Terraform Mastery
Master Terraform — HCL, state management, modules, providers, workspaces, testing, and multi-cloud infrastructure-as-code. 15 phases from CLI basics to production IaC pipelines.
Your Progress
Complete all 15 phases to master this track
Master Terraform — HCL, state management, modules, providers, workspaces, testing, and multi-cloud infrastructure-as-code. 15 phases from CLI basics to production IaC pipelines.
Phase 1: Infrastructure as Code Foundations and Terraform Setup
Adopt declarative infrastructure as code, install Terraform, and run your first plan and apply cycle.
Declarative Infrastructure as Code Principles
Why declared desired state beats imperative scripts for repeatable infrastructure.
Installing and Verifying Terraform
Installing the binary from official sources and validating the local environment.
The init, plan, and apply Workflow
How Terraform initializes a directory, previews changes, and executes them.
Deploying Your First Resource
Writing a configuration, applying it, inspecting outputs, and destroying it cleanly.
Terraform Versus Other IaC Tools
Comparing Terraform with CloudFormation, Pulumi, and configuration-management tools.
Phase 2: HCL Syntax and Expression Language Deep Dive
Read and write blocks, types, expressions, interpolation, and heredocs with correct HCL style.
Block Structure and Nesting
Recognizing labeled blocks, body attributes, and how Terraform nests configuration.
HCL Value Types
Working with strings, numbers, booleans, lists, maps, and object values.
Attributes, References, and Meta-arguments
Assigning values with references to other objects and applying meta-arguments.
String Interpolation and Templates
Embedding expressions inside quoted strings and choosing concatenation alternatives.
Heredoc and Slash-slash String Literals
Writing multi-line documents such as policy JSON directly inside configuration.
Phase 3: Resources, Data Sources, Outputs, and Dependencies
Declare managed resources, look up external data, publish outputs, and control creation order.
Resource Block Anatomy
Configuring resource arguments, provider selection, and resource identifiers.
Output Value Declarations
Exposing computed values with descriptions, sensitivity, and conditional display.
Data Source Lookups
Reading existing cloud objects that Terraform does not manage.
Implicit and Explicit Dependencies
Controlling the directed acyclic graph Terraform builds from references and depends_on.
The lifecycle Meta-argument
Controlling replacement, destruction, and ignored attribute changes per resource.
Phase 4: Variables, Locals, and Expression Logic
Parameterize configurations with validated variables, locals, conditionals, and built-in functions.
Input Variable Declarations
Declaring variables with types, defaults, descriptions, and value sources.
Variable Validation Rules
Enforcing allowed values and formats with validation and precondition blocks.
Locals for Derived Values
Computing intermediate values once with locals instead of repeating expressions.
Conditional Expressions
Branching values with the ternary operator and guarding against type mismatches.
The Built-in Function Library
Using string, collection, file, network, and time functions in expressions.
Phase 5: State Storage and Remote Backends
Understand state file internals, move storage off laptops, and configure locked remote backends.
State File Internals
Reading the JSON structure of state with resources, outputs, serial, and lineage.
Limitations of Local State Files
Why laptop-stored state fails for teams, CI systems, and concurrent runs.
Configuring a Remote Backend
Moving state to shared storage with terraform init backend migration.
S3 Bucket and DynamoDB Locking Backend
Pairing an S3 state bucket with a DynamoDB table for state locking on AWS.
Partial Backend Configuration
Supplying environment-specific backend settings at init without editing shared files.
Phase 6: State Operations, Import, and Relocation
Inspect and edit state safely with list, show, mv, rm, import, moved blocks, and lock recovery.
Listing and Showing State Entries
Finding resource addresses with terraform state list and reading their attributes.
Moving and Forgetting State Entries
Relocating addresses after refactors and dropping objects Terraform should no longer track.
Importing Existing Resources
Adopting pre-existing cloud objects by generating resource entries in state.
moved Block Declarations
Recording refactors in code so state moves automatically for every teammate.
State Lock Breakage and Recovery
Diagnosing stale locks and unlocking safely after interrupted operations.
Phase 7: Module Design and the Module Registry
Factor infrastructure into versioned modules with clear input and output contracts.
Module Block Anatomy
Declaring module calls with source, version, and passing input arguments.
Module Source Addresses
Choosing between local paths, registry namespaces, and Git repository sources.
Designing Module Input and Output Contracts
Choosing stable variable names, sensible defaults, and meaningful exported values.
Composing Modules into Layers
Structuring root modules, shared modules, and wrapper modules for scale.
Publishing to a Private Module Registry
Versioning and sharing modules through Terraform Cloud, Enterprise, or Git sources.
Phase 8: Provider Configuration and Version Pinning
Declare required providers, constrain versions, alias multi-region clients, and mirror artifacts.
Declaring Required Providers
Using the required_providers block to map short names to source addresses.
Version Constraint Syntax
Writing pessimistic, range, and exact constraints for providers and modules.
Provider Lock File Integrity
Committing .terraform.lock.hcl and verifying checksums across machines.
Provider Aliases for Multi-Region Use
Configuring additional provider instances and referencing them from resources.
Provider Mirrors for Air-gapped Networks
Serving providers from filesystem or network mirrors when registries are unreachable.
Phase 9: Workspaces and Environment Strategy
Separate environments with workspaces or directory layouts and define a promotion workflow.
Workspace Basics with the CLI
Creating, switching, and listing workspaces and understanding state isolation.
Workspace Design Tradeoffs
Deciding when workspaces fit and when per-environment directories serve better.
Directory Layouts per Environment
Organizing dev, staging, and prod into separate roots with shared modules.
Promoting Changes Across Environments
Running dev first, reviewing diffs, and reusing verified plans in production.
Phase 10: Dynamic Infrastructure with count, for_each, and dynamic
Create repeated resources, iterate collections, and generate nested blocks programmatically.
The count Meta-argument
Creating fixed repetitions of a resource and indexing them in references.
for_each over Maps and Sets
Creating one resource per stable key while keeping instances addressable by name.
for Expressions and Comprehensions
Transforming and filtering collections into new lists and maps inside expressions.
dynamic Blocks for Repeatable Nesting
Generating repeated inner blocks like ingress rules from collection data.
Splat and Attribute Access Expressions
Extracting attribute lists from whole collections with splat syntax.
Phase 11: Policy Enforcement, Security Scanning, and Secrets
Handle secrets carefully, scan configurations statically, and gate applies with policy engines.
Sensitive Values and Redaction
Marking secrets sensitive and understanding what redaction does and does not hide.
Injecting Secrets from External Stores
Reading credentials from vaults and secret managers instead of hardcoding them.
Static Security Scanning
Running tfsec, Checkov, and Trivy against configurations before apply.
OPA and Conftest Policy Gates
Writing Rego policies that evaluate plan JSON for organizational rules.
Sentinel Policies in Terraform Platforms
Applying HashiCorp Sentinel rules as enforced checks on plan and apply runs.
Phase 12: CI/CD Pipelines and Plan/Apply Gates
Automate plan and apply in pipelines with review gates, comment bots, and short-lived credentials.
Structuring Plan and Apply Jobs
Splitting init, validate, plan, and apply into separate pipeline stages.
Pull Request Workflow Gates
Requiring plan output, policy checks, and approvals before merges land.
Plan Comment Bots and Atlantis-style Workflows
Posting formatted plan results and applying via PR commands automatically.
Remote Execution Platforms
Running plans in Terraform Cloud, HCP Terraform, or managed CI runners.
OIDC Federation for Pipeline Credentials
Exchanging short-lived tokens for cloud roles instead of storing static keys.
Phase 13: Multi-Cloud and Provider Composition Patterns
Wire resources across clouds and providers while keeping abstractions honest about tradeoffs.
Operating Multiple Provider Instances
Running the same provider against several accounts, subscriptions, or regions.
Wiring Resources Across Clouds
Passing outputs from one cloud's resources into another cloud's configuration.
Abstraction Modules Across Clouds
Building interfaces that swap provider-specific implementations behind one contract.
Multi-Cloud Design Tradeoffs
Evaluating when multi-cloud IaC adds resilience and when it only adds complexity.
Phase 14: Testing Terraform: Native Tests and Terratest
Verify configurations with the native test framework, mocks, plan assertions, and Go-based Terratest.
The Native terraform test Framework
Writing .tftest.hcl files with run blocks that execute plans and assertions.
Mocking Providers in Tests
Replacing provider responses with mock data so tests never touch real clouds.
Plan Assertions and Expectations
Asserting resource counts, attribute values, and expected failures in tests.
Terratest Harness in Go
Using Terratest helpers to apply, verify outputs, and destroy in one test run.
Layering Tests in the Pipeline
Combining fmt, validate, unit plan tests, and scheduled integration runs.
Phase 15: Drift, Collaboration, and Enterprise Capstone
Detect and repair drift, estimate costs, add team guardrails, and operate IaC at organizational scale.
Detecting Configuration Drift
Scheduling refresh-only plans that reveal out-of-band infrastructure changes.
Remediating Detected Drift
Deciding between importing fixes, reapplying configuration, or accepting divergence.
Cost Estimation on Plans
Attaching monthly cost estimates to plans so changes arrive with price context.
Team Collaboration Guardrails
Adding ownership files, required checks, and access scopes to shared repositories.
Enterprise IaC Operating Model
Combining modules, pipelines, policy, state, and cost controls into a lasting practice.