Variables, outputs, locals, expressions
5. Terraform State	14%	Remote state, backends, locking
6. Terraform Modules	12%	Module structure, registry, versioning
7. Terraform Cloud & Enterprise	10%	Workspaces, Sentinel, remote operations

15.2 Exam Preparation Strategy#

4-Week Study Plan#

Week	Focus	Activities
Week 1	Foundation (Ch 1-4)	Read chapters, run examples, practice commands
Week 2	Core Skills (Ch 5-8)	Build modules, configure backends, use workspaces
Week 3	Advanced (Ch 9-12)	Dynamic blocks, import, refactor, functions
Week 4	Exam Prep (Ch 13-15)	Review all, take practice tests, weak areas

Study Resources#

Resource	Type	Link
Official Study Guide	Document	HashiCorp Learn
Review Guide	PDF	Exam Review Guide
Sample Questions	Practice	HashiCorp Sample Questions
Practice Exams	Third-party	Udemy, Whizlabs, Tutorials Dojo
Hands-on Labs	Interactive	HashiCorp Learn Tutorials

15.3 Key Concepts to Master#

Must-Know Commands#

Command	Purpose	Exam Frequency
`terraform init`	Initialize directory, download providers	🔴 High
`terraform plan`	Show execution plan	🔴 High
`terraform apply`	Apply changes	🔴 High
`terraform destroy`	Destroy resources	🔴 High
`terraform fmt`	Format code	🟡 Medium
`terraform validate`	Validate syntax	🟡 Medium
`terraform state list`	List resources in state	🟡 Medium
`terraform state mv`	Move/rename in state	🟡 Medium
`terraform state rm`	Remove from state	🟡 Medium
`terraform import`	Import existing resources	🟡 Medium
`terraform workspace`	Manage workspaces	🟡 Medium
`terraform output`	Show output values	🟢 Low
`terraform console`	Interactive console	🟢 Low

Critical Concepts (Exam Focus)#

Concept	Why It’s Tested
Provider version constraints	Understanding `~>`, `>=`, `=` syntax
State locking	DynamoDB for S3 backend
Backend configuration	Cannot use variables in backend block
Variable precedence	`-var` > `*.auto.tfvars` > `terraform.tfvars` > `TF_VAR_` > default
Resource dependencies	Implicit vs explicit (`depends_on`)
Lifecycle rules	`create_before_destroy`, `prevent_destroy`, `ignore_changes`
count vs for_each	When to use each, index shifting
Provisioners	Last resort, alternatives preferred
Workspaces	Pros/cons vs directory-based environments
Terraform Cloud	VCS workflow, remote execution, Sentinel
Sensitive data	`sensitive = true`, state encryption
Module sources	Registry, local, GitHub, S3, Git

15.4 Sample Practice Questions#

Domain 1: Infrastructure as Code (12%)#

Q1: What is a key benefit of Infrastructure as Code?

Chapter 16: Interview Questions & Answers

Mon, 01 Jan 0001 00:00:00 +0000

Chapter 16: Interview Questions & Answers#

Prepare for your Terraform interview with categorized questions ranging from beginner to expert level.

📋 Table of Contents#

16.1 Beginner Level Questions#

Q1: What is Terraform and how does it work?#

Answer: Terraform is an Infrastructure as Code (IaC) tool by HashiCorp that allows you to define and provision infrastructure using a declarative configuration language called HCL (HashiCorp Configuration Language). It works by:

Chapter 17: Real-World Scenario Questions

Mon, 01 Jan 0001 00:00:00 +0000

Chapter 17: Real-World Scenario Questions#

Test your Terraform knowledge with real-world troubleshooting scenarios. Each scenario includes a problem description, analysis, and step-by-step solution.

🎯 Learning Objectives#

Analyze and resolve real-world Terraform failures (state corruption, drift, secrets leakage)
Design multi-region, high-availability architectures with Terraform
Implement secure secret management and rotation strategies
Build and maintain CI/CD pipelines for infrastructure deployments
Execute safe refactoring and migration strategies at scale
Apply cost optimization and security incident response patterns

📋 Table of Contents#

17.1 State File Corruption#

Scenario#

You run terraform plan and get the following error:

Exam Practice Test 1

Mon, 01 Jan 0001 00:00:00 +0000

Exam Practice Test 1#

Simulate the real Terraform Associate certification exam with 57 questions across all 7 domains. Time yourself — you have 60 minutes. Aim for 70% or higher.

📋 Exam Instructions#

Detail	Value
Questions	57
Time Limit	60 minutes
Passing Score	~70% (40/57 correct)
Format	Multiple choice (single answer & select two)
Domains	7 domains (weighted per real exam)

60 : 00

Time Remaining

✓ Mark test as completed

1. Infrastructure as Code (Q1–Q7)#

Q1. Which of the following BEST describes Infrastructure as Code?

Exam Practice Test 2

Mon, 01 Jan 0001 00:00:00 +0000

Exam Practice Test 2#

Another full-length simulation of the Terraform Associate certification exam. 57 new questions — including code-based questions. Time yourself: 60 minutes.

📋 Exam Instructions#

Detail	Value
Questions	57
Time Limit	60 minutes
Passing Score	~70% (40/57 correct)
Format	Multiple choice (single answer & select two)

60 : 00

Time Remaining

✓ Mark test as completed

1. Infrastructure as Code (Q1–Q7)#

Q1. How does Infrastructure as Code differ from configuration management tools like Ansible or Puppet?

Exam Practice Test 3

Mon, 01 Jan 0001 00:00:00 +0000

📝 Terraform Associate — Practice Test 3#

Instructions: This test contains 57 multiple-choice questions covering all 7 domains of the Terraform Associate exam. Choose the best answer for each question. Some questions include code snippets. Time yourself — aim for 60 minutes for the full set. A passing score is 70% (40/57).

60 : 00

Time Remaining

✓ Mark test as completed

Domain 1: Infrastructure as Code (7 Questions — Q1–Q7)#

Q1. Which property distinguishes Immutable Infrastructure from Mutable Infrastructure?

Exam Practice Test 4

Mon, 01 Jan 0001 00:00:00 +0000

📝 Terraform Associate — Practice Test 4#

Instructions: This test contains 57 multiple-choice questions covering all 7 domains of the Terraform Associate exam. Choose the best answer for each question. Some questions include code snippets. Time yourself — aim for 60 minutes for the full set. A passing score is 70% (40/57).

60 : 00

Time Remaining

✓ Mark test as completed

Domain 1: Infrastructure as Code (7 Questions — Q1–Q7)#

Q1. Which of the following is an example of IaC provisioning rather than configuration management?

Exam Practice Test 5

Mon, 01 Jan 0001 00:00:00 +0000

📝 Terraform Associate — Practice Test 5#

Instructions: This test contains 57 multiple-choice questions covering all 7 domains of the Terraform Associate exam. Choose the best answer for each question. Some questions include code snippets. Time yourself — aim for 60 minutes for the full set. A passing score is 70% (40/57).

60 : 00

Time Remaining

✓ Mark test as completed

Domain 1: Infrastructure as Code (7 Questions — Q1–Q7)#

Q1. Which principle ensures a Terraform configuration produces the same infrastructure every time it is applied, regardless of when or by whom it is run?

Exam Practice Test 6

Mon, 01 Jan 0001 00:00:00 +0000

📝 Terraform Associate — Practice Test 6#

Instructions: This test contains 57 multiple-choice questions covering all 7 domains of the Terraform Associate exam. Choose the best answer for each question. Some questions include code snippets. Time yourself — aim for 60 minutes for the full set. A passing score is 70% (40/57).

60 : 00

Time Remaining

✓ Mark test as completed

Domain 1: Infrastructure as Code (7 Questions — Q1–Q7)#

Q1. A team uses Terraform to manage all cloud resources. An engineer notices that running terraform apply twice in a row produces the same result with “No changes” on the second run. What IaC principle does this demonstrate?

Exam Practice Test 7

Mon, 01 Jan 0001 00:00:00 +0000

📝 Terraform Associate — Practice Test 7#

Instructions: This test contains 57 multiple-choice questions covering all 7 domains of the Terraform Associate exam. Choose the best answer for each question. Some questions include code snippets. Time yourself — aim for 60 minutes for the full set. A passing score is 70% (40/57).

60 : 00

Time Remaining

✓ Mark test as completed

Domain 1: Infrastructure as Code (7 Questions — Q1–Q7)#

Q1. A company stores its Terraform configurations in a Git repository. A developer modifies the configuration, but does not run terraform apply. What is the status of the infrastructure compared to the code?

Terraform Learning Path

📊 Progress Dashboard

📖 Full Curriculum#

Foundation (Week 1)#

Core Skills (Week 2)#

Advanced (Week 3)#

Production & Exam Prep (Week 4)#

Bonus Chapters#

Practice Tests#

🚀 Start Here

🚀 Start Here: Your Terraform Learning Path#

🎯 How to Use This Guide#

If you’re completely new to Terraform#

If you’re reviewing for the exam#

Chapter 1: Introduction to Infrastructure as Code & Terraform

Chapter 1: Introduction to Infrastructure as Code & Terraform#

🎯 Learning Objectives#

1.1 What is Infrastructure as Code?#

Chapter 2: Terraform Core Concepts

Chapter 2: Terraform Core Concepts#

🎯 Learning Objectives#

2.1 Providers#

How Providers Work#

Important Provider Concepts#

Provider Example#

Provider Version Constraints (Exam Critical)#

Chapter 3: HCL Configuration Language

Chapter 3: HCL Configuration Language#

🎯 Learning Objectives#

3.1 HCL Syntax Basics#

Comments#

Basic Syntax Structure#

Example#

3.2 Data Types#

Primitive Types#

Complex Types#

Type Examples#

3.3 Expressions and Interpolation#

String Interpolation#

String Heredoc Syntax#

Template Files#

3.4 Operators#

Arithmetic Operators#

Comparison Operators#

Logical Operators#

Conditional Expressions#

3.5 For Expressions#

Chapter 4: Resources, Data Sources & Meta-Arguments

Chapter 4: Resources, Data Sources & Meta-Arguments#

🎯 Learning Objectives#

4.1 Resources Deep Dive#

Resource Behavior (Exam Critical)#

Resource Behaviors#

4.2 Resource Meta-Arguments#

count — Create Multiple Resources from a Count#

for_each — Create Resources from a Map or Set#

count vs for_each — When to Use Which (Exam Critical)#

Chapter 5: Variables, Outputs & Locals

Chapter 5: Variables, Outputs & Locals#

🎯 Learning Objectives#

5.1 Input Variables#

Variable Declaration#

Variable Attributes (Exam Critical)#

Variable Definition Precedence (Exam Critical)#

Chapter 6: State Management

Chapter 6: State Management#

🎯 Learning Objectives#

6.1 What is Terraform State?#

What State Contains#

Why State is Essential (Exam Critical)#

6.2 Local State (Default)#

How Local State Works#

Problems with Local State#

6.3 Remote State Backends#

Chapter 7: Terraform Modules

Chapter 7: Terraform Modules#

🎯 Learning Objectives#

7.1 What are Modules?#

Chapter 8: Workspaces & Environments

Chapter 8: Workspaces & Environments#

`count` — Create Multiple Resources from a Count#

`for_each` — Create Resources from a Map or Set#

`count` vs `for_each` — When to Use Which (Exam Critical)#