Narsing Shah

Terraform Certified Associate Notes

9/2/2023

💡 Core Mnemonics

  • A-P-A-D (Workflow): Author -> Plan -> Apply -> Destroy
  • I-I-A (Core Commands): Init (download) -> Plan (preview) -> Apply (deploy)
  • F-V (Code Quality): Fmt (format) -> Validate (syntax)
  • S-L (State): State (truth) -> Lock (safety)
  • P-R (Providers): Plugins (needed) -> Registry (source)

🛠️ Essential Commands

1. Initialize Working Directory

terraform init
  • Downloads necessary provider plugins.
  • Sets up backend storage.

2. Format Code

terraform fmt
  • Rewrites config files for readability.
  • Ensures consistent spacing style.

3. Validate Configuration

terraform validate
  • Checks syntax correctness.
  • Verifies attribute names and types.

4. Preview Changes

terraform plan
  • Shows what actions will happen.
  • Does not change real infrastructure.

5. Create Infrastructure

terraform apply
  • Builds or changes real infrastructure.
  • Asks for approval before running.

6. Auto-Approve Changes

terraform apply -auto-approve
  • Skips interactive approval prompt.
  • Danger: Use only in automated pipelines.

7. Destroy Infrastructure

terraform destroy
  • Deletes all managed infrastructure resources.
  • Requires manual approval by default.

8. Inspect State

terraform show
  • Reads current state file data.
  • Prints human-readable infrastructure status.

⚠️ Exam Quick Rules

  • State File: Never modify terraform.tfstate by hand.
  • Variables: Use variables.tf for inputs, outputs.tf for values.
  • Implicit Dependency: Created automatically when one resource references another.
  • Explicit Dependency: Created manually using the depends_on keyword.
  • Refresh: terraform plan automatically updates state with real-world changes.

🚀 Workspaces (Mnemonic: I-S-W-D)

  • Isolate: Workspaces separate states for the exact same configuration code.
  • Select: Use terraform workspace select [name] to switch between environments.
  • What’s active?: Use terraform workspace show to see your current workspace.
  • Default: The primary workspace is always named default and cannot be deleted.

Workspace Commands

  • terraform workspace new dev -> Creates a brand new workspace named dev.
  • terraform workspace list -> Shows all existing workspaces with an asterisk next to active.
  • terraform workspace select prod -> Switches your current context to prod workspace.
  • terraform workspace show -> Outputs the name of the workspace you are currently in.
  • terraform workspace delete dev -> Removes a workspace (must be empty and inactive).

🔒 Backends (Mnemonic: L-R-S-S)

  • Local: Default backend; stores state on your own laptop disk.
  • Remote: Stores state in cloud buckets like AWS S3 or Terraform Cloud.
  • State Locking: Supported by S3 (via DynamoDB), Azure Blob, and Consul.
  • Secrets Safety: Remote backends keep sensitive plain-text API keys off local disks.

Backend Configurations

# Standard local backup
terraform {
  backend "local" {
    path = "terraform.tfstate"
  }
}

# Remote backend with locking capabilities
terraform {
  backend "s3" {
    bucket         = "my-terraform-state-bucket"
    key            = "prod/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "terraform-lock-table" # Enables State Locking
  }
}

💾 State Management (Mnemonic: M-R-I-P)

  • Manual Zero: Never ever modify the raw .tfstate JSON file with a text editor.
  • Refactor safely: Use commands to rename or move resources without breaking real infrastructure.
  • Import existing: Bring pre-made cloud resources into your Terraform state file tracking.
  • Purge tracking: Forget items from tracking without destroying the actual cloud resource.

State Modification Commands

  • terraform state list -> Lists every resource address currently tracked in state.
  • terraform state show aws_instance.web -> Shows detailed state attributes for one specific resource.
  • terraform state mv old_name new_name -> Renames a resource in state so it matches code updates.
  • terraform state rm aws_instance.bad -> Deletes a item from state (cloud resource survives).
  • terraform import aws_instance.web i-12345678 -> Matches existing cloud asset ID to code resource block.
  • terraform refresh -> Updates local state to match real cloud layout (does not change cloud).