#Terraform
48 posts
Terraform Associate 004 #5 State Management: Backends, Locking, State Commands, and Sensitive Data
Starting from the purpose of state and its default file location, we organize the difference between local and remote backends, the incidents locking prevents, and where force-unlock fits, all from the exam angle. We pin down what the state list, show, mv, and rm commands each change and each leave alone, how they map to the moved, removed, and import blocks, and cover sensitive data in state and access control as exam points.
Terraform Associate 004 #4 Core Workflow: init, plan, apply, destroy, and Debugging
We cover the three stages of the official exam workflow — Write, Plan, Apply — what each command does, and the four situations that require running init again. Then the option-based question points: saving a plan with -out, apply with -auto-approve and -replace, the dangers of -target, the role split between fmt and validate, and enabling debug logs with the TF_LOG environment variable.
Terraform Associate 004 #3 Terraform Fundamentals: Version Constraints, the Lock File, and Provider Configuration
Starting from installation and checking with terraform version, we work through the version constraint operators the exam loves (=, ~>, >=) and how to read them, then separate the roles of the required_providers block and the .terraform.lock.hcl lock file. We cover provider configuration and multi-region setups with alias, and what actually goes into the .terraform directory — the question points of exam objective 3.
Terraform Associate 004 #2 IaC Concepts and Terraform's Purpose: Mastering Definition Questions
We organize the definition and benefits of IaC in the language the exam expects, and firm up the declarative-versus-imperative distinction and the concept of idempotency from a question-solving perspective. We also cover Terraform's position in the multi-cloud and provider ecosystem, why state exists, and the structure of Terraform's language and binary — a pass through the testing points of exam objectives 1 and 2.
Terraform Associate 004 #1 Exam Introduction: The 004 Revision, Domain Structure, and Study Strategy
An overview of the HashiCorp Terraform Associate certification as of the January 2026 004 revision: the exam format and what changed from 003. We cover the newly tested areas — ephemeral values and write-only arguments — along with the expanded HCP Terraform coverage and the domain breakdown, then build a mapping table between the exam objectives and the 26 parts of this blog's Terraform track to lay out a study path.
Recovering a Deleted terraform.tfstate: Backup File, S3 Versioning, and Re-import in Order
Starting with the symptoms of a missing state file and why you must not apply in that condition. We walk the recovery paths in priority order — checking the local terraform.tfstate.backup, the commands to restore a previous version from S3 versioning, and the last-resort path of rebuilding state with import when no backup exists — then cover the backend settings that structurally prevent the same accident.
How to Use terraform import: Bringing Existing Resources into Code with import Blocks
The procedure for bringing console-created resources under Terraform management, based on import blocks. Where to find each resource type's import ID, how to generate a code draft with -generate-config-out, how to adjust the code until plan shows no changes, the differences from the old CLI command approach, and the order to follow when importing multiple resources at once.
Fixing the terraform state lock Error: Finding the Cause and When to Use force-unlock
Starting with how to read the Lock Info block in the "Error acquiring the state lock" message. We cover the check procedure that separates the normal case — a teammate or CI is mid-run — from the abnormal one where a crashed run left a stale lock, the conditions under which force-unlock is safe and why misusing it corrupts state, plus where to look when the lock lives in DynamoDB and the settings that prevent recurrence.
Terraform Operations #7 OpenTofu and Licensing: The BSL Switch, the IBM Acquisition, and How to Choose
We walk the timeline from the 2023 BSL license switch and the OpenTofu fork to the CNCF acceptance and the completed IBM acquisition of HashiCorp. We cover what the BSL actually prohibits and why it is irrelevant to most users, where the two tools have diverged, how to choose based on your situation and what to check before migrating — and close out the Terraform track with a note on the Associate certification.
Terraform Operations #6 Execution Platforms Compared: Plain CI, HCP Terraform, Atlantis, and Spacelift
Using how far a hand-built GitHub Actions workflow carries you — and where it starts to hurt — as the yardstick, we compare the managed HCP Terraform, the self-hosted OSS Atlantis, and the commercial Spacelift family of platforms. We examine what a platform actually adds — policy as code, RBAC, run history visualization — along with pricing structure, and lay out selection criteria by team size.
Terraform Operations #5 Structuring at Scale: Stack Boundaries, Cross-Stack References, and When to Adopt Terragrunt
Examining the problems that appear when a single state grows large — slow plans, a wide blast radius, lock contention between teams — and how to split it into stacks along change frequency, lifetime, and owning team. We compare the two ways to pass values between stacks, terraform_remote_state versus SSM parameters, and their difference in coupling, lay out monorepo conventions, and cover how to judge when boilerplate has crossed the threshold that justifies Terragrunt.
Terraform Operations #4 Security and Cost Scanning: PR Guardrails with trivy, checkov, and Infracost
We compare and adopt trivy and checkov, static scanners that catch security misconfigurations before apply, and set a rule for handling false-positive exceptions in code with the reason attached. With Infracost commenting monthly cost changes on every PR, cost review moves to the pre-deploy stage, and default_tags-based cost tracking completes the PR guardrails.