IaC & Automation
Terraform
Declarative Infrastructure as Code for multi-cloud provisioning and lifecycle management.
HashiCorp Terraform enables engineers to codify cloud infrastructure in human-readable HCL (HashiCorp Configuration Language). Through state tracking, resource graphs, and dry-run execution plans, it brings version control, PR reviews, and automated verification to cloud architecture.
Virtual Lab Ready
Automated testing sandbox running in your browser.
Launch First Lab ⚡No local installation required
Hands-on Practice
Interactive Terminal Labs
Real environment tasks with automated validation. Write real commands, verify state, and debug errors.
Write Your First Configuration
Topic: Init & Plan
Terraform turns .tf files into real infrastructure. Write a configuration that declares an S3 bucket, initialize the provider and generate a plan — the read-only preview every change should start with.
Key Checks:
- Directory ~/infra contains main.tf with an aws_s3_bucket resource
- terraform init has been run in ~/infra
Apply the Configuration
Topic: Apply & State
terraform apply executes the plan and writes what it created into terraform.tfstate — the file Terraform uses to remember what belongs to it.
Key Checks:
- aws_s3_bucket.demo exists in the Terraform state
Destroy It All
Topic: Destroy
The most underrated Terraform command. Destroy everything the module created and confirm the state is empty — the same reflex that keeps cloud bills at zero.
Key Checks:
- Terraform state in ~/infra is empty
Wire Up a Bucket Module
Topic: Modules
Copy-pasted .tf files do not scale — teams package resources into modules and call them once per environment. Lay out a bucket module, wire the root configuration that calls it, then init and apply so the bucket lands in state.
Key Checks:
- Directory ~/tf-modules/modules/s3 contains the module's main.tf
- Root main.tf in ~/tf-modules declares the module call
Configure a Remote Backend
Topic: State, Backends & Guardrails
Local state belongs to one laptop and disappears with it. Move it to an S3 bucket with locking so a whole team can share one source of truth.
Key Checks:
- Directory ~/infra exists
- File ~/infra/backend.tf exists
Guard a Bucket with a Lifecycle Rule
Topic: State, Backends & Guardrails
Some infrastructure must never be destroyed by a stray command. Declare a bucket with a prevent_destroy lifecycle rule and apply it.
Key Checks:
- Directory ~/infra exists
- File ~/infra/main.tf declares a bucket with prevent_destroy
System Design
Core Workflow & State Engine
Understand how this tool operates internally before running production workloads.
Internal Mechanics
Terraform compiles configuration files into a Directed Acyclic Graph (DAG) of resource dependencies. It queries provider plugins via RPC to compute differences between reality and configuration, saving the result in a remote state file.
Mental Model Rule of Thumb
Never treat Terraform as a black box. Understanding its boundary with the kernel, filesystem, and network stack prevents 90% of production outages.
Core Architectural Subsystems
Terraform Core
Parses HCL, constructs resource dependency DAGs, and generates diff plans.
Provider Plugins
Standalone executables (AWS, GCP, Azure, K8s) translating resources into cloud API calls.
State File (terraform.tfstate)
Source of truth mapping real cloud resource IDs to declared HCL blocks.
State Backend (S3 + DynamoDB)
Remote storage providing encrypted persistence and distributed locking.
Developer Reference
Command Reference & Cheatsheet
Curated commands, flags, and one-liners tested for everyday operational productivity.
terraform init -backend-config='bucket=my-state'Initialize backend storage and download provider plugins
terraform plan -out=tfplanGenerate execution plan showing additions, changes and destructions
terraform apply tfplanExecute planned cloud infrastructure modifications safely
terraform state listList all tracked resources within the active state backend
terraform fmt -recursive && terraform validateFormat code according to canonical style and check syntax
terraform destroy -target=module.vpcDestroy targeted infrastructure components selectively
Fundamental Primitives
Key Terminology & Primitives
Core abstractions you must master to communicate and build with confidence.
State & Drift
State records cloud reality. Drift occurs when someone makes manual console changes outside Terraform.
Plan vs Apply
Plan performs a non-destructive read diff. Apply executes the API calls to reach desired state.
Modules
Reusable containers for multiple resources that act as self-contained blueprints.
State Locking
Prevents concurrent execution collisions that could corrupt the state file.
Production War-Stories
Common Pitfalls & Debugging Playbook
The exact errors that take down production systems and how to diagnose and resolve them.
State lock error (ConditionalCheckFailedException)
Symptom
Error acquiring the state lock: DynamoDB lock entry exists.
Resolution
Ensure no other pipeline is running. If a previous run crashed, inspect the Lock ID and run 'terraform force-unlock <LOCK_ID>'.
Accidental resource destruction on rename
Symptom
Plan reports 1 to add, 1 to destroy when renaming an HCL identifier.
Resolution
Use 'moved { from = old.res to = new.res }' blocks to update state mappings without tearing down live cloud assets.
Reliability Standards
Production Readiness Checklist
Review this checklist before deploying workloads to staging or production clusters.
- ✓Always store state in an encrypted remote backend with object versioning enabled.
- ✓Configure automated distributed locking with DynamoDB or equivalent.
- ✓Run 'terraform plan' on pull requests and require peer review before 'apply'.
- ✓Pin exact provider versions in required_providers block.
- ✓Never commit secrets, tokens, or plain-text passwords into .tf files.
Full Curriculum Track
Master Terraform as part of the DevOps Engineer path
Tools do not exist in isolation. Learn how Terraform connects with other systems, CI/CD pipelines, and infrastructure patterns.