IBM Terraform Authoring and Operations

State problems are solved at the keyboard. You inspect and edit state, import resources that exist outside Terraform, and reconcile drift in either direction, working on AWS or Azure.

• Inspecting state with list and show
• Moving, renaming and removing state entries
• Importing with import blocks
• Writing configuration that matches imported resources
• Reconciling drift: update the code or the world
• Backing up and restoring state

You build A repaired environment: unmanaged resources imported and drift resolved.

Most failures show up as a message you have to decode. You validate and format code, read errors from Terraform and from provider APIs, turn on logging at the right level, and write conditions and tests that catch faults early.

• validate, fmt and what each one catches
• Reading Terraform error messages
• Provider and API errors on AWS and Azure
• Logging levels and capturing logs to a file
• Variable validation and custom conditions
• Testing a configuration with terraform test
• Using terraform console to inspect values

You build A broken configuration diagnosed and fixed, with the cause of each fault written down.

Real configurations depend on things they do not own. You read existing infrastructure with data sources, pass values between configurations, and decide when to look up a value and when to take it as an input.

• Data sources for existing cloud objects
• Filtering data source results precisely
• Reading another configuration’s outputs
• Lookup against input: choosing between them
• Timing: when data is read during plan and apply
• Handling data sources that return nothing

You build A configuration that builds on an existing network it does not own.

Dynamic configuration keeps code short as environments grow. You use count, for_each, depends_on and lifecycle correctly, call functions that shape data, and generate nested blocks without losing readability.

• count and for_each: choosing between them
• depends_on and hidden dependencies
• Lifecycle rules in practice
• Collection and string functions that matter
• File and template functions
• Dynamic blocks and when to avoid them
• Debugging an unexpected plan

You build A dynamic configuration that generates rules and instances from one variable.

Real inputs are structured, and some of them are secret. You model them with object types and optional attributes, validate them, and fetch secrets from Vault so they are not written into code or leaked through state.

• Object and collection types with optional attributes
• Validation across several fields
• Sensitive variables and outputs
• Reading secrets from Vault in configuration
• Dynamic secrets against static secrets
• Keeping secrets out of logs and state

You build A configuration with a structured, validated input and secrets read from Vault.

Modules turn working code into shared code. You build them from existing configuration, version and consume them, and refactor a flat configuration into modules without destroying anything that already exists.

• Extracting a module from existing configuration
• Designing inputs and outputs
• Versioning and consuming modules
• moved blocks for safe refactoring
• Modules with count and for_each
• Provider configuration inside and outside modules
• Testing a module

You build A flat configuration refactored into modules with no resources recreated.

Providers are where most operational problems hide. You learn how Terraform loads plugins, configure aliases and versions, authenticate to AWS or Azure in several ways, and work through the errors providers produce.

• The plugin architecture and the provider protocol
• Aliases for multiple regions and subscriptions
• Version constraints, the lock file and upgrades
• Authentication: environment, profiles and identities
• Diagnosing authentication and permission failures
• Handling provider bugs and deprecated arguments

You build A two-region or two-subscription configuration with documented authentication.

Two people applying the same configuration is where teams get hurt. You constrain versions, put state in a locked remote backend, share outputs between workspaces, and run Terraform from automation without surprises.

• Pinning Terraform and provider versions
• Remote state with locking on AWS or Azure
• Sharing outputs across workspaces
• Running Terraform non-interactively
• Avoiding conflicting applies
• Reviewing changes before they run

You build A two-configuration setup sharing outputs through locked remote state.

HCP Terraform adds a shared run workflow, access control and governance. You follow a run from plan to apply, configure workspaces and permissions, supply provider credentials safely, and enforce rules with policy as code.

• The run workflow and its stages
• Workspaces, teams and access
• Provider credentials in workspaces
• Variable sets and sensitive variables
• Policy as code with Sentinel or OPA
• Governance, auditing and cost controls

You build A governed workspace with credentials, permissions and a policy check.

You inherit infrastructure with drift, hard-coded values, no modules and local state. Using everything above, you stabilize it, bring it under shared state, refactor it and hand it to a team workspace, one verified step at a time.

• Auditing an inherited configuration
• Stabilizing state before changing anything
• Importing what is missing
• Refactoring into modules
• Moving to a team workspace with policy
• Documenting the handover

You build An inherited estate repaired, modularized and moved to a governed workspace.