GuideAdvanced
Terraform And Iac
This guide takes the Andes Cargo stack built by hand, command by command, in the AWS Core Services Guide and teaches you to stop creating infrastructure manually and start declaring it. It covers HCL in depth (`resource`, `data`, `variable`, `output`, `locals`, `module`), the `init`/`plan`/`apply`/`destroy` cycle and the idempotency behind it, and dedicates its heaviest module to Terraform's `state`: what it is, why it's the source of truth, how drift gets detected, how to import infrastructure that already exists (the exact real-world problem Andes Cargo has, since it was created by hand in the previous guide), and why a poorly secured state is one of the least-taught security risks in the discipline. It builds two reusable modules (`s3-bucket`, `iam-role`) and uses them to declare the same four canonical Andes Cargo resources — the bucket, both IAM roles, and the Lambda function with its DynamoDB table — proving that a single `terraform apply` recreates what used to require a manual checklist, and a single `terraform destroy` cleans it all up. The capstone runs the same code with OpenTofu, Terraform's open-source fork, and dedicates a lesson to a real March 2026 incident where an AI agent ran `terraform destroy` against production infrastructure without anyone carefully reviewing the plan — installing the rule that no `apply` or `destroy` ever runs without reading the full plan first. Everything runs $0 against the same LocalStack lab from the previous guide.
- 64
- lessons
- 8
- modules
- English · Spanish
- available in
- Yes
- certificate
- Free
- access
Outcomes
What you'll be able to do
- Explain why declarative infrastructure beats a sequence of imperative commands (reproducibility, Git history, PR review, a `destroy` that actually cleans everything up)
- Write HCL with judgment: the anatomy of `resource`/`data`/`provider` blocks, the implicit and explicit dependency graph, `fmt` and `validate`
- Run the `init`/`plan`/`apply`/`destroy` cycle and demonstrate Terraform's idempotency (a second `apply` with no changes does nothing)
- Parameterize a configuration with `variable`, `.tfvars` files, `locals`, and `output`, respecting the real precedence order
- Explain what `terraform.tfstate` is, why it's the source of truth, and detect drift by comparing state against reality
- Import pre-existing infrastructure with `terraform import` and write the HCL that matches what was imported
- Identify the security risk of a poorly secured state (secrets and ARNs in plain text) and apply the basic mitigations
- Build reusable Terraform modules (`source`, inputs/outputs) to avoid repeating the same bucket or role definition
- Declare with Terraform the same services already known (S3, IAM, Lambda, DynamoDB) that were created by hand with the AWS CLI in the previous guide
- Read a `terraform plan` as the artifact to review before applying, and recognize the blast radius of a poorly reviewed `apply`/`destroy`
- Run the same HCL code with OpenTofu and explain why the fork exists
Before you start
What you need to bring
It's for you if...
- Devs who already completed the AWS Core Services Guide and want to stop creating infrastructure by hand with the CLI
- Teams managing infrastructure through loose commands who need reproducibility, PR review, and Git history
- Data Engineering devs who need the Terraform piece to complete their software engineering stack (alongside git, tests, and CI/CD, covered in other guides)
- Anyone who wants to deeply understand Terraform's `state` before touching it in a real production environment
Requirements and materials
- AWS Core Services Guide completed (IAM, S3, Lambda with an S3 trigger, DynamoDB) with the LocalStack lab already running
- Basic terminal and shell skills (environment variables, redirection, reading JSON in the terminal)
- Free LocalStack account with an auth token, no credit card needed
- Docker installed and running locally
Content
The syllabus, module by module
Open any of them to see its lessons.
- 1. Introduction to the guide: from commands to code
- 2. The trouble with imperative infrastructure
- 3. What is infrastructure as code
- 4. Terraform and its alternatives: why Terraform, what is OpenTofu
- 5. Hands-on: installing Terraform and a clean start
- 6. Hands-on: connecting Terraform to LocalStack
- 7. Hands-on: your first resource, end to end
- 8. Project: bootstrapping Andes Cargo's Terraform repository
- 1. Introduction: reading and writing HCL with judgment
- 2. Anatomy of an HCL block
- 3. `resource` vs. `data`: creating vs. reading
- 4. The dependency graph: implicit and explicit
- 5. The `plan` → `apply` → `destroy` cycle, in depth
- 6. Hands-on: `fmt` and `validate`
- 7. Hands-on: proving idempotency
- 8. Project: Andes Cargo's first declared resource
- 1. Introduction: from fixed values to parameterized configuration
- 2. Input variables and types
- 3. `.tfvars` files and precedence
- 4. `locals` for computed values
- 5. `output` and string interpolation
- 6. The `random` provider, with a fixed seed
- 7. Hands-on: parameterizing the Andes Cargo bucket
- 8. Project: a configurable stack for Andes Cargo
- 1. Introduction: what Terraform remembers between runs
- 2. What is `terraform.tfstate`
- 3. Why state is the source of truth
- 4. Hands-on: detecting drift
- 5. Hands-on: importing existing infrastructure
- 6. Backends: local (what this guide uses) vs. remote
- 7. The security risk of state
- 8. Project: Andes Cargo's state under control
- 1. Introduction: the access and storage model, now in code
- 2. Recap: Andes Cargo's identity and storage model
- 3. IAM policies as declarative data
- 4. Hands-on: declaring `LambdaManifestProcessorRole`
- 5. Hands-on: declaring `AppServerRole`
- 6. Bucket versioning and policy as separate resources
- 7. Hands-on: declaring `andes-cargo-shipment-docs`
- 8. Project: Andes Cargo's identity and storage as code
- 1. Introduction: compute and data, now in code
- 2. Recap: Andes Cargo's processing and data model
- 3. Packaging Lambda code with `archive_file`
- 4. Hands-on: declaring the Lambda function
- 5. Hands-on: declaring the `Shipments` table
- 6. Wiring the S3 trigger
- 7. Hands-on: applying the full pipeline
- 8. Project: Andes Cargo's pipeline as code
- 1. Introduction to the capstone
- 2. Architecture review: the full stack as code
- 3. End-to-end: recreate from zero
- 4. `plan` as a PR review, and `apply` guardrails
- 5. Blast radius: the Claude Code `destroy` incident
- 6. Hands-on: the same code with OpenTofu
- 7. What Andes Cargo still needs
- 8. Final project: Andes Cargo's infrastructure as a deliverable
Common questions
What people usually ask
No limit. It's a free guide: come in whenever you like, as often as you like.
No. Modules run from easier to harder, but you can jump to the one you need. Progress is saved per lesson.
Whatever is needed is listed under “What you need to bring”, above. If nothing is listed there, you can start from zero.
In the Club's WhatsApp group, and every two weeks there's a live with an instructor where questions get worked through.
Yes. It's issued automatically once you finish every lesson, with a verifiable code you can share on LinkedIn.
Start whenever you like
What students say
These reviews are from enrolled students who completed at least 50% of the course. We moderate reviews only on content grounds (spam, offensive language, personal data), never for being critical or negative.
No approved reviews yet.
Be the first to share your experience!