Terraform.txt

# TERRAFORM - Infrastructure as Code Reference - by Richard Rembert

# Terraform is an open-source Infrastructure as Code (IaC) tool for building, changing, and versioning infrastructure
# Supports multiple cloud providers (AWS, Azure, GCP, etc.) and services through providers

# INSTALLATION AND SETUP

# Install Terraform (Ubuntu/Debian)
curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo apt-key add -
sudo apt-add-repository "deb [arch=amd64] https://apt.releases.hashicorp.com $(lsb_release -cs) main"
sudo apt-get update && sudo apt-get install terraform

# Install Terraform (macOS)
brew tap hashicorp/tap
brew install hashicorp/tap/terraform
# or
brew install terraform

# Install Terraform (Windows)
# Download from https://www.terraform.io/downloads
# Or use Chocolatey: choco install terraform
# Or use Scoop: scoop install terraform

# Install specific version with tfenv (version manager)
git clone https://github.com/tfutils/tfenv.git ~/.tfenv
echo 'export PATH="$HOME/.tfenv/bin:$PATH"' >> ~/.bashrc
tfenv install 1.6.0
tfenv use 1.6.0

# Verify installation
terraform --version
terraform -help

# Enable tab completion
terraform -install-autocomplete

# Set up environment
export TF_LOG=INFO                    # Enable logging (TRACE, DEBUG, INFO, WARN, ERROR)
export TF_LOG_PATH="./terraform.log"  # Log to file
export TF_DATA_DIR=".terraform"       # Terraform working directory
export TF_PLUGIN_CACHE_DIR="$HOME/.terraform.d/plugin-cache"  # Plugin cache

# Create plugin cache directory
mkdir -p $HOME/.terraform.d/plugin-cache


# TERRAFORM BASICS AND CONCEPTS

# Core Concepts:
# - Provider: Plugin that manages resources for a specific service (AWS, Azure, etc.)
# - Resource: Infrastructure component (EC2 instance, S3 bucket, etc.)
# - Data Source: Read-only information from existing infrastructure
# - Variable: Input parameters for configurations
# - Output: Return values from configurations
# - Module: Reusable Terraform configurations
# - State: Mapping between configuration and real-world resources

# File Structure:
# main.tf        - Primary configuration
# variables.tf   - Variable definitions
# outputs.tf     - Output definitions
# terraform.tfvars - Variable values
# versions.tf    - Provider version constraints
# locals.tf      - Local values


# BASIC TERRAFORM WORKFLOW

# 1. Initialize Terraform (downloads providers, sets up backend)
terraform init                    # Initialize current directory
terraform init -upgrade           # Upgrade providers to latest allowed version
terraform init -reconfigure       # Reconfigure backend
terraform init -migrate-state     # Migrate state to new backend

# 2. Planning (preview changes)
terraform plan                    # Show planned changes
terraform plan -out=tfplan        # Save plan to file
terraform plan -target=aws_instance.web  # Plan specific resource
terraform plan -var="environment=production"  # Override variable
terraform plan -var-file="prod.tfvars"       # Use variable file
terraform plan -destroy           # Plan destruction

# 3. Applying changes
terraform apply                    # Apply changes (with confirmation)
terraform apply -auto-approve     # Apply without confirmation
terraform apply tfplan            # Apply saved plan
terraform apply -target=aws_instance.web     # Apply specific resource
terraform apply -var="instance_type=t3.small"  # Override variable

# 4. Destroying infrastructure
terraform destroy                 # Destroy all resources (with confirmation)
terraform destroy -auto-approve   # Destroy without confirmation
terraform destroy -target=aws_instance.web   # Destroy specific resource

# Validation and formatting
terraform validate                # Validate configuration syntax
terraform fmt                     # Format configuration files
terraform fmt -check              # Check if files are formatted
terraform fmt -recursive          # Format files recursively


# BASIC TERRAFORM CONFIGURATION

# Basic main.tf example
terraform {
  required_version = ">= 1.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.1"
    }
  }
}

# Provider configuration
provider "aws" {
  region = var.aws_region
  
  default_tags {
    tags = {
      Environment = var.environment
      Project     = var.project_name
      ManagedBy   = "Terraform"
    }
  }
}

# Simple resource example
resource "aws_instance" "web" {
  ami           = "ami-0c02fb55956c7d316"  # Amazon Linux 2
  instance_type = "t3.micro"
  
  tags = {
    Name = "web-server"
  }
}

# Data sources
data "aws_availability_zones" "available" {
  state = "available"
}

data "aws_ami" "ubuntu" {
  most_recent = true
  owners      = ["099720109477"] # Canonical
  
  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-22.04-amd64-server-*"]
  }
}


# VARIABLES AND OUTPUTS

# variables.tf - Input variables
variable "aws_region" {
  description = "AWS region for resources"
  type        = string
  default     = "us-west-2"
  
  validation {
    condition     = can(regex("^[a-z]{2}-[a-z]+-[0-9]+$", var.aws_region))
    error_message = "The aws_region value must be a valid AWS region format."
  }
}

variable "environment" {
  description = "Environment name"
  type        = string
  default     = "development"
  
  validation {
    condition = contains([
      "development",
      "staging", 
      "production"
    ], var.environment)
    error_message = "Environment must be development, staging, or production."
  }
}

variable "project_name" {
  description = "Name of the project"
  type        = string
  default     = "myapp"
}

variable "instance_type" {
  description = "EC2 instance type"
  type        = string
  default     = "t3.micro"
}

variable "allowed_cidr_blocks" {
  description = "CIDR blocks allowed to access resources"
  type        = list(string)
  default     = ["0.0.0.0/0"]
}

variable "enable_monitoring" {
  description = "Whether to enable monitoring"
  type        = bool
  default     = true
}

variable "database_config" {
  description = "Database configuration"
  type = object({
    engine         = string
    engine_version = string
    instance_class = string
    allocated_storage = number
  })
  default = {
    engine         = "postgres"
    engine_version = "15.4"
    instance_class = "db.t3.micro"
    allocated_storage = 20
  }
}

variable "tags" {
  description = "Additional tags to apply to resources"
  type        = map(string)
  default     = {}
}

# Sensitive variables
variable "db_password" {
  description = "Database password"
  type        = string
  sensitive   = true
  default     = ""
}

# outputs.tf - Return values
output "instance_id" {
  description = "ID of the EC2 instance"
  value       = aws_instance.web.id
}

output "instance_public_ip" {
  description = "Public IP address of the instance"
  value       = aws_instance.web.public_ip
}

output "availability_zones" {
  description = "Available availability zones"
  value       = data.aws_availability_zones.available.names
}

# Complex outputs
output "instance_details" {
  description = "Detailed instance information"
  value = {
    id               = aws_instance.web.id
    public_ip        = aws_instance.web.public_ip
    private_ip       = aws_instance.web.private_ip
    availability_zone = aws_instance.web.availability_zone
    instance_type    = aws_instance.web.instance_type
  }
}

# Using variables
resource "aws_instance" "web_with_vars" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = var.instance_type
  
  tags = merge(var.tags, {
    Name        = "${var.project_name}-web"
    Environment = var.environment
  })
}


# LOCAL VALUES

# locals.tf - Computed values
locals {
  # Common tags used across resources
  common_tags = {
    Environment = var.environment
    Project     = var.project_name
    Owner       = "DevOps Team"
    ManagedBy   = "Terraform"
    CreatedAt   = formatdate("YYYY-MM-DD", timestamp())
  }
  
  # Environment-specific configuration
  environment_config = {
    development = {
      instance_type = "t3.micro"
      min_size     = 1
      max_size     = 2
    }
    staging = {
      instance_type = "t3.small"
      min_size     = 1
      max_size     = 3
    }
    production = {
      instance_type = "t3.medium"
      min_size     = 2
      max_size     = 10
    }
  }
  
  current_config = local.environment_config[var.environment]
  
  # Computed values
  name_prefix = "${var.project_name}-${var.environment}"
  vpc_cidr    = "10.0.0.0/16"
  
  availability_zones = slice(data.aws_availability_zones.available.names, 0, 3)
  
  public_subnet_cidrs = [
    "10.0.1.0/24",
    "10.0.2.0/24",
    "10.0.3.0/24"
  ]
}

# Using locals in resources
resource "aws_instance" "web_with_locals" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = local.current_config.instance_type
  
  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-web"
  })
}


# RESOURCE CONFIGURATION

# Basic resource syntax
resource "resource_type" "resource_name" {
  argument1 = "value1"
  argument2 = "value2"
  
  # Nested block
  block_name {
    nested_argument = "value"
  }
  
  # Multiple blocks of same type
  block_name {
    nested_argument = "another_value"
  }
}

# VPC and Networking Resources
resource "aws_vpc" "main" {
  cidr_block           = local.vpc_cidr
  enable_dns_hostnames = true
  enable_dns_support   = true
  
  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-vpc"
  })
}

resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id
  
  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-igw"
  })
}

# Public subnets using count
resource "aws_subnet" "public" {
  count = length(local.public_subnet_cidrs)
  
  vpc_id                  = aws_vpc.main.id
  cidr_block              = local.public_subnet_cidrs[count.index]
  availability_zone       = local.availability_zones[count.index]
  map_public_ip_on_launch = true
  
  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-public-${count.index + 1}"
    Type = "Public"
  })
}

# Route table
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id
  
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }
  
  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-public-rt"
  })
}

# Route table associations
resource "aws_route_table_association" "public" {
  count = length(aws_subnet.public)
  
  subnet_id      = aws_subnet.public[count.index].id
  route_table_id = aws_route_table.public.id
}

# Security Groups
resource "aws_security_group" "web" {
  name        = "${local.name_prefix}-web-sg"
  description = "Security group for web servers"
  vpc_id      = aws_vpc.main.id
  
  # HTTP
  ingress {
    description = "HTTP"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = var.allowed_cidr_blocks
  }
  
  # HTTPS
  ingress {
    description = "HTTPS"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = var.allowed_cidr_blocks
  }
  
  # SSH
  ingress {
    description = "SSH"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = var.allowed_cidr_blocks
  }
  
  # All outbound traffic
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
  
  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-web-sg"
  })
}

# EC2 Instances
resource "aws_instance" "web" {
  count = var.environment == "production" ? 3 : 1
  
  ami                    = data.aws_ami.ubuntu.id
  instance_type          = local.current_config.instance_type
  vpc_security_group_ids = [aws_security_group.web.id]
  subnet_id             = aws_subnet.public[count.index % length(aws_subnet.public)].id
  
  user_data = base64encode(<<-EOF
    #!/bin/bash
    apt-get update
    apt-get install -y nginx
    systemctl start nginx
    systemctl enable nginx
    echo "<h1>Web Server ${count.index + 1}</h1>" > /var/www/html/index.html
  EOF
  )
  
  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-web-${count.index + 1}"
    Type = "WebServer"
  })
}


# TERRAFORM FUNCTIONS AND EXPRESSIONS

# String functions
locals {
  # String manipulation
  project_upper     = upper(var.project_name)
  project_title     = title(var.project_name)
  project_snake     = replace(var.project_name, "-", "_")
  
  # String formatting
  resource_name     = format("%s-%s-resource", var.project_name, var.environment)
  padded_name       = format("%04s", var.project_name)
  
  # String interpolation
  description       = "Project: ${var.project_name}, Environment: ${var.environment}"
  
  # String conditionals
  environment_short = var.environment == "production" ? "prod" : var.environment == "staging" ? "stg" : "dev"
}

# Collection functions
locals {
  # List operations
  availability_zones_selected = slice(data.aws_availability_zones.available.names, 0, 3)
  subnet_count                = length(local.public_subnet_cidrs)
  first_az                    = element(data.aws_availability_zones.available.names, 0)
  
  # Map operations
  current_config = local.environment_config[var.environment]
  
  # Set operations
  unique_azs = toset(data.aws_availability_zones.available.names)
}

# Conditional expressions
locals {
  # Ternary operator
  instance_count = var.environment == "production" ? 3 : 1
  storage_size   = var.environment == "production" ? 100 : 20
  
  # Multiple conditions
  backup_retention = (
    var.environment == "production" ? 30 :
    var.environment == "staging" ? 7 :
    1
  )
  
  # Complex conditionals
  monitoring_enabled = var.environment == "production" || var.environment == "staging"
}

# For expressions
locals {
  # Transform list to map
  subnet_map = {
    for idx, subnet in aws_subnet.public :
    subnet.availability_zone => subnet.id
  }
  
  # Filter and transform
  large_configs = {
    for name, config in local.environment_config :
    name => config
    if config.max_size > 5
  }
}


# DYNAMIC BLOCKS

# Dynamic ingress rules
variable "ingress_rules" {
  description = "List of ingress rules"
  type = list(object({
    description = string
    from_port   = number
    to_port     = number
    protocol    = string
    cidr_blocks = list(string)
  }))
  default = [
    {
      description = "HTTP"
      from_port   = 80
      to_port     = 80
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    },
    {
      description = "HTTPS"
      from_port   = 443
      to_port     = 443
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  ]
}

resource "aws_security_group" "dynamic_example" {
  name_prefix = "${local.name_prefix}-dynamic-"
  vpc_id      = aws_vpc.main.id
  
  # Dynamic ingress rules
  dynamic "ingress" {
    for_each = var.ingress_rules
    content {
      description = ingress.value.description
      from_port   = ingress.value.from_port
      to_port     = ingress.value.to_port
      protocol    = ingress.value.protocol
      cidr_blocks = ingress.value.cidr_blocks
    }
  }
  
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
  
  tags = local.common_tags
}


# STATE MANAGEMENT

# State commands
terraform state list              # List resources in state
terraform state show aws_instance.web        # Show specific resource
terraform state pull              # Download state file
terraform state push terraform.tfstate       # Upload state file
terraform state mv aws_instance.web aws_instance.web_server  # Rename resource
terraform state rm aws_instance.web          # Remove resource from state

# Import existing resources
terraform import aws_instance.web i-1234567890abcdef0

# Refresh state
terraform refresh                 # Update state with real infrastructure

# Backend configuration for remote state
terraform {
  backend "s3" {
    bucket = "my-terraform-state"
    key    = "infrastructure/terraform.tfstate"
    region = "us-west-2"
    
    # State locking
    dynamodb_table = "terraform-locks"
    encrypt        = true
  }
}

# Using remote state
data "terraform_remote_state" "network" {
  backend = "s3"
  
  config = {
    bucket = "my-terraform-state"
    key    = "network/terraform.tfstate"
    region = "us-west-2"
  }
}

# Reference remote state outputs
resource "aws_instance" "app" {
  ami       = data.aws_ami.ubuntu.id
  subnet_id = data.terraform_remote_state.network.outputs.public_subnet_ids[0]
}


# MODULES

# Module definition directory structure:
# modules/
# └── vpc/
#     ├── main.tf
#     ├── variables.tf
#     ├── outputs.tf
#     └── README.md

# Module usage
module "vpc" {
  source = "./modules/vpc"
  
  # Required variables
  project_name = var.project_name
  environment  = var.environment
  
  # VPC configuration
  vpc_cidr            = "10.0.0.0/16"
  availability_zones  = slice(data.aws_availability_zones.available.names, 0, 3)
  public_subnet_cidrs = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  
  # Tags
  tags = local.common_tags
}

# Use module outputs
resource "aws_instance" "app" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = var.instance_type
  subnet_id     = module.vpc.public_subnet_ids[0]
  
  vpc_security_group_ids = [module.vpc.web_security_group_id]
  
  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-app"
  })
}

# Module with for_each
module "environments" {
  source = "./modules/environment"
  
  for_each = toset(["development", "staging", "production"])
  
  environment     = each.key
  project_name    = var.project_name
  instance_type   = local.environment_config[each.key].instance_type
  
  tags = {
    Environment = each.key
    Project     = var.project_name
  }
}

# Remote module from Terraform Registry
module "s3_bucket" {
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.0"
  
  bucket = "${var.project_name}-${var.environment}-storage"
  
  versioning = {
    enabled = true
  }
  
  server_side_encryption_configuration = {
    rule = {
      apply_server_side_encryption_by_default = {
        sse_algorithm = "AES256"
      }
    }
  }
  
  tags = local.common_tags
}


# WORKSPACES

# Workspace commands
terraform workspace list          # List workspaces
terraform workspace new prod      # Create new workspace
terraform workspace select prod   # Switch to workspace
terraform workspace delete dev    # Delete workspace
terraform workspace show         # Show current workspace

# Workspace-specific configuration
locals {
  workspace_config = {
    development = {
      instance_type = "t3.micro"
      min_size     = 1
      max_size     = 2
    }
    staging = {
      instance_type = "t3.small"
      min_size     = 1
      max_size     = 3
    }
    production = {
      instance_type = "t3.medium"
      min_size     = 2
      max_size     = 10
    }
  }
  
  current_workspace_config = local.workspace_config[terraform.workspace]
  
  # Workspace-specific naming
  resource_prefix = "${var.project_name}-${terraform.workspace}"
}

# Use workspace configuration
resource "aws_instance" "workspace_example" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = local.current_workspace_config.instance_type
  
  tags = {
    Name      = "${local.resource_prefix}-example"
    Workspace = terraform.workspace
  }
}


# DATA SOURCES

# AWS data sources
data "aws_caller_identity" "current" {}

data "aws_region" "current" {}

data "aws_availability_zones" "available" {
  state = "available"
  
  filter {
    name   = "zone-type"
    values = ["availability-zone"]
  }
}

data "aws_ami" "amazon_linux" {
  most_recent = true
  owners      = ["amazon"]
  
  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }
  
  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }
}

data "aws_vpc" "existing" {
  count = var.use_existing_vpc ? 1 : 0
  
  filter {
    name   = "tag:Name"
    values = ["${var.project_name}-vpc"]
  }
}

data "aws_route53_zone" "domain" {
  count = var.domain_name != "" ? 1 : 0
  
  name         = var.domain_name
  private_zone = false
}

# External data source
data "external" "git_info" {
  program = ["bash", "${path.module}/scripts/get_git_info.sh"]
}

# HTTP data source
data "http" "myip" {
  url = "https://ipv4.icanhazip.com"
}

# Template file
data "template_file" "user_data" {
  template = file("${path.module}/templates/user_data.tpl")
  
  vars = {
    project_name = var.project_name
    environment  = var.environment
    region       = data.aws_region.current.name
  }
}


# PROVISIONERS

# File provisioner
resource "aws_instance" "bastion" {
  count = var.create_bastion ? 1 : 0
  
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t3.micro"
  key_name      = var.key_pair_name
  subnet_id     = aws_subnet.public[0].id
  
  vpc_security_group_ids = [aws_security_group.web.id]
  
  # File provisioner
  provisioner "file" {
    source      = "${path.module}/scripts/setup.sh"
    destination = "/tmp/setup.sh"
    
    connection {
      type        = "ssh"
      user        = "ubuntu"
      private_key = file(var.ssh_private_key_path)
      host        = self.public_ip
    }
  }
  
  # Remote-exec provisioner
  provisioner "remote-exec" {
    inline = [
      "chmod +x /tmp/setup.sh",
      "sudo /tmp/setup.sh"
    ]
    
    connection {
      type        = "ssh"
      user        = "ubuntu"
      private_key = file(var.ssh_private_key_path)
      host        = self.public_ip
    }
  }
  
  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-bastion"
  })
}

# Local-exec provisioner
resource "null_resource" "local_command" {
  triggers = {
    instance_id = aws_instance.web[0].id
  }
  
  provisioner "local-exec" {
    command = "echo 'Instance ${aws_instance.web[0].id} created'"
  }
}


# RESOURCE LIFECYCLE

resource "aws_instance" "lifecycle_example" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = var.instance_type
  
  lifecycle {
    # Prevent destruction
    prevent_destroy = var.environment == "production"
    
    # Create before destroy
    create_before_destroy = true
    
    # Ignore changes to specific attributes
    ignore_changes = [
      ami,
      user_data
    ]
  }
  
  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-lifecycle-example"
  })
}


# VALIDATION AND TESTING

# Input validation
variable "validated_email" {
  description = "Email address with validation"
  type        = string
  
  validation {
    condition     = can(regex("^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$", var.validated_email))
    error_message = "Please provide a valid email address."
  }
}

# Precondition and postcondition checks
resource "aws_instance" "validated" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = var.instance_type
  
  lifecycle {
    # Precondition
    precondition {
      condition     = data.aws_ami.ubuntu.architecture == "x86_64"
      error_message = "The selected AMI must be for the x86_64 architecture."
    }
    
    # Postcondition
    postcondition {
      condition     = self.public_dns != ""
      error_message = "Instance must have a public DNS name."
    }
  }
  
  tags = {
    Name = "validated-instance"
  }
}


# ERROR HANDLING

# Try function for safe operations
locals {
  # Safe navigation
  instance_type_safe = try(var.custom_config.instance_type, var.instance_type)
  
  # Error handling with can()
  is_valid_cidr = can(cidrhost(var.vpc_cidr, 0))
  
  # Conditional with error handling
  subnet_count = try(length(var.subnet_cidrs), 3)
}

# Resource with error handling
resource "aws_instance" "error_handling" {
  count = var.create_instances ? try(length(var.instance_configs), 0) : 0
  
  ami           = try(var.instance_configs[count.index].ami, data.aws_ami.ubuntu.id)
  instance_type = try(var.instance_configs[count.index].instance_type, var.instance_type)
  
  tags = merge(local.common_tags, {
    Name = "error-handling-${count.index + 1}"
  })
}


# ADVANCED RESOURCE EXAMPLES

# Complete Database Setup
resource "aws_db_subnet_group" "main" {
  name       = "${local.name_prefix}-db-subnet-group"
  subnet_ids = aws_subnet.private[*].id
  
  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-db-subnet-group"
  })
}

resource "aws_security_group" "database" {
  name        = "${local.name_prefix}-db-sg"
  description = "Security group for database"
  vpc_id      = aws_vpc.main.id
  
  ingress {
    description     = "PostgreSQL"
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    security_groups = [aws_security_group.web.id]
  }
  
  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-db-sg"
  })
}

resource "aws_db_instance" "main" {
  identifier = "${local.name_prefix}-db"
  
  engine         = var.database_config.engine
  engine_version = var.database_config.engine_version
  instance_class = var.database_config.instance_class
  
  allocated_storage = var.database_config.allocated_storage
  storage_encrypted = true
  
  db_name  = replace(var.project_name, "-", "_")
  username = "dbadmin"
  password = var.db_password != "" ? var.db_password : random_password.db_password.result
  
  db_subnet_group_name   = aws_db_subnet_group.main.name
  vpc_security_group_ids = [aws_security_group.database.id]
  publicly_accessible    = false
  
  backup_retention_period = var.environment == "production" ? 30 : 7
  backup_window          = "03:00-04:00"
  maintenance_window     = "sun:04:00-sun:05:00"
  
  deletion_protection = var.environment == "production"
  skip_final_snapshot = var.environment != "production"
  
  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-database"
  })
  
  lifecycle {
    ignore_changes = [password]
  }
}

# Random password for database
resource "random_password" "db_password" {
  length  = 16
  special = true
}

# S3 Bucket with versioning and encryption
resource "aws_s3_bucket" "storage" {
  bucket        = "${local.name_prefix}-storage-${random_string.bucket_suffix.result}"
  force_destroy = var.environment != "production"
  
  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-storage"
  })
}

resource "aws_s3_bucket_versioning" "storage" {
  bucket = aws_s3_bucket.storage.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_encryption" "storage" {
  bucket = aws_s3_bucket.storage.id
  
  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = "AES256"
      }
    }
  }
}

resource "random_string" "bucket_suffix" {
  length  = 8
  special = false
  upper   = false
}

# Load Balancer
resource "aws_lb" "main" {
  name               = "${local.name_prefix}-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.web.id]
  subnets            = aws_subnet.public[*].id
  
  enable_deletion_protection = var.environment == "production"
  
  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-alb"
  })
}

resource "aws_lb_target_group" "web" {
  name     = "${local.name_prefix}-web-tg"
  port     = 80
  protocol = "HTTP"
  vpc_id   = aws_vpc.main.id
  
  health_check {
    enabled             = true
    healthy_threshold   = 2
    interval            = 30
    matcher             = "200"
    path                = "/"
    port                = "traffic-port"
    protocol            = "HTTP"
    timeout             = 5
    unhealthy_threshold = 2
  }
  
  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-web-tg"
  })
}

resource "aws_lb_listener" "web" {
  load_balancer_arn = aws_lb.main.arn
  port              = "80"
  protocol          = "HTTP"
  
  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.web.arn
  }
}

resource "aws_lb_target_group_attachment" "web" {
  count = length(aws_instance.web)
  
  target_group_arn = aws_lb_target_group.web.arn
  target_id        = aws_instance.web[count.index].id
  port             = 80
}


# MULTI-PROVIDER CONFIGURATION

# Provider aliases for multi-region
provider "aws" {
  alias  = "us_east"
  region = "us-east-1"
}

provider "aws" {
  alias  = "us_west"
  region = "us-west-2"
}

# Resources in different regions
resource "aws_s3_bucket" "east_backup" {
  provider = aws.us_east
  bucket   = "${local.name_prefix}-backup-east"
  
  tags = local.common_tags
}

resource "aws_s3_bucket" "west_backup" {
  provider = aws.us_west
  bucket   = "${local.name_prefix}-backup-west"
  
  tags = local.common_tags
}

# Multi-cloud example
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
  }
}

provider "azurerm" {
  features {}
}

# Azure resources
resource "azurerm_resource_group" "main" {
  name     = "${local.name_prefix}-rg"
  location = "West US 2"
  
  tags = {
    Environment = var.environment
    Project     = var.project_name
    Cloud       = "Azure"
  }
}


# VARIABLE FILES AND ENVIRONMENTS

# terraform.tfvars example
project_name = "myapp"
environment = "development"
aws_region = "us-west-2"
instance_type = "t3.micro"

database_config = {
  engine         = "postgres"
  engine_version = "15.4"
  instance_class = "db.t3.micro"
  allocated_storage = 20
}

tags = {
  Owner = "DevOps Team"
  Department = "Engineering"
}

# Environment-specific tfvars files
# development.tfvars
instance_type = "t3.micro"
enable_monitoring = false
database_config = {
  engine         = "postgres"
  engine_version = "15.4"
  instance_class = "db.t3.micro"
  allocated_storage = 20
}

# production.tfvars
instance_type = "t3.large"
enable_monitoring = true
database_config = {
  engine         = "postgres"
  engine_version = "15.4"
  instance_class = "db.r6g.large"
  allocated_storage = 100
}

# Use specific tfvars file
# terraform plan -var-file="production.tfvars"
# terraform apply -var-file="production.tfvars"


# TERRAFORM BEST PRACTICES

# 1. File Organization
# main.tf          - Main resources
# variables.tf     - Variable definitions
# outputs.tf       - Output definitions
# locals.tf        - Local values
# versions.tf      - Provider versions
# data.tf          - Data sources

# 2. Naming Conventions
locals {
  # Consistent naming pattern
  name_prefix = "${var.project_name}-${var.environment}"
  
  # Standard tags
  standard_tags = {
    Project     = var.project_name
    Environment = var.environment
    ManagedBy   = "Terraform"
    Owner       = var.owner
    CreatedAt   = formatdate("YYYY-MM-DD", timestamp())
  }
}

# 3. Resource Dependencies
# Use depends_on when implicit dependencies aren't sufficient
resource "aws_instance" "dependency_example" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = var.instance_type
  
  # Explicit dependency
  depends_on = [
    aws_vpc.main,
    aws_internet_gateway.main
  ]
  
  tags = local.common_tags
}

# 4. Security Best Practices
# - Never hardcode secrets
# - Use AWS Secrets Manager or Parameter Store
# - Implement least privilege IAM policies
# - Enable encryption at rest and in transit

# Store secrets in AWS Secrets Manager
resource "aws_secretsmanager_secret" "db_password" {
  name                    = "${local.name_prefix}-db-password"
  description             = "Database password"
  recovery_window_in_days = var.environment == "production" ? 30 : 0
  
  tags = local.common_tags
}

resource "aws_secretsmanager_secret_version" "db_password" {
  secret_id     = aws_secretsmanager_secret.db_password.id
  secret_string = random_password.db_password.result
}


# CI/CD INTEGRATION

# GitHub Actions workflow example
github_actions_workflow = <<-EOT
name: Terraform

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

env:
  TF_VERSION: '1.6.0'
  AWS_REGION: 'us-west-2'

jobs:
  terraform:
    name: Terraform
    runs-on: ubuntu-latest
    
    steps:
    - name: Checkout
      uses: actions/checkout@v3
      
    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v2
      with:
        terraform_version: \${{ env.TF_VERSION }}
        
    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v2
      with:
        aws-access-key-id: \${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: \${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: \${{ env.AWS_REGION }}
        
    - name: Terraform Format Check
      run: terraform fmt -check -recursive
      
    - name: Terraform Init
      run: terraform init
      
    - name: Terraform Validate
      run: terraform validate
      
    - name: Terraform Plan
      run: terraform plan -var-file="terraform.tfvars"
      
    - name: Terraform Apply
      if: github.ref == 'refs/heads/main' && github.event_name == 'push'
      run: terraform apply -auto-approve -var-file="terraform.tfvars"
EOT

# GitLab CI/CD pipeline example
gitlab_ci_pipeline = <<-EOT
stages:
  - validate
  - plan
  - apply

variables:
  TF_VERSION: "1.6.0"
  TF_ROOT: \${CI_PROJECT_DIR}

cache:
  key: "\${TF_ROOT}"
  paths:
    - \${TF_ROOT}/.terraform

before_script:
  - cd \${TF_ROOT}
  - terraform init

validate:
  stage: validate
  script:
    - terraform validate
    - terraform fmt -check

plan:
  stage: plan
  script:
    - terraform plan -out=tfplan
  artifacts:
    paths:
      - tfplan

apply:
  stage: apply
  script:
    - terraform apply -auto-approve tfplan
  when: manual
  only:
    - main
EOT


# TERRAFORM TESTING

# Example test structure with Terratest
test_example = <<-EOT
# test/terraform_test.go
package test

import (
    "testing"
    "github.com/gruntwork-io/terratest/modules/terraform"
    "github.com/gruntwork-io/terratest/modules/aws"
    "github.com/stretchr/testify/assert"
)

func TestTerraformInfrastructure(t *testing.T) {
    terraformOptions := &terraform.Options{
        TerraformDir: "../",
        Vars: map[string]interface{}{
            "project_name": "test-project",
            "environment":  "testing",
            "aws_region":   "us-west-2",
        },
    }

    defer terraform.Destroy(t, terraformOptions)
    terraform.InitAndApply(t, terraformOptions)

    // Test outputs
    vpcId := terraform.Output(t, terraformOptions, "vpc_id")
    assert.NotEmpty(t, vpcId)

    // Verify VPC exists
    vpc := aws.GetVpcById(t, vpcId, "us-west-2")
    assert.Equal(t, "10.0.0.0/16", *vpc.CidrBlock)
}
EOT


# DEBUGGING AND TROUBLESHOOTING

# Enable debugging
export TF_LOG=DEBUG
export TF_LOG_PATH=terraform.log

# Common debugging commands
terraform console                      # Interactive console
terraform show                        # Show current state
terraform graph                       # Generate dependency graph
terraform providers                   # Show provider requirements

# Debug outputs
output "debug_information" {
  description = "Debug information"
  value = var.enable_debug ? {
    terraform_version = terraform.version
    workspace        = terraform.workspace
    caller_identity  = data.aws_caller_identity.current
    region          = data.aws_region.current
  } : {}
}

# Common issues and solutions
troubleshooting_guide = <<-EOT
# Common Terraform Issues

## 1. State File Issues
# Problem: State file locked
# Solution: terraform force-unlock LOCK_ID

# Problem: Resource exists but not in state
# Solution: terraform import resource_type.name resource_id

## 2. Provider Issues
# Problem: Provider version conflicts
# Solution: Lock versions in terraform block
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

## 3. Resource Dependencies
# Problem: Circular dependencies
# Solution: Use depends_on or refactor resources

## 4. Performance Issues
# Problem: Slow plan/apply
# Solution: Use -parallelism flag
terraform apply -parallelism=10

## 5. Authentication Errors
# Problem: AWS credentials not found
# Solution: Check credentials
aws configure list
aws sts get-caller-identity
EOT


# USEFUL TERRAFORM COMMANDS

commands_reference = <<-EOT
# Terraform Commands Quick Reference

## Initialization and Setup
terraform init                          # Initialize working directory
terraform init -upgrade                 # Upgrade providers
terraform init -reconfigure             # Reconfigure backend

## Planning and Validation
terraform validate                      # Validate configuration
terraform fmt                          # Format files
terraform fmt -check                   # Check formatting
terraform plan                         # Show execution plan
terraform plan -out=tfplan             # Save plan to file
terraform plan -target=resource        # Plan specific resource

## Applying Changes
terraform apply                        # Apply changes
terraform apply -auto-approve          # Apply without confirmation
terraform apply tfplan                 # Apply saved plan
terraform apply -target=resource       # Apply specific resource

## State Management
terraform state list                   # List resources in state
terraform state show resource          # Show resource details
terraform state mv old_name new_name   # Rename resource
terraform state rm resource            # Remove from state
terraform import resource id           # Import existing resource

## Outputs and Information
terraform output                       # Show all outputs
terraform output -json                 # Show outputs in JSON
terraform show                         # Show current state
terraform providers                    # Show provider requirements

## Workspace Management
terraform workspace list               # List workspaces
terraform workspace new name           # Create workspace
terraform workspace select name        # Switch workspace

## Destruction
terraform destroy                      # Destroy all resources
terraform destroy -target=resource     # Destroy specific resource

## Debugging
terraform console                      # Interactive console
terraform graph                       # Generate dependency graph
terraform version                      # Show version

## Environment Variables
export TF_LOG=DEBUG                   # Enable debug logging
export TF_VAR_variable_name=value     # Set terraform variable
export TF_CLI_ARGS_plan="-parallelism=30" # Set CLI args
EOT


# ADVANCED PATTERNS

# Conditional resource creation
resource "aws_instance" "conditional" {
  count = var.create_instance ? 1 : 0
  
  ami           = data.aws_ami.ubuntu.id
  instance_type = var.instance_type
  
  tags = local.common_tags
}

# Resource creation with for_each
resource "aws_instance" "for_each_example" {
  for_each = var.create_multiple_instances ? toset(["web", "api", "worker"]) : toset([])
  
  ami           = data.aws_ami.ubuntu.id
  instance_type = var.instance_type
  
  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-${each.key}"
    Type = each.key
  })
}

# Complex data transformation
locals {
  # Create subnet mapping
  subnet_mapping = {
    for idx, subnet in aws_subnet.public :
    subnet.availability_zone => {
      id         = subnet.id
      cidr_block = subnet.cidr_block
      az         = subnet.availability_zone
    }
  }
  
  # Environment-specific settings
  settings = merge(
    var.default_settings,
    lookup(var.environment_settings, var.environment, {})
  )
}

# Resource with complex configuration
resource "aws_launch_template" "web" {
  name_prefix   = "${local.name_prefix}-web-"
  image_id      = data.aws_ami.ubuntu.id
  instance_type = local.current_config.instance_type
  
  vpc_security_group_ids = [aws_security_group.web.id]
  
  user_data = base64encode(templatefile("${path.module}/templates/user_data.sh", {
    project_name = var.project_name
    environment  = var.environment
  }))
  
  block_device_mappings {
    device_name = "/dev/sda1"
    ebs {
      volume_size = 20
      volume_type = "gp3"
      encrypted   = true
    }
  }
  
  tag_specifications {
    resource_type = "instance"
    tags = merge(local.common_tags, {
      Name = "${local.name_prefix}-web"
    })
  }
  
  lifecycle {
    create_before_destroy = true
  }
}

# Auto Scaling Group
resource "aws_autoscaling_group" "web" {
  name                = "${local.name_prefix}-web-asg"
  vpc_zone_identifier = aws_subnet.public[*].id
  target_group_arns   = [aws_lb_target_group.web.arn]
  health_check_type   = "ELB"
  
  min_size         = local.current_config.min_size
  max_size         = local.current_config.max_size
  desired_capacity = local.current_config.min_size
  
  launch_template {
    id      = aws_launch_template.web.id
    version = "$Latest"
  }
  
  tag {
    key                 = "Name"
    value               = "${local.name_prefix}-web-asg"
    propagate_at_launch = false
  }
  
  dynamic "tag" {
    for_each = local.common_tags
    content {
      key                 = tag.key
      value               = tag.value
      propagate_at_launch = true
    }
  }
}


echo "Terraform Reference Complete!"
echo "Terraform enables Infrastructure as Code across multiple cloud providers"
echo "Practice with simple resources before moving to complex multi-resource deployments"
echo "Remember: Always use remote state and state locking in team environments"
echo "Key principles: Plan before apply, use modules for reusability, implement proper tagging"