Here is a dump of all of my notes from the CalTech Devops PGC certificate, they aren’t in any particular order. I will only be posting from the courses I found more relevant:

There are about 13 labs as part of this course, i’ll provide a brief description of what each lab entailed.

Lesson 01: Setting Up a LAMP Stack Using Ansible

For this lab, I used Ansible to automate the deployment and configuration of a complete LAMP stack (Linux, Apache, MySQL, and PHP) on an Ubuntu server. Rather than manually installing and configuring each component, the lab demonstrates how infrastructure can be provisioned consistently through an Ansible playbook. This approach reduces deployment time, minimizes configuration errors, and ensures that new development environments can be built quickly and reliably.

The lab begins by configuring the Ansible inventory and creating a playbook that automates the installation of Apache, MySQL, and PHP, along with their required dependencies. The playbook also starts and enables the necessary services, configures the MySQL root password, and deploys a simple PHP test page to validate the installation. After executing the playbook, the target system is transformed into a fully functional web application server without requiring manual intervention. This exercise highlights the value of Infrastructure as Code (IaC) and demonstrates how Ansible can be used to standardize server deployments, improve scalability, and simplify configuration management in enterprise environments.

Lesson 02: Creating Static Host Inventory and Working with Hosts and Groups

In this lab, I learned how to build and manage a static Ansible inventory to enable centralized administration of multiple systems. The exercise focused on establishing secure SSH connectivity between an Ansible control node and managed hosts, creating inventory groups, and validating communication using Ansible ad-hoc commands. By generating SSH key pairs, distributing public keys to remote systems, and configuring inventory files with host information, the lab demonstrated the foundational steps required before large-scale automation can be performed.

The second portion of the lab focused on managing hosts individually and as logical groups within the Ansible inventory. Using ad-hoc commands, I performed tasks such as creating and removing files on remote systems, listing directory contents, and executing package updates across multiple hosts simultaneously. This demonstrated the power of Ansible’s inventory grouping, allowing administrators to target entire collections of servers with a single command rather than managing each system individually. The lab reinforced key automation concepts including inventory management, SSH-based authentication, host grouping, and scalable infrastructure administration, all of which are essential for efficient configuration management in enterprise environments.

Lesson 03: Executing Ad Hoc Commands, Ansible Modules, and Ansible Facts

In this series of labs, I explored several core Ansible capabilities used to automate server administration and gather system information across managed hosts. The exercises began with configuring secure SSH-based communication between an Ansible control node and remote systems, followed by the use of ad hoc commands to execute one-time administrative tasks without creating full playbooks. Through inventory configuration and connectivity testing, I was able to quickly retrieve system information such as uptime and memory utilization from multiple hosts simultaneously, demonstrating how Ansible can streamline routine operational tasks.

The labs also introduced the use of Ansible modules and facts, which provide a more structured and scalable approach to automation. Using built-in modules such as setup, shell, apt, and file, I gathered detailed system information, retrieved hostnames, installed software packages, and managed file permissions on remote servers. Additionally, I used Ansible Facts to collect and filter hardware, operating system, and device information, enabling playbooks to make decisions based on real-time system data. Together, these exercises demonstrated how Ansible can be used for both rapid task execution and intelligent infrastructure management, forming the foundation for more advanced automation workflows and configuration management practices.

Lesson 04: Working with YAML and Ansible Automation

In this series of labs, I explored how YAML serves as a foundational language for both Python applications and Ansible automation. The exercises began with creating, validating, and parsing YAML files using Python, demonstrating how structured data can be stored, verified, and read programmatically for configuration management and application development. I also learned how YAML can be used for data serialization, converting Python dictionaries into human-readable YAML files that simplify data storage, portability, and maintenance. These activities highlighted YAML’s role as a lightweight and flexible format for managing configuration data across automation platforms.

The labs then expanded into practical Ansible use cases, including configuring an Apache web server through an automated playbook, implementing reusable YAML anchors and aliases, and defining global variables through the group_vars directory structure. By automating Apache installation and service validation, I demonstrated how Ansible can consistently deploy and manage application services. Additionally, the use of YAML anchors reduced redundancy by allowing common data structures to be reused across multiple objects, while global variables provided a centralized method for managing configuration values across playbooks. Together, these exercises reinforced key Infrastructure as Code (IaC) principles, including reusability, maintainability, and scalability, while showcasing how YAML and Ansible work together to simplify system administration and automation workflows.

Lesson 05: Ansible Playbook Development and Automation

Ansible Playbook Development and Automation
Creating an Ansible Playbook

In this demo, I created a basic Ansible playbook to automate the installation of Node.js on a target system. The playbook leveraged built-in Ansible modules such as apt_key, apt_repository, and apt to add the NodeSource repository, install the required package, and automate application deployment tasks. This exercise demonstrated the core structure of an Ansible playbook and how automation can be used to consistently provision software and configure systems.

Executing Variables in an Ansible Playbook

This demo introduced the use of variables within Ansible playbooks. A variable was defined in the playbook and then referenced within a task using Jinja2 syntax. By separating data from tasks, variables make playbooks more dynamic, reusable, and easier to maintain across multiple environments and deployments.

Executing Loops in a Playbook

In this exercise, I learned how to iterate through lists of data using Ansible loops. The demo showcased multiple looping methods, including loop, with_items, and indexed iterations. Loops eliminate repetitive code by allowing a single task to process multiple values, improving playbook efficiency and scalability.

Implementing Conditionals in Playbooks

This demo focused on controlling task execution through conditional logic using the when statement. Tasks were configured to run only when specific operating system families or distribution versions were detected. This capability enables playbooks to make intelligent decisions and adapt their behavior based on the target environment.

Configuring Tasks with Handlers

In this lab, I configured a playbook to trigger handlers when a task reported a change. A file creation task notified a handler, which then executed a follow-up action. Handlers are useful for operations such as restarting services only when configuration changes occur, helping improve efficiency and maintain idempotent automation workflows.

Working with Ansible Filters

This demo explored Ansible’s data manipulation capabilities through both built-in and custom filters. Built-in filters were used to transform lists, dictionaries, and strings, while a custom Python filter plugin extended Ansible’s functionality with user-defined logic. The exercise demonstrated how filters can simplify data processing and enhance the flexibility of automation workflows.

Lesson 06: Jinja2 Templating and Data Processing
Setting Up Jinja2

In this demo, I installed and configured Jinja2, the Python templating engine commonly used by Ansible and web applications. The exercise included installing the required Python and Jinja2 packages, verifying the installation, and confirming the version installed on the system. This lab established the foundation for building dynamic templates that separate presentation from application logic, making automation and application development more maintainable and scalable.

Accessing Variables in Jinja2

This demo introduced the fundamentals of working with variables inside Jinja2 templates. A simple template was created that displayed user-specific information, and a Python script was used to pass variables into the template during rendering. The exercise demonstrated how Jinja2 dynamically replaces placeholders with real data, allowing templates to generate customized output based on user-defined values.

Implementing Variables in Jinja2 Filters

In this lab, I explored Jinja2 filters, which provide methods for transforming and formatting data within templates. Using an Ansible playbook, variables were converted to lowercase, uppercase, capitalized, and title case formats. The demo also introduced the default filter, which provides fallback values when variables are undefined. These capabilities allow templates to manipulate data dynamically while reducing the need for additional programming logic.

Running a Playbook Containing Ansible Facts

This demo focused on using Ansible Facts to gather information about managed systems and make automation decisions based on the collected data. A playbook was configured to install the latest Apache package only on Debian-based systems by evaluating operating system facts gathered by Ansible. The exercise demonstrated how automation workflows can adapt to different environments by leveraging system-specific information during execution.

Combining Loops and Conditionals in Jinja2

In this exercise, I learned how to combine loops and conditional statements within Jinja2 templates to generate dynamic content. A YAML data file containing product information was processed through a Jinja2 template that iterated through products and displayed different output depending on whether each item was in stock. This demonstrated how Jinja2 can use logic and data structures together to create flexible, data-driven output without requiring extensive application code.

Lesson 7: Working with Roles and Vault

Creating Ansible Roles

This demo introduced Ansible Roles, a method for organizing automation code into reusable and modular components. An Apache role was created using ansible-galaxy, and separate task files were developed to install Apache, deploy an index.html file, and manage the web service. A main.yml task file was used to control execution order, while handlers were introduced to restart services when changes occurred. Finally, a playbook was created to apply the role to a group of hosts and verify the web server deployment through a browser. This exercise demonstrated how roles improve scalability, maintainability, and organization in Ansible projects.

Key Concepts Learned
Creating role structures with ansible-galaxy init
Separating functionality into task files
Using import_tasks to organize execution
Deploying files with the copy module
Managing services with the service module
Using handlers to restart services when required
Executing roles through playbooks
Verifying deployments through a web browser
Implementing Ansible Vault

This demo focused on protecting sensitive information using Ansible Vault. A vault file was created and encrypted with a password, allowing credentials and other confidential variables to be stored securely. The lab demonstrated how to edit encrypted files, encrypt existing YAML files, change vault passwords using the rekey process, and execute playbooks that require vault-protected data. Ansible Vault provides a secure method for storing secrets while keeping playbooks and automation code in version control systems.

Key Concepts Learned
Creating encrypted vault files
Editing encrypted data securely
Encrypting existing YAML files
Rotating vault passwords with ansible-vault rekey
Executing playbooks with vault-protected variables
Protecting credentials and sensitive configuration data within automation workflows
Implementing Dynamic Inventories

This demo introduced Dynamic Inventories, which allow Ansible to automatically discover managed systems from external sources rather than relying on static inventory files. A Python script was developed using the AWS SDK (boto3) to query running EC2 instances and generate inventory data dynamically. The script was configured as the inventory source in ansible.cfg, enabling Ansible to automatically retrieve host information. A playbook was then executed using the dynamic inventory to gather information from discovered systems. This approach is especially useful in cloud environments where infrastructure changes frequently.

Key Concepts Learned
Installing AWS automation libraries (boto3 and AWS CLI)
Creating a custom Python-based inventory script
Querying AWS EC2 resources dynamically
Generating Ansible-compatible inventory structures
Configuring Ansible to use a dynamic inventory source
Viewing inventory output with ansible-inventory
Running playbooks against dynamically discovered hosts

Lesson 08: Terraform Basics and Workflow

Deploying AWS Infrastructure with Terraform

This demo demonstrated how to deploy and manage AWS infrastructure using Terraform. The process began by creating Terraform project files in VS Code, defining variables for regions, VPCs, and subnets, and creating Terraform configuration files. Terraform was then used to provision AWS networking components including a VPC, public and private subnets, route tables, an Internet Gateway, and a NAT Gateway. Finally, the lab covered applying the configuration to deploy resources and removing them when no longer needed. This exercise introduced Infrastructure as Code (IaC) principles and showed how Terraform automates cloud infrastructure provisioning.

Key Concepts Learned
Creating and organizing Terraform project files
Defining reusable variables in variables.tf
Configuring the AWS provider
Creating AWS VPCs and subnets with Terraform
Using availability zones dynamically
Deploying public and private networking infrastructure
Creating route tables and route table associations
Configuring Internet Gateways and NAT Gateways
Managing AWS resources through Infrastructure as Code
Deploying and removing infrastructure with Terraform commands
Validating Terraform Configuration Files

This demo focused on validating Terraform configurations before deployment. The process included initializing Terraform with terraform init, generating an execution plan using terraform plan, deploying infrastructure using terraform apply, and removing resources with terraform destroy. The execution plan allowed verification of proposed changes before deployment, while the apply and destroy commands demonstrated the complete lifecycle management of cloud resources. This workflow helps ensure Terraform configurations are accurate and predictable before modifying production environments.

Key Concepts Learned
Initializing Terraform providers and modules with terraform init
Verifying configuration syntax and dependencies
Generating execution plans using terraform plan
Reviewing planned infrastructure changes before deployment
Deploying resources using terraform apply
Confirming infrastructure creation in AWS
Removing resources using terraform destroy
Managing the full infrastructure lifecycle with Terraform
Creating a Simple HCL Configuration File

This demo introduced the HashiCorp Configuration Language (HCL), Terraform’s native language for defining infrastructure. A simple Terraform configuration was created to provision an AWS S3 bucket using the AWS provider and a randomly generated bucket name. The exercise demonstrated how to define providers, declare resources, initialize Terraform, generate execution plans, apply configurations, and clean up deployed resources. This lab provided a foundation for understanding how Terraform uses HCL to describe cloud infrastructure declaratively.

Key Concepts Learned
Understanding the structure of HCL configuration files
Configuring Terraform providers
Defining AWS resources declaratively
Creating AWS S3 buckets with Terraform
Using Terraform resource dependencies
Generating unique resource names with random identifiers
Initializing Terraform projects
Planning and applying infrastructure changes
Cleaning up resources after deployment
Implementing HCL Functions

This demo demonstrated how Terraform HCL functions can be used to manipulate data and improve configuration flexibility. Examples included string manipulation functions, collection functions for lists and maps, and encoding-related functions. Outputs were generated to demonstrate how functions such as upper(), element(), and lookup() process variables and return transformed values. By using HCL functions, Terraform configurations become more dynamic, reusable, and capable of handling complex input data structures.

Key Concepts Learned
Using string manipulation functions such as upper()
Working with list collections using element()
Accessing map values with lookup()
Defining and referencing Terraform variables
Generating outputs from transformed data
Improving configuration flexibility through functions
Building reusable and dynamic Terraform code
Understanding HCL data types and collections
Using functions to simplify infrastructure definitions

Lesson 09: Terraform Basics and Workflow

Configuring AWS and Random Providers in Terraform

This lesson introduces the foundational concepts of Terraform providers by demonstrating how to configure both the AWS and Random providers within a Terraform project. Readers learn how to prepare their development environment by installing the HashiCorp Terraform extension in Visual Studio Code, creating a Terraform configuration file, and defining provider requirements using the required_providers block. The lesson emphasizes how providers act as the bridge between Terraform and external platforms, enabling infrastructure automation across cloud services and supporting utility providers such as Random for generating unique values.

The walkthrough also covers Terraform initialization, which downloads and installs the specified provider plugins for use in the project. By understanding provider configuration early, learners build a solid foundation for future Terraform deployments. This lesson serves as the starting point for Infrastructure as Code (IaC) practices, teaching users how Terraform communicates with cloud platforms while maintaining version control and consistency across environments.

Running Multiple Cloud Provider Configurations

This lesson explores how Terraform can manage resources across multiple cloud regions using provider aliases. Instead of being limited to a single AWS region, the configuration demonstrates how multiple provider instances can be defined within the same project, each targeting a different geographic location. By assigning aliases to provider blocks, Terraform gains the flexibility to deploy and manage infrastructure across several regions simultaneously.

The tutorial then shows how individual resources can reference specific providers, allowing EC2 instances to be deployed in multiple AWS regions from a single Terraform configuration. This approach is particularly valuable for organizations implementing disaster recovery, high availability, or globally distributed applications. The lesson highlights Terraform’s ability to centralize multi-region deployments while maintaining clear, organized infrastructure definitions.

Generating an SSH Key with a Terraform TLS Provider

This lesson demonstrates how Terraform can generate cryptographic assets directly through the TLS provider, eliminating the need for external key-generation tools. Readers learn how to add and initialize the TLS provider, verify provider installations, and define resources that automatically generate RSA private keys. The exercise highlights Terraform’s ability to manage not only infrastructure but also supporting security artifacts required for cloud deployments.

The tutorial concludes by storing the generated key in a local file, making it immediately available for secure access to cloud resources such as EC2 instances. By integrating key generation into Terraform workflows, organizations can improve consistency, reduce manual steps, and ensure that infrastructure provisioning and security configuration occur together. This lesson demonstrates an important aspect of Infrastructure as Code: treating security components as managed resources alongside infrastructure.

Implementing Local-Exec Provisioners

This lesson introduces Terraform’s local-exec provisioner, which enables commands and scripts to run on the machine executing Terraform. The configuration creates an EC2 instance and then triggers a local shell script that performs additional automation tasks. By passing resource attributes, such as the public IP address of the newly created instance, Terraform can integrate infrastructure provisioning with local operational workflows.

The hands-on example demonstrates how a custom Bash script can connect to the provisioned EC2 instance and perform post-deployment configuration tasks. This capability allows administrators to extend Terraform beyond infrastructure creation and into operational automation. While provisioners should be used carefully, the lesson shows how local-exec can bridge Terraform with existing scripts and processes when immediate post-deployment actions are required.

Implementing Remote-Exec Provisioners

This lesson expands on Terraform automation by introducing remote-exec provisioners, which execute commands directly on newly created remote systems. The lab builds a complete AWS environment, including networking, security groups, key pairs, and EC2 instances, before using remote-exec to automate configuration tasks on the target machine. This approach enables infrastructure and server setup to occur as part of a single deployment workflow.

By combining SSH connectivity with Terraform provisioning, administrators can automate software installation, configuration changes, and system initialization immediately after resource creation. The lesson demonstrates how remote-exec can reduce manual setup time and ensure consistent deployments across environments. It highlights the value of integrating infrastructure provisioning and system configuration into a unified Infrastructure as Code process.

Formatting Terraform Code

Maintaining clean and consistent code is essential for successful Infrastructure as Code projects, and this lesson focuses on Terraform’s built-in formatting capabilities. Readers are introduced to intentionally unformatted Terraform code and learn how the terraform fmt command automatically aligns and structures the configuration according to Terraform style conventions.

The lesson reinforces the importance of readability and maintainability when working in collaborative environments. Consistent formatting makes configurations easier to review, troubleshoot, and manage over time. By incorporating terraform fmt into daily workflows, teams can improve code quality, reduce stylistic inconsistencies, and maintain professional standards across their infrastructure repositories.

Generating Workspaces in Terraform

This lesson introduces Terraform workspaces as a mechanism for separating infrastructure environments while using a single configuration codebase. Readers learn how to create, view, and switch between workspaces, allowing environments such as development, testing, and production to maintain independent state files. This separation helps prevent accidental modifications and simplifies environment management.

The tutorial demonstrates creating a dedicated development workspace, applying infrastructure changes within that workspace, and navigating between multiple states. By leveraging workspaces, organizations can streamline environment management without duplicating configuration files. The lesson highlights a practical strategy for managing multiple deployment environments while maintaining consistency and reducing administrative overhead.

Validating, Applying, and Destroying a Terraform Configuration File

This lesson covers the complete Terraform deployment lifecycle, guiding readers through validation, deployment, and resource cleanup. It begins by updating a Terraform configuration with multiple providers and resources, then uses the terraform validate process to verify syntax and configuration integrity before deployment. This validation step helps identify errors early and improves deployment reliability.

The lesson concludes by demonstrating how Terraform applies infrastructure changes and later destroys those resources when they are no longer needed. Understanding the full lifecycle of creation, modification, and removal is critical for effective cloud resource management. By mastering these core Terraform commands, practitioners gain confidence in deploying infrastructure safely, managing changes predictably, and avoiding unnecessary cloud costs through proper resource cleanup.

Lesson 10: Terraform State

Managing Terraform State Using Default Local Backend

This lesson introduces Terraform’s default local backend and explains how Terraform tracks infrastructure resources through the state file. Readers learn how to inspect the current state using commands such as terraform show and terraform state list, providing visibility into the resources Terraform is actively managing. The lesson also demonstrates where Terraform stores its state information by default, including both the primary terraform.tfstate file and the backup state file maintained in the working directory.

The walkthrough continues by making infrastructure changes through the addition of a new EC2 instance, validating the changes with terraform plan, and applying them to the environment. By observing how the state file updates after deployment, learners gain a practical understanding of Terraform’s state management process and the critical role state plays in tracking infrastructure over time.

Authenticating Terraform State Backend

This lesson focuses on securing Terraform state management through backend authentication. Readers learn how to create and configure an Amazon S3 bucket specifically for Terraform state storage and understand the authentication requirements needed for Terraform to access remote backends. The lesson highlights the importance of separating infrastructure code from state storage while ensuring secure access to backend resources.

The tutorial explores authentication for both S3 standard backends and Terraform Cloud’s remote enhanced backend. By configuring backend credentials and validating connectivity, users learn how Terraform securely accesses and manages state across multiple storage platforms. These practices establish a foundation for collaborative infrastructure management while maintaining security and operational integrity.

Configuring Terraform State Backend Storage

This lesson demonstrates how to configure a robust and reliable backend storage solution for Terraform state using Amazon S3. Readers learn to enable bucket versioning, which protects state files by preserving historical versions and allowing recovery from accidental changes or corruption. The exercise emphasizes why state files are among the most critical assets in an Infrastructure as Code environment.

In addition to versioning, the lesson covers enabling encryption and implementing state locking capabilities to improve security and consistency. These features help protect sensitive infrastructure metadata while preventing conflicting modifications from multiple users. By the end of the lesson, learners understand how to transform a basic S3 bucket into a production-ready Terraform backend that supports reliability, security, and collaboration.

Configuring Terraform Remote State Backend

This lesson introduces Terraform Cloud as a remote backend solution for managing Terraform state in collaborative environments. Readers learn how to configure Terraform to use the remote backend, authenticate with Terraform Cloud, and associate infrastructure deployments with a dedicated workspace. The lesson highlights the advantages of centralized state management, including improved visibility, collaboration, and operational governance.

The tutorial also demonstrates how Terraform Cloud handles remote execution workflows and state management while securely storing credentials and deployment history. By validating runs directly through the Terraform Cloud interface, users gain insight into enterprise-grade Infrastructure as Code practices. This lesson provides a practical introduction to managing infrastructure in team-based environments using cloud-hosted state management.

Implementing Terraform State Locking

Terraform state files must remain consistent, especially when multiple users or automation processes interact with the same infrastructure. This lesson demonstrates how Terraform state locking prevents concurrent operations from modifying the state file simultaneously. By intentionally creating a lock and attempting a second operation from another terminal, readers can observe how Terraform protects state integrity and prevents corruption.

The lesson also introduces lock timeout settings, allowing Terraform operations to wait for a lock to be released before proceeding. Understanding state locking is critical for teams working in shared environments where multiple deployments may occur concurrently. By implementing locking mechanisms, organizations can avoid conflicting changes and maintain a reliable source of truth for infrastructure management.

Migrating Terraform State

As infrastructure environments evolve, organizations often need to move Terraform state between different backends. This lesson demonstrates how to migrate state seamlessly between the default local backend, an Amazon S3 backend, and Terraform Cloud. Readers learn how Terraform’s migration capabilities preserve existing infrastructure information while changing the storage location of the state file.

The tutorial guides users through backend reconfiguration, state migration commands, and validation procedures to ensure successful transitions. By understanding state migration workflows, practitioners can adapt their infrastructure management strategy as organizational requirements change, moving from individual development environments to centralized and collaborative backend solutions without disrupting existing deployments.

Managing Sensitive Data in Terraform State

This lesson explores one of the most important security considerations in Infrastructure as Code: the handling of sensitive information within Terraform state files. Readers learn how state files can contain sensitive values such as personal information, credentials, and output variables, even when those values are not displayed directly during normal Terraform operations. The lesson begins by examining the raw contents of a Terraform state file to understand what data is actually stored.

The tutorial then demonstrates how to mark variables and outputs as sensitive, reducing their exposure in Terraform output while still allowing Terraform to manage the data internally. However, the lesson also emphasizes that sensitive values may still reside within the state file itself, reinforcing the importance of securing backend storage through encryption, access controls, and proper state management practices. This serves as a valuable reminder that protecting Terraform state is a critical component of cloud security.

Lesson 11: Read Generate and Modify Configs

Implementing Workflow for Managing Configurations in Terraform

This lesson introduces the foundational workflow required to manage AWS infrastructure using Terraform. Readers learn how to create an AWS IAM user, assign appropriate permissions, and generate access and secret keys that Terraform will use to authenticate against AWS services. The lesson emphasizes establishing a dedicated automation account rather than using personal credentials, helping to improve security and operational consistency.

The walkthrough then demonstrates how to configure Terraform with AWS credentials and establish a repeatable workflow for infrastructure management. By connecting Terraform to AWS through a properly configured IAM user, learners create the foundation needed for all subsequent Terraform deployments and automation activities. This lesson serves as the starting point for building Infrastructure as Code workflows in AWS environments.

Working with Variables in Terraform

This lesson focuses on improving Terraform configuration flexibility through the use of variables, local values, and outputs. Readers learn how to define reusable variables for application settings, server names, and team ownership information while also using local values to centralize commonly referenced configuration data. These techniques reduce hardcoded values and make infrastructure code more maintainable.

The lesson also demonstrates how to use data sources to dynamically retrieve AWS resources such as Ubuntu AMIs and how to apply consistent tagging across deployed resources. By leveraging variables, locals, and outputs together, practitioners create more scalable and reusable Terraform configurations that can be adapted to multiple environments with minimal modification.

Validating Variables and Securing Secrets in Terraform Code

This lesson explores methods for improving configuration reliability and security through variable validation and sensitive data management. Readers learn how to enforce input requirements using validation rules that restrict acceptable cloud providers, require lowercase input, enforce character limits, and validate IP address formats. These validations help prevent configuration errors before infrastructure is deployed.

The tutorial also demonstrates how to handle sensitive information such as phone numbers and other confidential values. By marking variables and outputs as sensitive, Terraform suppresses their display during execution while still allowing them to be used within configurations. This lesson highlights the importance of protecting sensitive data and ensuring user-provided inputs meet organizational standards.

Working with Collections and Structure Types

This lesson introduces Terraform collection data types, including lists, maps, and complex object structures. Readers learn how to define and reference lists of AWS availability zones, replace static configuration values with maps, and use structured data to simplify resource definitions. These collection types make Terraform configurations more dynamic and easier to maintain.

The lesson also demonstrates how to iterate through map variables to create multiple resources automatically and how complex map structures can improve readability by grouping related configuration values together. By using collections and structured data types, practitioners can significantly reduce repetitive code while improving the scalability and flexibility of their Terraform deployments.

Implementing Terraform Built-in Functions

This lesson focuses on Terraform’s built-in functions, which provide powerful tools for manipulating data within infrastructure configurations. Readers learn how to perform numerical operations using functions such as max() and min(), allowing Terraform to calculate values dynamically instead of relying on hardcoded inputs. These functions help create more intelligent and adaptive infrastructure definitions.

The tutorial also explores string manipulation functions and networking-related functions such as cidrsubnet(), which can automatically generate subnet addresses from larger network blocks. By understanding Terraform’s built-in function library, practitioners gain the ability to perform calculations, transform data, and generate infrastructure components programmatically within their configurations.

Working with Dynamic Blocks

This lesson demonstrates how dynamic blocks can be used to generate repetitive resource configuration sections automatically. Readers learn how to create AWS security groups with multiple ingress rules by iterating through a collection of rule definitions rather than manually defining each block. Dynamic blocks improve maintainability and reduce duplication in Terraform code.

The lesson also introduces local variables as a mechanism for centralizing configuration values and dynamically generating resource names and settings. By combining dynamic blocks with local variables, Terraform configurations become more modular, scalable, and adaptable to changing infrastructure requirements. These techniques are especially useful when managing large environments with many similar configuration elements.

Working with Graphs

This lesson explores Terraform’s ability to generate dependency graphs that visualize relationships between infrastructure resources. Readers build a small AWS environment consisting of resources such as VPCs, subnets, internet gateways, and supporting data sources, allowing Terraform to automatically establish dependency relationships between components.

The tutorial then demonstrates how to generate a graph using the terraform graph command and visualize the output using Graphviz-compatible tools. These visualizations help practitioners understand deployment order, troubleshoot dependency issues, and gain deeper insight into how Terraform interprets resource relationships. Dependency graphs are particularly valuable when working with complex infrastructure environments that contain numerous interconnected resources.

Managing Terraform Resource Lifecycle

This lesson focuses on Terraform lifecycle management features that control how resources are created, modified, and destroyed. Readers learn how to use lifecycle arguments such as create_before_destroy to ensure replacement resources are provisioned before existing resources are removed, minimizing downtime during infrastructure changes. The lesson demonstrates these concepts using AWS security groups and dynamic ingress rules.

The tutorial also introduces prevent_destroy, a powerful safeguard that prevents accidental deletion of critical infrastructure resources. By implementing lifecycle controls, organizations can reduce operational risk, improve service availability, and enforce stronger governance over infrastructure changes. These lifecycle features are essential for production environments where infrastructure stability and protection are high priorities.

Lesson 12: Security in Terraform

Managing Secrets and Credentials with Terraform

This lesson introduces best practices for securely managing AWS credentials when using Terraform. Readers learn how to configure AWS authentication using the AWS CLI rather than hardcoding access keys and secret keys directly into Terraform configuration files. By using the aws configure command, credentials are stored securely and can be reused by Terraform during deployments.

The lesson then demonstrates how Terraform uses these credentials to authenticate with AWS and deploy infrastructure resources such as EC2 instances. Readers create Terraform configuration files, define an EC2 resource, initialize the Terraform working directory, preview infrastructure changes with terraform plan, and deploy resources using terraform apply. This approach highlights how Terraform can securely interact with cloud platforms while separating authentication from infrastructure code.

Securing Terraform Credentials Using Checkov

This lesson focuses on improving Terraform security through automated code scanning with Checkov. Readers learn how to install Checkov, create a Terraform credentials file, and configure AWS provider authentication using variables rather than embedding credentials directly within Terraform code. By referencing environment variables for sensitive values, the configuration follows more secure credential management practices.

The tutorial then demonstrates how to use Checkov to scan Terraform files for security issues and validate compliance with security best practices. After configuring the credentials file and exporting AWS credentials as environment variables, readers run Checkov against the Terraform configuration to identify potential security concerns. Successful validation confirms that the configuration avoids exposing secrets directly in code and adheres to secure Infrastructure as Code standards. This lesson introduces security scanning as an essential part of the Terraform development lifecycle.

Lesson 13: Terraform Cloud

Working with Private Registry on Terraform Cloud

This lesson demonstrates how to create, publish, and consume private Terraform modules using Terraform Cloud’s Private Registry. Readers begin by setting up a Terraform Cloud account and organization, then create a GitHub repository containing a reusable Terraform module. The module consists of standard Terraform files (main.tf, variables.tf, and output.tf) that define an AWS EC2 instance resource, input variables, and outputs. After committing the module code to GitHub, the repository is published to the organization’s private registry in Terraform Cloud.

The lesson then shows how to initialize a Terraform configuration repository that can consume modules from the private registry. Readers create a local Git repository, commit their Terraform configuration files, connect the repository to GitHub, and push the code to a remote repository. By leveraging Terraform Cloud’s Private Registry, organizations can centralize approved infrastructure modules, promote code reuse, standardize deployments, and simplify module version management across teams.

Working with Workspaces on Terraform Cloud

This lesson introduces Terraform Cloud workspaces and demonstrates how they can be used to manage infrastructure deployments across different environments. Readers learn how to sign in to Terraform Cloud, create an organization, and configure a workspace using the CLI-Driven Workflow model. The lesson emphasizes that workspaces provide isolated state management, allowing multiple deployments to use the same Terraform configuration while maintaining separate infrastructure states.

The tutorial then walks through authenticating Terraform with Terraform Cloud using terraform login, generating an API token, configuring workspace environment variables, and initializing a Terraform project. Readers configure an AWS provider, authenticate with AWS credentials, run terraform init, preview infrastructure changes with terraform plan, and deploy resources using terraform apply. Finally, the lesson demonstrates workspace management commands such as creating, listing, selecting, and switching between workspaces. By the end of the exercise, readers understand how Terraform Cloud workspaces enable environment separation, collaborative infrastructure management, and centralized state storage for Terraform deployments.