Infrastructure as code

terraform {
  required_version = "~> 1.9"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.60"          # allow patches, not surprises
    }
  }

  backend "s3" {                   # shared state, see topic 05
    bucket       = "acme-tfstate"
    key          = "prod/web/terraform.tfstate"
    region       = "ap-south-1"
    use_lockfile = true            # prevents two people applying at once
  }
}

provider "aws" {
  region = var.region
  default_tags {
    tags = {                       # tag everything: this is how you
      Environment = var.environment  # answer "what is this and whose bill?"
      ManagedBy   = "terraform"
      Repo        = "acme/infra"
    }
  }
}

# look up the newest Ubuntu image instead of hard-coding an AMI id
data "aws_ami" "ubuntu" {
  most_recent = true
  owners      = ["099720109477"]
  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*"]
  }
}

resource "aws_security_group" "web" {
  name        = "${var.environment}-web"
  description = "HTTP/HTTPS in, everything out"
  vpc_id      = var.vpc_id

  ingress {
    description = "HTTPS from the internet"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    description = "SSH from the office VPN only"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = [var.admin_cidr]     # never 0.0.0.0/0 (chapter 03)
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_instance" "web" {
  count                  = var.instance_count
  ami                    = data.aws_ami.ubuntu.id
  instance_type          = var.instance_type
  subnet_id              = var.subnet_ids[count.index % length(var.subnet_ids)]
  vpc_security_group_ids = [aws_security_group.web.id]   # ← the dependency

  root_block_device {
    volume_size = 20
    encrypted   = true
  }

  tags = { Name = "${var.environment}-web-${count.index + 1}" }
}

terraform init              # download providers, connect the backend
terraform fmt -recursive    # canonical formatting (put this in CI)
terraform validate          # syntax and type checking

terraform plan -out=tfplan  # the dry run. READ IT. every line.
Plan: 3 to add, 1 to change, 0 to destroy.

terraform apply tfplan      # apply exactly the plan you reviewed

terraform show              # what exists now, per state
terraform output alb_dns    # a value another system needs
terraform destroy           # tear it all down (your wallet's best friend)

terraform state list                          # everything Terraform manages
terraform state show aws_instance.web[0]
terraform import aws_instance.web i-0abc123   # adopt an existing resource
terraform state rm aws_instance.old           # forget it (does NOT delete it)
terraform state mv aws_instance.a aws_instance.b  # after renaming in code
terraform force-unlock LOCK_ID                # only when a lock is genuinely stale

variable "environment" {
  description = "Deployment environment name"
  type        = string
  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "environment must be dev, staging or prod."
  }
}

variable "instance_count" {
  description = "How many web servers"
  type        = number
  default     = 2
}

variable "admin_cidr" {
  description = "CIDR allowed to SSH"
  type        = string
  default     = "10.8.0.0/24"
}

variable "db_password" {
  description = "Database password — supplied from a secret store, never a file"
  type        = string
  sensitive   = true      # keeps it out of plan/apply output
}

output "web_private_ips" {
  value       = aws_instance.web[*].private_ip
  description = "Private IPs of the web servers"
}

# ---- supplying values, in order of precedence ----
# 1. -var on the command line
# 2. -var-file=prod.tfvars
# 3. terraform.tfvars / *.auto.tfvars
# 4. TF_VAR_environment=prod  (how CI usually does it)
# 5. the default in the variable block

infra/
├── modules/
│   ├── network/          # vpc, subnets, routing
│   ├── web-service/      # asg or instances + sg + load balancer
│   └── database/
└── environments/
    ├── staging/
    │   ├── main.tf       # calls the modules with small numbers
    │   └── terraform.tfvars
    └── prod/
        ├── main.tf       # same modules, bigger numbers, own state
        └── terraform.tfvars

module "network" {
  source      = "../../modules/network"
  environment = "prod"
  cidr_block  = "10.0.0.0/16"
}

module "web" {
  source         = "../../modules/web-service"
  environment    = "prod"
  vpc_id         = module.network.vpc_id
  subnet_ids     = module.network.private_subnet_ids
  instance_count = 6            # staging passes 1
  instance_type  = "t3.medium"  # staging passes t3.micro
}

03:14  outage. someone widens a security group in the console. site recovers.
09:00  nobody writes it down.
      now: the code says one thing, reality says another
14:00  a colleague applies an unrelated change…
14:01  …and terraform helpfully "corrects" the drift — the outage returns.

# detection
terraform plan -detailed-exitcode   # exit 2 = drift found (run this nightly in CI)

# the fix, in order
1. reproduce the manual change IN CODE
2. plan → confirm it now proposes no changes
3. commit it, with the incident number in the message

- name: Configure web servers
  hosts: web
  become: true                    # use sudo

  vars:
    app_port: 3000

  tasks:
    - name: Install packages
      ansible.builtin.apt:
        name: [nginx, curl, jq]
        state: present            # "present", not "install" — declarative
        update_cache: true

    - name: Deploy nginx site config
      ansible.builtin.template:
        src: templates/site.conf.j2
        dest: /etc/nginx/sites-available/app.conf
        mode: "0644"
      notify: reload nginx        # only reloads IF this task changed something

    - name: Ensure nginx is running and enabled
      ansible.builtin.service:
        name: nginx
        state: started
        enabled: true

  handlers:
    - name: reload nginx
      ansible.builtin.service:
        name: nginx
        state: reloaded

ansible-inventory --list
ansible all -m ping                        # can I reach every host?
ansible-playbook playbook.yml --check --diff # dry run, show the diffs
ansible-playbook playbook.yml --limit web-01 # one host first, always
ansible-playbook playbook.yml
PLAY RECAP: web-01 : ok=6 changed=2 failed=0          # ← run again: changed=0

on:
  pull_request:
    paths: ['infra/**']
  push:
    branches: [main]
    paths: ['infra/**']

jobs:
  plan:
    runs-on: ubuntu-latest
    permissions:
      id-token: write        # OIDC → short-lived cloud creds, no static keys
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
      - run: terraform fmt -check -recursive
      - run: terraform init
      - run: terraform validate
      - run: terraform plan -no-color -out=tfplan
      - run: tfsec . || true             # security scan (chapter 11)
      # post the plan as a PR comment so a human reviews the diff

  apply:
    needs: plan
    if: github.ref == 'refs/heads/main'
    environment: production              # requires a manual approval
    runs-on: ubuntu-latest
    steps: [ ... terraform apply ... ]