Terraform Cheatsheet

Error: Error acquiring the state lock
Error message: resource temporarily unavailable
Lock Info:
  ID:        5655ac73-41b8-8922-6280-797c64a5ba18
  Path:      terraform.tfstate
  Operation: OperationTypeApply
  Who:       user@host

Error: Failed to install provider
Error while installing hashicorp/random v3.7.2: the current package for
registry.terraform.io/hashicorp/random 3.7.2 doesn't match any of the
checksums previously recorded in the dependency lock file

rm .terraform.lock.hcl
terraform providers lock -platform=linux_amd64 -platform=darwin_arm64
terraform init

Error: Cycle:
  terraform_data.a
  terraform_data.b

resource "terraform_data" "per_id" {
  for_each = toset(terraform_data.ids[*].id) # IDs don't exist until apply
  input    = each.value
}

Error: Invalid for_each argument
The "for_each" set includes values derived from resource attributes that
cannot be determined until apply, and so Terraform cannot determine the full
set of keys that will identify the instances of this resource.

Modules declared by configuration:
.
├── "vpc"[registry.terraform.io/terraform-aws-modules/vpc/aws] 6.7.3 (~> 6.0)
└── "web_servers"[./modules/web-server]

# buckets.tfquery.hcl
list "aws_s3_bucket" "all" {
  provider = aws
}

$ terraform query
list.aws_s3_bucket.all   account_id=,bucket=reports-2024,region=us-east-1   reports-2024
list.aws_s3_bucket.all   account_id=,bucket=reports-2025,region=us-east-1   reports-2025

ephemeral "random_password" "db" {
  length  = 20
  special = false
}

resource "aws_secretsmanager_secret" "db" {
  name = "prod/db/password"
}

resource "aws_secretsmanager_secret_version" "db" {
  secret_id                = aws_secretsmanager_secret.db.id
  secret_string_wo         = ephemeral.random_password.db.result
  secret_string_wo_version = 1
}

ephemeral.random_password.db: Opening...
ephemeral.random_password.db: Opening complete after 0s
ephemeral.random_password.db: Closing...

# main.tf
variable "environment" {
  type = string
  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Environment must be dev, staging, or prod."
  }
}

resource "aws_s3_bucket" "logs" {
  bucket = "myapp-${var.environment}-logs"
}

output "bucket_arn" {
  value = aws_s3_bucket.logs.arn
}

# tests/bucket.tftest.hcl
mock_provider "aws" {
  mock_resource "aws_s3_bucket" {
    defaults = {
      arn = "arn:aws:s3:::mocked"
    }
  }
}

variables {
  environment = "dev"
}

run "bucket_name_follows_environment" {
  command = plan

  assert {
    condition     = aws_s3_bucket.logs.bucket == "myapp-dev-logs"
    error_message = "Unexpected bucket name"
  }
}

run "apply_with_mocked_aws" {
  assert {
    condition     = output.bucket_arn == "arn:aws:s3:::mocked"
    error_message = "Mock ARN not used"
  }
}

run "rejects_unknown_environment" {
  command = plan

  variables {
    environment = "qa"
  }

  expect_failures = [
    var.environment,
  ]
}

$ terraform test
tests/bucket.tftest.hcl... in progress
  run "bucket_name_follows_environment"... pass
  run "apply_with_mocked_aws"... pass
  run "rejects_unknown_environment"... pass
tests/bucket.tftest.hcl... tearing down
tests/bucket.tftest.hcl... pass

Success! 3 passed, 0 failed.

  run "rejects_unknown_environment"... fail
Error: Missing expected failure
The checkable object, var.environment, was expected to report an error but
did not.
Failure! 2 passed, 1 failed.

# String variables
export TF_VAR_region="us-west-2"
export TF_VAR_instance_type="t3.micro"
export TF_VAR_environment="production"
export TF_VAR_project_name="my-app"
export TF_VAR_ami_id="ami-0d26eb3972b7f8c96"

# Number variables
export TF_VAR_instance_count="3"
export TF_VAR_max_size="10"
export TF_VAR_port="8080"
export TF_VAR_timeout="300"

# Boolean variables
export TF_VAR_enable_monitoring="true"
export TF_VAR_enable_backup="false"
export TF_VAR_create_dns_record="true"
export TF_VAR_enable_encryption="true"

# List variables (same type elements)
export TF_VAR_availability_zones='["us-west-2a","us-west-2b","us-west-2c"]'
export TF_VAR_allowed_ips='["192.168.1.0/24","10.0.0.0/8"]'
export TF_VAR_subnet_ids='["subnet-abc123","subnet-def456"]'

# Map variables (key-value pairs)
export TF_VAR_tags='{"Environment":"prod","Team":"devops","CostCenter":"engineering"}'
export TF_VAR_instance_types='{"dev":"t3.micro","staging":"t3.small","prod":"t3.large"}'

# Object variables (structured data with different types)
export TF_VAR_server_config='{"name":"web-server","port":8080,"enabled":true}'
export TF_VAR_database='{"engine":"postgres","version":"14.5","multi_az":true,"allocated_storage":100}'

# Tuple variables (fixed-length, mixed types)
export TF_VAR_deployment_info='["v1.2.3",8080,true]'

# Set variables (unique values, unordered)
export TF_VAR_security_groups='["sg-123456","sg-789012","sg-345678"]'

# Complex nested structures
export TF_VAR_vpc_config='{"cidr":"10.0.0.0/16","enable_dns":true,"subnets":[{"cidr":"10.0.1.0/24","az":"us-west-2a"},{"cidr":"10.0.2.0/24","az":"us-west-2b"}]}'

# Map of objects (multiple structured items)
export TF_VAR_subnets='{"subnet_a":{"name":"Public-A","cidr":"10.0.1.0/24","public":true},"subnet_b":{"name":"Private-B","cidr":"10.0.2.0/24","public":false}}'

# List of objects (ordered structured items)
export TF_VAR_instances='[{"name":"web-1","type":"t3.micro","az":"us-west-2a"},{"name":"web-2","type":"t3.micro","az":"us-west-2b"}]'

# Sensitive variables (passwords, keys, tokens)
export TF_VAR_db_password="super-secret-password"
export TF_VAR_api_key="your-api-key-here"
export TF_VAR_private_key="-----BEGIN RSA PRIVATE KEY-----..."

# Terraform-specific environment variables
export TF_LOG=DEBUG                                    # Log level: TRACE, DEBUG, INFO, WARN, ERROR
export TF_LOG_PATH="./terraform.log"                   # Log file path
export TF_LOG_CORE=TRACE                               # Core Terraform logging
export TF_LOG_PROVIDER=DEBUG                           # Provider plugin logging

# Configuration and behavior
export TF_CLI_CONFIG_FILE="$HOME/.terraformrc"         # CLI configuration file
export TF_DATA_DIR=".terraform"                        # Data directory for plugins and modules
export TF_PLUGIN_CACHE_DIR="$HOME/.terraform.d/plugin-cache"  # Plugin cache directory
export TF_INPUT=false                                  # Disable interactive input prompts
export TF_IN_AUTOMATION=true                           # Indicate running in CI/CD
export TF_WORKSPACE="production"                       # Set active workspace

# Terraform Cloud/Enterprise
export TF_TOKEN_app_terraform_io="your-token-here"     # Terraform Cloud token
export TF_CLOUD_ORGANIZATION="my-org"                  # Organization name
export TF_CLOUD_HOSTNAME="app.terraform.io"            # Terraform Cloud hostname

# CLI behavior customization
export TF_CLI_ARGS="-no-color"                         # Global CLI arguments
export TF_CLI_ARGS_plan="-refresh=false"               # Arguments for plan command
export TF_CLI_ARGS_apply="-auto-approve"               # Arguments for apply command

# Provider-specific variables (examples)
export TF_VAR_aws_access_key="AKIAIOSFODNN7EXAMPLE"
export TF_VAR_aws_secret_key="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
export TF_VAR_azure_subscription_id="00000000-0000-0000-0000-000000000000"
export TF_VAR_gcp_project_id="my-gcp-project"

# Backup state before major operations
cp terraform.tfstate terraform.tfstate.backup.$(date +%Y%m%d_%H%M%S)

# Use remote state
terraform init -backend-config="bucket=my-tf-state" -backend-config="key=prod/terraform.tfstate"

# Enable state locking (S3 native lock file, Terraform 1.10+)
terraform init -backend-config="use_lockfile=true"

alias tf="terraform"
alias tfi="terraform init"
alias tfp="terraform plan"
alias tfa="terraform apply"
alias tfd="terraform destroy"
alias tfs="terraform show"
alias tfo="terraform output"
alias tfv="terraform validate"
alias tff="terraform fmt"
alias tfw="terraform workspace"
alias tfws="terraform workspace show"
alias tfsl="terraform state list"

# Generic function for any base64 string
tf_base64_decode() {
    if [ $# -eq 0 ]; then
        echo "Usage: tf_base64_decode '<base64_string>'"
        return 1
    fi
    echo "base64decode(\"$1\")" | terraform console
}

terraform-project/
├── environments/
│   ├── dev/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   ├── outputs.tf
│   │   ├── terraform.tfvars
│   │   └── versions.tf
│   ├── staging/
│   └── prod/
├── modules/
│   ├── vpc/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   ├── outputs.tf
│   │   └── versions.tf
│   ├── ec2/
│   └── rds/
├── .gitignore
├── README.md
└── Makefile

# Resources: snake_case
resource "aws_instance" "web_server" {}

# Resource tags: kebab-case pattern <project>-<environment>-<resource>-<purpose>
tags = {
  Name = "${var.project_name}-${var.environment}-web-server"
}

# Variables: snake_case with descriptive names
variable "database_instance_class" {}

# Modules: snake_case
module "vpc_network" {}

locals {
  mandatory_tags = {
    Project     = var.project_name
    Environment = var.environment
    ManagedBy   = "Terraform"
    Owner       = var.team_name
    CostCenter  = var.cost_center
  }

  common_tags = merge(local.mandatory_tags, {
    Application = var.application_name
  })
}

# Apply to resources
resource "aws_instance" "web" {
  # ...
  tags = merge(local.common_tags, {
    Name = "${var.project_name}-${var.environment}-web-server"
    Role = "web-server"
  })
}

variable "environment" {
  description = "Environment name"
  type        = string

  validation {
    condition     = can(regex("^(dev|staging|prod)$", var.environment))
    error_message = "Environment must be dev, staging, or prod."
  }
}

variable "instance_type" {
  description = "EC2 instance type"
  type        = string
  default     = "t3.micro"

  validation {
    condition = contains([
      "t3.micro", "t3.small", "t3.medium", "t3.large",
      "t3.xlarge", "t3.2xlarge"
    ], var.instance_type)
    error_message = "Instance type must be a valid t3 instance type."
  }
}

variable "cidr_block" {
  description = "VPC CIDR block"
  type        = string

  validation {
    condition     = can(cidrhost(var.cidr_block, 0))
    error_message = "CIDR block must be a valid IPv4 CIDR."
  }
}

# Mark variables as sensitive
variable "database_password" {
  description = "Database master password"
  type        = string
  sensitive   = true
}

# Use AWS Secrets Manager
data "aws_secretsmanager_secret_version" "db_password" {
  secret_id = "prod/database/password"
}

locals {
  db_password = jsondecode(
    data.aws_secretsmanager_secret_version.db_password.secret_string
  )["password"]
}

# Mark outputs as sensitive
output "database_endpoint" {
  description = "Database endpoint"
  value       = aws_db_instance.main.endpoint
  sensitive   = true
}

terraform {
  backend "s3" {
    bucket       = "company-terraform-state"
    key          = "environments/prod/terraform.tfstate"
    region       = "us-east-1"
    encrypt      = true
    kms_key_id   = "arn:aws:kms:us-east-1:123456789012:key/..."
    use_lockfile = true
    assume_role = {
      role_arn = "arn:aws:iam::123456789012:role/TerraformStateRole"
    }
  }
}

Error: Error acquiring the state lock
Error message: operation error S3: PutObject, https response error
StatusCode: 412, RequestID: ..., api error PreconditionFailed: At least one of the pre-conditions you
specified did not hold
Lock Info:
  ID:        c8a60fa0-3031-3c98-3a8c-90fe837e19e8
  Path:      my-terraform-state/prod/terraform.tfstate
  Operation: OperationTypeApply
  Who:       user@host
  Version:   1.16.6

resource "aws_dynamodb_table" "terraform_locks" {
  name         = "terraform-state-locks"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "LockID"

  attribute {
    name = "LockID"
    type = "S"
  }

  tags = {
    Name = "Terraform State Lock Table"
  }
}

# Azure
terraform {
  backend "azurerm" {
    resource_group_name  = "terraform-rg"
    storage_account_name = "terraformstate"
    container_name       = "tfstate"
    key                  = "prod.terraform.tfstate"
  }
}

# Google Cloud
terraform {
  backend "gcs" {
    bucket = "my-terraform-state"
    prefix = "prod"
  }
}

# Consul
terraform {
  backend "consul" {
    address = "consul.example.com:8500"
    scheme  = "https"
    path    = "terraform/prod"
  }
}

terraform {
  cloud {
    organization = "example-org"

    workspaces {
      name = "app-production" # or: tags = ["app", "prod"] to select by tag
    }
  }
}

terraform login        # stores an API token in ~/.terraform.d/credentials.tfrc.json
terraform init         # connects to the workspace; asks to migrate local state if there is any

bucket       = "my-terraform-state"
key          = "prod/terraform.tfstate"
region       = "us-east-1"
encrypt      = true
use_lockfile = true

terraform init -backend-config=backend.hcl
terraform init -migrate-state -force-copy

# Access outputs from another state file
data "terraform_remote_state" "vpc" {
  backend = "s3"

  config = {
    bucket = "my-terraform-state"
    key    = "vpc/terraform.tfstate"
    region = "us-east-1"
  }
}

# Use outputs from remote state
resource "aws_instance" "example" {
  ami           = "ami-0c55b159cbfafe1d0"
  instance_type = "t2.micro"
  subnet_id     = data.terraform_remote_state.vpc.outputs.private_subnet_id

  vpc_security_group_ids = [
    data.terraform_remote_state.vpc.outputs.default_security_group_id
  ]
}

# Import resource with count index
terraform import 'aws_instance.example[0]' i-1234567890abcdef0

# Import resource with for_each key
terraform import 'aws_instance.example["web"]' i-1234567890abcdef0

# Import into module
terraform import module.database.aws_db_instance.main mydb-instance

# Move resource into a module
terraform state mv aws_instance.example module.web.aws_instance.example

# Move resource out of a module
terraform state mv module.web.aws_instance.example aws_instance.example

# Move between count and for_each
terraform state mv 'aws_instance.example[0]' 'aws_instance.example["web"]'

# Detect drift (show what changed outside Terraform)
terraform plan -refresh-only

# Update state to match real infrastructure (without changing resources)
terraform apply -refresh-only

# Fix drift by updating infrastructure to match config
terraform apply

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::my-terraform-state"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-terraform-state/prod/terraform.tfstate"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::my-terraform-state/prod/terraform.tfstate.tflock"
    }
  ]
}

company-terraform-state/
├── environments/
│   ├── dev/terraform.tfstate
│   ├── staging/terraform.tfstate
│   └── prod/terraform.tfstate
└── global/
    ├── iam.tfstate
    └── route53.tfstate

resource "aws_instance" "web" {
  ami           = var.ami_id
  instance_type = var.instance_type

  lifecycle {
    create_before_destroy = true # Zero-downtime replacements
    prevent_destroy       = true # Protect production resources
    ignore_changes = [
      ami, # Ignore AMI drift
      tags["LastUpdated"],
    ]
  }
}

# Controlled replacements with replace_triggered_by
resource "aws_instance" "web" {
  ami           = var.ami_id
  instance_type = var.instance_type

  lifecycle {
    replace_triggered_by = [
      aws_launch_template.web.latest_version
    ]
  }
}

# Preconditions and postconditions (Terraform 1.2+)
resource "aws_instance" "app" {
  ami           = data.aws_ami.example.id
  instance_type = var.instance_type

  lifecycle {
    precondition {
      condition     = data.aws_ami.example.architecture == "x86_64"
      error_message = "AMI must be x86_64 architecture."
    }

    postcondition {
      condition     = self.public_ip != ""
      error_message = "Instance must have a public IP."
    }
  }
}

# Rename a resource (Terraform 1.1+)
moved {
  from = aws_instance.old_name
  to   = aws_instance.new_name
}

# Move a resource into a module
moved {
  from = aws_instance.example
  to   = module.compute.aws_instance.example
}

# Move a resource out of a module
moved {
  from = module.compute.aws_instance.example
  to   = aws_instance.example
}

import {
  to = aws_s3_bucket.logs
  id = "legacy-logs"
}

terraform plan -generate-config-out=generated.tf

aws_s3_bucket.logs: Preparing import... [id=legacy-logs]
aws_s3_bucket.logs: Refreshing state... [id=legacy-logs]
  # aws_s3_bucket.logs will be imported
  # (config will be generated)

# __generated__ by Terraform
# Please review these resources and move them into your main configuration files.

# __generated__ by Terraform from "legacy-logs"
resource "aws_s3_bucket" "logs" {
  bucket              = "legacy-logs"
  bucket_namespace    = "global"
  force_destroy       = false
  object_lock_enabled = false
  region              = "us-east-1"
  tags                = {}
  tags_all            = {}
}

resource "aws_s3_bucket" "app_logs" {
  bucket = "legacy-logs"
}

moved {
  from = aws_s3_bucket.logs
  to   = aws_s3_bucket.app_logs
}

  # aws_s3_bucket.logs has moved to aws_s3_bucket.app_logs
Plan: 0 to add, 0 to change, 0 to destroy.

removed {
  from = aws_s3_bucket.app_logs

  lifecycle {
    destroy = false
  }
}

 # aws_s3_bucket.app_logs will no longer be managed by Terraform, but will not be destroyed
 # (destroy = false is set in the configuration)
Plan: 0 to add, 0 to change, 0 to destroy.

Warning: Some objects will no longer be managed by Terraform

check "health_check" {
  data "http" "app" {
    url = "https://${aws_instance.app.public_ip}:8080/health"
  }

  assert {
    condition     = data.http.app.status_code == 200
    error_message = "Health check failed."
  }
}

resource "aws_instance" "app" {
  ami           = data.aws_ami.latest.id
  instance_type = "t3.micro"

  # File provisioner
  provisioner "file" {
    content = templatefile("${path.module}/templates/app.conf.tpl", {
      db_host     = aws_db_instance.main.endpoint
      environment = var.environment
    })
    destination = "/tmp/app.conf"

    connection {
      type        = "ssh"
      user        = "ec2-user"
      private_key = file(var.private_key_path)
      host        = self.public_ip
    }
  }

  # Remote-exec provisioner
  provisioner "remote-exec" {
    inline = [
      "sudo mv /tmp/app.conf /etc/app/app.conf",
      "sudo systemctl enable app",
      "sudo systemctl start app",
    ]

    connection {
      type        = "ssh"
      user        = "ec2-user"
      private_key = file(var.private_key_path)
      host        = self.public_ip
    }
  }
}

# Local-exec provisioner (runs on the machine running Terraform).
# terraform_data (built in since 1.4) replaces null_resource without the null provider
resource "terraform_data" "ansible" {
  triggers_replace = [aws_instance.cluster[*].id]

  provisioner "local-exec" {
    command = "ansible-playbook -i ${aws_instance.cluster[0].public_ip}, playbooks/setup.yml"
  }
}

# Use for_each when resources are identified by name/key (safer for additions/removals)
resource "aws_instance" "web" {
  for_each = toset(var.availability_zones)

  ami               = data.aws_ami.ubuntu.id
  instance_type     = var.instance_type
  availability_zone = each.value

  tags = merge(local.common_tags, {
    Name = "${var.project_name}-web-${each.value}"
  })
}

# Use count only for conditional creation
resource "aws_eip" "web" {
  count    = var.create_eip ? 1 : 0
  instance = aws_instance.web.id
  domain   = "vpc"
}

# Conditional resources with count
resource "aws_eip" "web" {
  count    = var.create_eip ? 1 : 0
  instance = aws_instance.web.id
  domain   = "vpc"
}

# Safe references to conditional resources
output "eip_public_ip" {
  value = var.create_eip ? aws_eip.web[0].public_ip : aws_instance.web.public_ip
}

# Fallback values with try(): for attributes that may be missing,
# not for data sources that fail (a failed lookup still stops the plan)
locals {
  ami_id = try(var.overrides.ami_id, var.default_ami_id)
}

# Reference security groups instead of CIDR blocks where possible
resource "aws_security_group" "web" {
  name_prefix = "${var.project_name}-${var.environment}-web-"
  vpc_id      = var.vpc_id

  ingress {
    description     = "HTTPS from ALB"
    from_port       = 443
    to_port         = 443
    protocol        = "tcp"
    security_groups = [aws_security_group.alb.id]
  }

  egress {
    description = "HTTPS to internet"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = local.common_tags
}

name: Terraform
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  terraform:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v7
    - uses: hashicorp/setup-terraform@v4
      with:
        terraform_version: 1.16.6
    - run: terraform init
    - run: terraform validate
    - run: terraform fmt -check
    - run: terraform plan -var-file="prod.tfvars"
    - name: Apply (main only)
      if: github.ref == 'refs/heads/main'
      run: terraform apply -auto-approve -var-file="prod.tfvars"

stages: [validate, plan, apply]

variables:
  TF_ROOT: ${CI_PROJECT_DIR}/environments/prod

before_script:
  - cd ${TF_ROOT}
  - terraform init

validate:
  stage: validate
  script:
    - terraform validate
    - terraform fmt -check

plan:
  stage: plan
  script:
    - terraform plan -var-file="prod.tfvars" -out=tfplan
  artifacts:
    paths: [environments/prod/tfplan]
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

apply:
  stage: apply
  script:
    - terraform apply tfplan
  dependencies: [plan]
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
      when: manual

terraform fmt -recursive
terraform validate
terraform plan -var-file="dev.tfvars"
terraform plan -refresh-only        # Check for drift

# Complete workflow
terraform init
terraform plan -var-file="prod.tfvars" -out=prod.tfplan
terraform apply prod.tfplan

# Quick development cycle
terraform fmt && terraform validate && terraform plan

# Emergency destroy
terraform plan -destroy -out=destroy.tfplan
terraform apply destroy.tfplan

# Import and apply
terraform import aws_s3_bucket.example my-bucket-name
terraform plan
terraform apply

# Detect drift without making changes
terraform plan -refresh-only

# Backup state before major operations
cp terraform.tfstate terraform.tfstate.backup.$(date +%Y%m%d_%H%M%S)

# Single line comment
// Also single line comment

/*
Multi-line
comment
*/

# String
variable "name" {
  type    = string
  default = "example"
}

# Number
variable "port" {
  type    = number
  default = 80
}

# Boolean
variable "enabled" {
  type    = bool
  default = true
}

# List
variable "availability_zones" {
  type    = list(string)
  default = ["us-east-1a", "us-east-1b"]
}

# Map
variable "tags" {
  type = map(string)
  default = {
    Environment = "dev"
    Project     = "example"
  }
}

# Object
variable "server" {
  type = object({
    name = string
    port = number
  })
  default = {
    name = "web"
    port = 8080
  }
}

# Tuple (fixed-length, mixed types)
variable "mixed_list" {
  type    = tuple([string, number, bool])
  default = ["hello", 42, true]
}

data "aws_ami" "ubuntu" {
  most_recent = true
  owners      = ["099720109477"]

  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*"]
  }
}

data "aws_availability_zones" "available" {
  state = "available"
}

resource "aws_instance" "example" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t2.micro"
}

locals {
  # Ternary operator
  instance_type = var.environment == "prod" ? "t3.large" : "t2.micro"

  # Conditional list
  security_groups = var.environment == "prod" ? [
    aws_security_group.prod.id
    ] : [
    aws_security_group.dev.id,
    aws_security_group.debug.id
  ]
}

locals {
  # Transform list
  uppercase_names = [for name in var.names : upper(name)]

  # Filter and transform
  prod_instances = [
    for instance in var.instances : instance.name
    if instance.environment == "prod"
  ]

  # Create map from list
  instance_map = {
    for instance in var.instances : instance.id => instance.name
  }

  # Transform map values
  uppercase_tags = {
    for key, value in var.tags : key => upper(value)
  }

  # Filter map
  env_tags = {
    for key, value in var.tags : key => value
    if key != "temporary"
  }

  # Flatten nested structures (common pattern for security group rules)
  security_rules = flatten([
    for group_name, group in var.security_groups : [
      for rule in group.rules : {
        group_name  = group_name
        from_port   = rule.from_port
        to_port     = rule.to_port
        protocol    = rule.protocol
        cidr_blocks = rule.cidr_blocks
      }
    ]
  ])
}

locals {
  servers = [
    { name = "web-1", ip = "10.0.0.1" },
    { name = "web-2", ip = "10.0.0.2" },
  ]
}

output "ips" {
  value = local.servers[*].ip # same as [for s in local.servers : s.ip]
}

output "private_addresses" {
  value = aws_instance.server[*].private_ip # one value per count instance
}

variable "ingress_rules" {
  type = list(object({
    from_port   = number
    to_port     = number
    protocol    = string
    cidr_blocks = list(string)
  }))

  default = [
    {
      from_port   = 80
      to_port     = 80
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    },
    {
      from_port   = 443
      to_port     = 443
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  ]
}

resource "aws_security_group" "example" {
  name = "example"

  dynamic "ingress" {
    for_each = var.ingress_rules
    content {
      from_port   = ingress.value.from_port
      to_port     = ingress.value.to_port
      protocol    = ingress.value.protocol
      cidr_blocks = ingress.value.cidr_blocks
    }
  }
}

  dynamic "ingress" {
    for_each = var.ingress_ports        # list(number)
    iterator = port

    content {
      from_port   = port.value
      to_port     = port.value
      protocol    = "tcp"
      cidr_blocks = ["10.0.0.0/16"]
    }
  }

locals {
  # Interpolation
  message = "Hello, ${var.name}!"

  # Templatefile
  user_data = templatefile("${path.module}/user_data.sh", {
    db_host = var.database_host
    app_env = var.environment
  })
}

provider "aws" {
  region = "us-east-1"
}

provider "aws" {
  alias  = "us_west"
  region = "us-west-2"
}

# Use alias in resource
resource "aws_instance" "west" {
  provider      = aws.us_west
  ami           = "ami-0c55b159cbfafe1d0"
  instance_type = "t2.micro"
}

output "instance_id" {
  description = "ID of the EC2 instance"
  value       = aws_instance.example.id
}

output "instances" {
  description = "Instance details"
  value = {
    for instance in aws_instance.example : instance.id => {
      private_ip = instance.private_ip
      public_ip  = instance.public_ip
    }
  }
}

locals {
  config = {
    dev = {
      instance_type  = "t2.micro"
      instance_count = 1
    }
    staging = {
      instance_type  = "t3.small"
      instance_count = 2
    }
    prod = {
      instance_type  = "t3.large"
      instance_count = 3
    }
  }

  env_config = local.config[var.environment]
}

resource "aws_instance" "web" {
  count         = local.env_config.instance_count
  ami           = data.aws_ami.ubuntu.id
  instance_type = local.env_config.instance_type
}

provider "aws" {
  region  = var.aws_region
  profile = "default"

  assume_role {
    role_arn = "arn:aws:iam::123456789012:role/TerraformRole"
  }

  default_tags {
    tags = {
      Project     = "MyApp"
      Environment = var.environment
      ManagedBy   = "Terraform"
    }
  }
}

provider "kubernetes" {
  config_path = "~/.kube/config"

  # Or use explicit config
  # host                   = var.cluster_endpoint
  # token                  = var.cluster_token
  # cluster_ca_certificate = base64decode(var.cluster_ca_cert)
}

# Local path
source = "./modules/vpc"
source = "../shared-modules/database"

# Terraform Registry
source  = "terraform-aws-modules/vpc/aws"
version = "~> 6.0"

# Git HTTPS
source = "git::https://example.com/vpc.git"
source = "git::https://example.com/network.git?ref=v1.2.0"
source = "git::https://example.com/network.git//modules/vpc?ref=v1.2.0"

# Git SSH
source = "git::ssh://git@github.com/company/terraform-modules.git//database?ref=v1.0.0"

# S3 bucket
source = "s3::https://s3-eu-west-1.amazonaws.com/terraform-modules/vpc.zip"

# HTTP URL
source = "https://example.com/vpc-module.zip"

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 6.0"

  name = "my-vpc"
  cidr = "10.0.0.0/16"

  azs             = ["us-east-1a", "us-east-1b", "us-east-1c"]
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]

  enable_nat_gateway = true

  tags = {
    Terraform   = "true"
    Environment = "dev"
  }
}

resource "aws_instance" "example" {
  ami           = "ami-0c02fb55956c7d316"
  instance_type = "t3.micro"
  subnet_id     = module.vpc.private_subnets[0]
}

modules/web-server/
├── main.tf
├── variables.tf
├── outputs.tf
├── versions.tf
└── README.md

# modules/web-server/main.tf
resource "aws_instance" "web" {
  ami           = var.ami_id
  instance_type = var.instance_type
  subnet_id     = var.subnet_id

  vpc_security_group_ids = var.security_group_ids

  user_data = templatefile("${path.module}/user_data.sh", {
    app_name = var.app_name
  })

  tags = merge(var.tags, {
    Name = "${var.app_name}-web-server"
  })
}

# modules/web-server/variables.tf
variable "app_name" {
  description = "Name of the application"
  type        = string
}

variable "ami_id" {
  description = "AMI ID for the instance"
  type        = string
}

variable "instance_type" {
  description = "EC2 instance type"
  type        = string
  default     = "t3.micro"
}

variable "subnet_id" {
  description = "Subnet ID for the instance"
  type        = string
}

variable "security_group_ids" {
  description = "Security groups for the instance"
  type        = list(string)
  default     = []
}

variable "tags" {
  description = "Tags to apply to resources"
  type        = map(string)
  default     = {}
}

# modules/web-server/outputs.tf
output "instance_id" {
  description = "ID of the EC2 instance"
  value       = aws_instance.web.id
}

output "instance_public_ip" {
  description = "Public IP of the EC2 instance"
  value       = aws_instance.web.public_ip
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 6.0"

  name = var.vpc_name
  cidr = var.vpc_cidr

  azs             = var.availability_zones
  private_subnets = var.private_subnets
  public_subnets  = var.public_subnets

  enable_nat_gateway   = true
  enable_dns_hostnames = true
}

module "web_servers" {
  source = "./modules/web-server"
  count  = var.web_server_count

  app_name      = "${var.app_name}-${count.index}"
  ami_id        = data.aws_ami.ubuntu.id
  subnet_id     = module.vpc.private_subnets[count.index % length(module.vpc.private_subnets)]
  instance_type = var.web_instance_type

  depends_on = [module.vpc]
}

module "internal_vpc" {
  source  = "app.terraform.io/your-org/vpc/aws"
  version = "~> 1.0"

  name = "internal-vpc"
  cidr = "10.0.0.0/16"
}

provider_installation {
  network_mirror {
    url     = "https://terraform-mirror.company.com/"
    include = ["*/*"]
  }

  direct {
    exclude = ["*/*"]
  }
}