Terraform

You can describe infrastructure as code and run a plan without destroying anything.

1. 1Why infrastructure as codeYou can apply this in a live incident: IaC makes infrastructure reviewable, repeatable and diffable.12m30xp
2. 2Plan then applyYou can apply this in a live incident: Plan is a dry run; apply is the write.12m30xp
3. 3Providers and resourcesYou can apply this in a live incident: A provider is the plugin that talks to an API.12m30xp
4. 4HCL blocks and argumentsYou can apply this in a live incident: resource, data, variable, output, module and provider are the core blocks.12m30xp
5. 5Variables and outputsYou can apply this in a live incident: Variables are inputs; outputs are exports.12m30xp
6. 6What state is forYou can apply this in a live incident: State maps resource addresses to real IDs.12m30xp
7. 7Refresh and driftYou can apply this in a live incident: Refresh re-reads live resources into state.12m30xp
8. 8Importing existing resourcesYou can apply this in a live incident: terraform import binds a real ID to a resource address.12m30xp
9. 9Modules as interfacesYou can apply this in a live incident: A module is a reusable configuration with a typed interface.12m30xp
10. 10Lifecycle meta-argumentsYou can apply this in a live incident: create_before_destroy changes replacement order.12m30xp

You can work with remote state, workspaces and count/for_each without corrupting the map.

1. 1Remote backends and lockingYou can apply this in a live incident: A remote backend stores state off the laptop.12m30xp
2. 2WorkspacesYou can apply this in a live incident: A workspace is a separate state under the same configuration.12m30xp
3. 3count versus for_eachYou can apply this in a live incident: count addresses resources by index, which is brittle when the list changes.12m30xp
4. 4Depends_on and the graphYou can apply this in a live incident: Terraform builds a graph from references.12m30xp
5. 5Secrets in TerraformYou can apply this in a live incident: Plain values in config and state are readable.12m30xp

You can run the CLI so init, fmt, validate and lockfiles match what CI will run.

1. 1terraform init and -upgradeYou can apply this in a live incident: init downloads providers and modules and writes the lock file.12m30xp
2. 2fmt and validateYou can apply this in a live incident: fmt rewrites HCL to canonical style.12m30xp
3. 3.terraform.lock.hclYou can apply this in a live incident: The lock file records provider version and package hashes per platform.12m30xp
4. 4Version constraintsYou can apply this in a live incident: required_providers version is a constraint, not a pin by itself.12m30xp
5. 5Registry modules and providersYou can apply this in a live incident: The public registry is registry.terraform.io.12m30xp
6. 6terraform consoleYou can apply this in a live incident: console evaluates expressions in the context of the configuration and state.12m30xp
7. 7terraform outputYou can apply this in a live incident: terraform output prints output values from state.12m30xp
8. 8terraform login and HCP TerraformYou can apply this in a live incident: terraform login stores a token for HCP Terraform or Terraform Enterprise.12m30xp
9. 9fmt -check in pipelinesYou can apply this in a live incident: fmt -check is the CI gate; fmt is the local fix.12m30xp
10. 10destroy and refresh-onlyYou can apply this in a live incident: destroy plans the removal of every resource in the current state.12m30xp

You can write HCL that expresses intent without hidden graphs.

1. 1Data sourcesYou can apply this in a live incident: A data source reads existing objects; it does not create them.12m30xp
2. 2locals, tfvars and var filesYou can apply this in a live incident: locals are named expressions inside a module.12m30xp
3. 3Dynamic blocksYou can apply this in a live incident: dynamic generates nested blocks from a collection.12m30xp
4. 4Splat and for expressionsYou can apply this in a live incident: A splat is a shorthand for a list of attributes from a list of objects.12m30xp
5. 5moved blocksYou can apply this in a live incident: moved records an address rename in configuration.12m30xp
6. 6Import blocksYou can apply this in a live incident: An import block declares intent to bind an ID to an address on the next apply.12m30xp
7. 7Check blocksYou can apply this in a live incident: check blocks assert conditions against data after apply.12m30xp
8. 8terraform testYou can apply this in a live incident: terraform test runs .tftest.hcl files against a module.12m30xp
9. 9Provider aliasesYou can apply this in a live incident: A provider alias is a named configuration of the same provider.12m30xp
10. 10Provisioners and why notYou can apply this in a live incident: Provisioners run scripts on create (or destroy) and are a last resort.12m30xp

You can move, list and replace state without guessing IDs.

1. 1state list and showYou can apply this in a live incident: state list prints resource addresses in the current state.12m30xp
2. 2state mv and rmYou can apply this in a live incident: state mv relocates an object to a new address.12m30xp
3. 3state pull and pushYou can apply this in a live incident: state pull writes the current remote state to stdout.12m30xp
4. 4terraform graphYou can apply this in a live incident: terraform graph emits DOT of the dependency graph.12m30xp
5. 5replace and targetYou can apply this in a live incident: -replace forces replacement of an object even if the diff looks in-place.12m30xp
6. 6ParallelismYou can apply this in a live incident: -parallelism caps concurrent operations.12m30xp
7. 7terraform_remote_stateYou can apply this in a live incident: terraform_remote_state is a data source that reads another state's outputs.12m30xp
8. 8Sensitive valuesYou can apply this in a live incident: sensitive hides values in CLI and UI by default.12m30xp
9. 9CLI workspaces versus directoriesYou can apply this in a live incident: CLI workspaces are multiple states for one configuration directory.12m30xp
10. 10Policy as code at a high levelYou can apply this in a live incident: Policy as code evaluates plan data against rules before apply.12m30xp

You can tell a laptop apply from a remote run without mixing credentials.

1. 1HCP Terraform remote runsYou can apply this in a live incident: Execution mode can be remote, local or agent.12m30xp
2. 2Workspace variables versus filesYou can apply this in a live incident: HCP workspace variables are injected into remote runs.12m30xp
3. 3Run tasks and VCS workflowsYou can apply this in a live incident: VCS-driven workspaces plan on pull request and apply on merge when configured.12m30xp
4. 4State versions in HCPYou can apply this in a live incident: HCP keeps state versions.12m30xp
5. 5CLI-driven remote runsYou can apply this in a live incident: CLI-driven runs can execute remotely while you watch from the terminal.12m30xp

You can publish a module other roots can call without reading its internals.

1. 1Module source stringsYou can apply this in a live incident: A module source is a path, a registry address or a git URL.12m30xp
2. 2Variable validationYou can apply this in a live incident: validation blocks on a variable catch bad inputs at plan.12m30xp