Differences

This shows you the differences between two versions of the page.

--- marc:studie:hashicorp_terraform_certified_associate [2026/05/13 09:36] – marcv
+++ marc:studie:hashicorp_terraform_certified_associate [2026/05/14 11:01] (current) – marcv
@@ Line 1: / Line 1: @@
 ====== HashiCorp Terraform Associate ======
+FIXME
+Needed for terraform to provision on AWS:
+The Terraform CLI (1.2.0+) installed.
+The AWS CLI installed.
+An AWS account and associated credentials that allow you to create resources in the us-west-2 region, including an EC2 instance, VPC, and security groups.
 :!: __**Infrastructure as Code**__ is the practice of defining infrastructure deployments using machine-readable files that can be used to provision infrastructure in an automated fashion.
+{{:marc:studie:ansible-terraform.png?600|}}{{:marc:studie:ansible-terraform2.png?600|}}
 ===== Infrastructure-as-Code (IaC) Concepts: =====
@@ Line 65: / Line 75: @@
   - **Idempotence:** Each time a Terraform configuration is planned or applied, Terraform checks to see if there are any changes required to the actual environment to match the desired configuration. __Only those resources that require changes will be updated__, and all other resources will be left alone. If there are no changes to the configuration, then Terraform will not make any changes to the environment. State is what allows Terraform to map the resources defined in the configuration to the resources that exist in the real world.
   - **Dependencies:** Imagine a scenario where you have removed a subnet and EC2 instance from a configuration. Terraform will attempt to destroy those resources the next time you apply the configuration. You know intuitively that the EC2 instance must be removed before the subnet, since the instance is dependent on the subnet. How can Terraform figure this out? When the resources were created, the EC2 instance referenced the subnet and so Terraform found the dependency when building its graph. With both resources removed from the configuration, Terraform cannot deduce the dependency by building a graph. The answer? State! Terraform maintains a list of dependencies in the state file so that it can properly deal with dependencies that no longer exist in the current configuration.
-  - **Performance:** The state is a representation of the current state of the world as Terraform understands it. When planning a change, Terraform needs to look at the resources and their attributes to etermine if changes are necessary. Do the EC2 instances need a new metadata tag? Terraform can check the tags attribute in state for the EC2 instance and make a quick decision. While Terraform could query resources directly for each planning run, the performance of planning would rapidly degrade as the infrastructure grows in scale. By default Terraform will refresh the state before each planning run, but to improve performance Terraform can be told to skip the refresh with the--refresh=false argument. The-target argument can be used to specify a particular resource to refresh, without triggering a full refresh of the state. The state can be periodically refreshed from the actual world when required in order to keep up
+  - **Performance:** The state is a representation of the current state of the world as Terraform understands it. When planning a change, Terraform needs to look at the resources and their attributes to etermine if changes are necessary. Do the EC2 instances need a new metadata tag? Terraform can check the tags attribute in state for the EC2 instance and make a quick decision. While Terraform could query resources directly for each planning run, the performance of planning would rapidly degrade as the infrastructure grows in scale. By default Terraform will refresh the state before each planning run, but to improve performance Terraform can be told to skip the refresh with the--refresh=false argument. The-target argument can be used to specify a particular resource to refresh, without triggering a full refresh of the state. The state can be periodically refreshed from the actual world when required in order to keep up with changes, while not requiring a full scan during each plan. It’s important to note that choosing not to refresh the state means that the reality of your infrastructure deployment may not match what is in the state file. This can lead to inconsistent results when you apply the plan, or an outright failure. The risk of not refreshing state should be balanced against any performance improvements.
-with changes, while not requiring a full scan during each plan. It’s important to note that choosing not to refresh the state means that the reality of your infrastructure deployment may not match what is in the state file. This can lead to inconsistent results when you apply the plan, or an outright failure. The risk of not refreshing state should be balanced against any performance improvements.
+  - **Collaboration:** State keeps track of the version of an applied configuration, and it supports the locking of state during updates. Combined with the storage of state in a remote, shared location, teams are able to collaborate on deployments without overwriting each other’s work.
+===== Providers =====
+A **provider** is an executable plug-in that contains the code necessary to interact with the **API of the service** it was written for. Typically this includes a way to authenticate to a service, manage resources, and access data sources.
+:!: Providers can be explicitly **defined** within a configuration, or **implied** by the presence of a resource or data source that uses the provider! The actual arguments in a provider block vary depending on the provider, but all providers support the meta-arguments of **version** and **alias**.
+Example of an Azure provider block:
+<code>1 provider azurerm {
+     version = "=1.41.0"
+     tenant_id = var.tenant_id
+     subscription = var.subscription_id
+}</code>
+  * In the case of the Azure provider, the authentication information could be supplied through an **environment variable** or **cached credentials** from the Azure CLI. The general best practice is to __avoid hard-coding secret information, like credentials,__ into the Terraform configuration.
+  * The version argument is used to **constrain** the provider to a **specific** version or a **range** of versions in order to prevent downloading a new provider that may possibly contain breaking changes. If the version isn’t specified, Terraform will automatically download the **most recent provider** during initialization.
+  * While you can specify the version of the provider in the provider block, HashiCorp recommends that you create a special //**__required_providers__**// block for Terraform configuration as follows:
+<code>
+terraform {
+     required_providers {
+         azurerm = "=1.41.0"
+     }
+}</code>
+  * Rather than setting the version of a provider for each instance of that provider, the **required_providers** block sets it for all instances of the provider, including child modules. Using the required_providers block makes it simpler to update the version on a complex configuration.
+  * There are multiple arguments for specifying the version number. It’s probably a good idea to know these:
+    * >= 1.41.0 is greater than or equal to the version.
+    * <= 1.41.0 is less than or equal to the version.
+    * ∼> 1.41.0 this one is funky. It means any version in the 1.41.X range.
+    * >= 1.20, <= 1.41 is any version between 1.20 and 1.41 inclusive.
+:!: One of the more common arguments is **∼>** which is meant to keep you on the same **major** version, while still allowing for **minor** version updates. For instance, let’s say there’s major change coming to the Azure provider in version 2.0. By setting the version to ∼>1.0, you would allow all version 1 updates that come down while still blocking the big 2.0 release.
+===== Plugin Based Architecture =====
+  * Terraform is provided as a **single binary** that includes **core components** required to parse and deploy Terraform configurations. What is does **not** include is the necessary code to interact with various providers and provisioners. That code is supplied via **plugins**. Each plugin is executed as a **separate process** communicating with the core Terraform binary using an **RPC** interface.
+  * Plugins keep the Terraform binary relatively small, lowers the potential attack surface, and simplifies debugging of core Terraform code. Allowing providers and provisioners to develop their plugins separately creates a firm delineation between what Terraform is meant to do and the plugins.
+===== Using Multiple Providers =====
+Even the most basic configurations will likely use multiple different providers. Let’s take the following configuration as an example:
+<code>
+provider "aws" {
+     region = "us-east-1"
+}
+
+resource "random_integer" "rand" {
+     min = 10000
+     max = 99999
+}
+
+resource "aws_s3_bucket" "bucket" {
+     name = "unique-name-${random_integer.rand.result}"
+     ...
+}</code>
+In this configuration we have already used two separate providers to create a single S3 bucket. The
+Random provider gives us a random integer for naming the bucket and the AWS provider gives us
+the S3 bucket resource. When using a provider it can be explicitly defined in a provider block, or
+implied by the presence of a resource that uses the provider.