#Terraform
48 posts
Terraform Operations #3 Code Quality and Testing: tflint, pre-commit, and terraform test
On top of fmt and validate, tflint catches provider-knowledge errors — instance types that do not exist, for example — before plan ever runs, and pre-commit hooks automate all of it at commit time. We learn Terraform's built-in test framework, terraform test, through a module-testing example covering tftest files and the run and assert structure, then close with a practical rule for choosing between plan tests and apply tests based on their cost difference.
Terraform Operations #2 Drift and State Surgery: Scheduled Detection, import Blocks, removed Blocks
Changes made outside the code need a detection system: a scheduled plan workflow with -detailed-exitcode catches drift within a day. We lay out the decision criteria for the three responses to drift — absorb into code, revert with apply, or hand over with ignore_changes. Then we adopt console-born resources with the import block, generate a code draft with -generate-config-out, and remove resources from state only — without destroying them — using the removed block.
Terraform Operations #1 Team Workflow: plan Review on PRs, apply via GitHub Actions
Local apply concentrates strong credentials on individual laptops and skips review — problems that surface fast on a team. This post builds the standard workflow with GitHub Actions: PRs get the plan output as a comment, and merging to main triggers apply in CI. We wire up OIDC role assumption, automate plan comments on PRs, and use concurrency to prevent simultaneous applies — the first step toward removing human hands from apply.
Terraform in Practice #10 Domain, HTTPS, and Completion: Route 53, ACM Validation, CloudFront and provider alias
Connecting the Route 53 hosted zone as a data source, issuing an ACM certificate through the three-resource DNS validation idiom, and attaching an HTTPS listener with a redirect to the ALB. We cover using a provider alias to work with us-east-1 for the CloudFront certificate, then wire up a CDN serving the locked-down S3 bucket via OAC and the alias records, completing the architecture built across ten parts.
Terraform in Practice #9 Environment Separation: Workspace Limits, Directory Layout, and moved Refactoring
Examining where the workspace approach falls short for environment separation, then setting up the standard practical layout that splits code into modules and envs directories. We refactor the code that grew in a single directory into network, compute, and data modules, using moved blocks to relocate addresses without recreating anything, and finish with dev and prod running the same modules with different values.
Terraform in Practice #8 Deploying on ECS Fargate: Task Definitions, Services, and the Cutover Behind the ALB
Examining the limits of the user_data approach and moving the compute layer to containers. We build an ECS cluster and a Fargate task definition, separate the execution role from the task role, create a service with an ip-type target group, and run EC2 and containers side by side behind the same ALB before cutting over with a single listener change — all in code.
Terraform in Practice #7 IAM as Code: Instance Roles, Least Privilege, and GitHub Actions OIDC
Writing trust policies and permission policies with the aws_iam_policy_document data source, then attaching a role to EC2 through an instance profile to complete SSM Session Manager access and secret reads. We narrow least privilege down to individual resource ARNs, and build the OIDC federation that lets GitHub Actions assume an AWS role without access keys — all in code.
Terraform in Practice #6 Secrets Management: SSM vs Secrets Manager and Write-Only Arguments
We compare SSM Parameter Store and Secrets Manager on cost and features to set a selection standard, then use Terraform 1.11 ephemeral resources and write-only arguments to build a configuration where the DB password appears in neither plan nor state. We also design the path where the application reads the secret at runtime, solving the plaintext problem from the last part structurally.
Terraform in Practice #5 RDS and S3: Codifying the Data Tier with Safety Guards
We place an isolated PostgreSQL RDS instance in private subnets using a DB subnet group and security group chaining, then configure gp3 storage, backups, and the prevent_destroy safety guard. We also set up an S3 bucket for static assets with public access blocked, and confirm the problem that the DB password kept temporarily in a variable stays in state as plaintext, handing it off as the task for the next part.
Terraform in Practice #4 ALB and Auto Scaling: Launch Template, Target Group, and Scaling Policy
We promote the single EC2 instance to an Auto Scaling group behind a load balancer. The instance definition moves into a launch template, the ALB, target group, and listener get wired together, and a CPU target tracking scaling policy goes on top. We also delete the verification instance from the code to walk through how resource removal works in IaC, and receive the first response in a browser.
Terraform in Practice #3 EC2 and Security Groups: SG Chaining Design and Booting with user_data
Instead of writing CIDR blocks, we connect security groups by security group reference — a chaining design across an ALB and EC2 two-tier layout. We then look up the latest AL2023 AMI with a data source and launch an EC2 instance into a private subnet that boots a web server via user_data. Also covered: why no SSH port is opened, and the plan to complete access with Session Manager.
Terraform in Practice #2 VPC Network as Code: Subnets Across Two AZs, Routing, and the NAT Gateway
We build the VPC that the myapp infrastructure stands on. Public and private subnets go across two AZs with for_each, an internet gateway and route tables define the traffic paths, and a NAT gateway carries private outbound traffic with the cost trade-off made explicit. We wrap up by organizing the network outputs so the compute layer in the next part has everything it needs.