#IaC
47 posts
Terraform Dependency Errors, All Three Kinds: Cycle, depends_on Misuse, known after apply
The three families of problems that come out of Terraform's dependency graph, in one place: breaking the classic Error: Cycle of mutually referencing security groups with separate rule resources and diagnosing with terraform graph, why implicit reference-based dependencies are the default and depends_on belongs only to hidden ones plus the side effects of overuse, and fixing the Invalid count argument that appears when uncomputed values reach count and for_each keys.
When Secrets End Up in tfstate in Plaintext: Rotation First, Then Prevention
Starting from the structural fact that tfstate stores values in plaintext regardless of sensitive markings: judging the exposure scope, why key rotation comes before any state cleanup, purging history when state was committed to git, and prevention — ephemeral resources and write-only arguments that keep values out of state, S3 backend encryption and access control, and designs where Terraform never touches the secret at all.
When terraform plan Is Slow: Refresh Load, Parallelism, and the Stack-Split Signal
Starting from the fact that plan time is dominated not by diff computation but by refresh, which reads the API for every resource: how resource count times API round trips sets the duration, the situations where -refresh=false is legitimate and where it is not, where raising parallelism collides with rate limits, why -target is not a performance tool, and the signals that say the real fix is splitting the stack.
Upgrading to AWS Provider 6.x: Diagnosing Breaking Changes and a Safe Transition Order
A safe procedure for AWS provider major upgrades: why a provider major hits harder than a CLI upgrade, the standard route through the latest 5.x to burn down deprecation warnings, the main 6.0 changes (resource-level region, OpsWorks and SimpleDB removal, strict booleans, flipped Redshift defaults), reading the plan to separate cosmetic schema diffs from real replacements, and the trap of shared modules pinning provider versions.
Upgrading Terraform Safely: Compatibility Promises, No-op Verification, Rollback Prep
A safe procedure for raising the Terraform CLI version: the v1.x compatibility promises that keep configurations working across minors, why CLI and provider upgrades must be separated, verifying with a no-changes plan before and after, the rollback preparation needed because state written by a newer version may be unreadable to older ones, and pinning team and CI versions with tfenv and mise.
When terraform destroy Fails: DependencyViolation and Resources That Won't Delete
The three branches of destroy failure, told apart: the diagnosis path for DependencyViolation caused by resources created outside Terraform still holding on, non-empty S3 buckets and why force_destroy needs an apply before the destroy, the correct release procedure for deliberate safety catches like prevent_destroy and deletion_protection, timeouts on slow-deleting resources, and cleaning up after a partial destroy.
When terraform plan Succeeds but apply Fails: Causes and Partial-Apply Recovery
Why a clean plan can still fail at apply: the asymmetry where plan validates only schema and references while real API validation happens at apply, the five typical causes (missing permissions, IAM propagation delays, service quotas, globally unique name collisions, parameter combinations), the safe recovery procedure for the partial-apply state that a non-transactional apply leaves behind, and when an already-exists error calls for import.
Terraform Associate 004 #10 Practice Exam: 50 Questions Across the Full Scope with Explanations
A 50-question multiple-choice practice exam drawn from all nine parts of the series. The questions are arranged by domain — from IaC concepts through the workflow, state, modules, writing configuration, the new 004 scope of ephemeral and write-only, and HCP Terraform — and every question comes with an explanation covering the reasoning behind the answer and the traps in the wrong choices. Grade yourself, then go back to the matching part for any weak domain as a final check.
Terraform Associate 004 #9 HCP Terraform: Workspaces, Variable Sets, Policies, and Drift Detection
Starting from the fact that an HCP Terraform workspace shares only its name with the CLI workspace, we lay out the structure that groups workspaces under projects and the three ways runs start (VCS-, CLI-, and API-driven). We then cover variable sets for supplying values to multiple workspaces, where Sentinel and OPA policies are evaluated and the hard versus soft failure distinction, always-on drift detection, and the relationship with Terraform Enterprise — the areas 004 widened.
Terraform Associate 004 #8 Deep Dive on the New Scope: ephemeral, write-only, and Meta-Arguments
This part gathers 004's flagship new scope in one place. We cover the nature of ephemeral values that never land in plan or state and where they can be used, how write-only arguments solve the secrets problem and why _wo_version is what triggers rotation, then firm up the meta-arguments from the exam's angle: the legitimate use of depends_on, choosing between count and for_each, and how the three lifecycle arguments — create_before_destroy, prevent_destroy, and ignore_changes — differ in effect.
Terraform Associate 004 #7 Writing Configuration: Variable Precedence, Functions, and Custom Conditions
We compress the exam view of variable types and the precedence of value sources, the actual reach of sensitive, and the roles of output and locals, then organize the built-in functions and expressions that appear most often. We also reinforce what the track covered lightly: the custom conditions strengthened in 004 — variable validation, resource precondition and postcondition, and check blocks — including how they differ and when each is evaluated.
Terraform Associate 004 #6 Modules: Source Addresses, Version Pinning, and Input/Output Syntax
Starting from the definition of a module and the distinction between root and child modules, we organize the syntax of the registry, Git, and local-path source types and the conditions under which the version argument works, all from the exam angle. We pin down inputs that pass values into a module and outputs read as module.<name>.<output>, the encapsulation principle that rules out direct access to resources inside a module, and the verified badge on the public registry.