TA-002-P Questions and Answers

https://www.terraform.io/docs/provisioners/index.html

https://www.terraform.io/docs/import/usage.html

https://www.hashicorp.com/products/terraform/pricing/

To upgrade to the latest acceptable version of each provider, run terraform init -upgrade. This command also upgrades to the latest versions of all Terraform modules.

https://www.terraform.io/docs/configuration/providers.html

https://www.terraform.io/docs/internals/debugging.html

Explanation

https://www.terraform.io/docs/enterprise/before-installing/index.html#operating-systemrequirements

https://www.terraform.io/cli/commands/console

https://www.terraform.io/internals/debugging

Businesses are making a transition where traditionally-managed infrastructure can no longer meet the demands of today's businesses. IT organizations are quickly adopting the public cloud, which is predominantly API-driven. To meet customer demands and save costs, application teams are architecting their applications to support a much higher level of elasticity, supporting technology like containers and public cloud resources. These resources may only live for a matter of hours; therefore the traditional method of raising a ticket to request resources is no longer a viable option Pointing and clicking in a management console is NOT scale and increases the change of human error.

https://www.terraform.io/language/expressions/references#references-to-resource-attributes

https://www.terraform.io/language/expressions/version-constraints#-3

Allows only the rightmost version component to increment. For example, to allow new patch releases within a specific minor release, use the full version number: ~> 1.0.4 will allow installation of 1.0.5 and 1.0.10 but not 1.1.0

"The current implementation of Terraform import can only import resources into the state. It does not generate configuration. A future version of Terraform will also generate configuration. Because of this, prior to running terraform import it is necessary to write manually a resource configuration block for the resource, to which the imported object will be mapped. While this may seem tedious, it still gives Terraform users an avenue for importing existing resources." https://www.terraform.io/cli/import/usage

The terraform console command provides an interactive console for evaluating expressions. This is useful for testing interpolations before using them in configurations, and for interacting with any values currently saved in state.

https://www.terraform.io/docs/commands/console.html

https://www.terraform.io/language/expressions/dynamic-blocks

Be very careful with this command. If you unlock the state when someone else is holding the lock it could cause multiple writers. Force unlock should only be used to unlock your own lock in the situation where automatic unlocking failed. Source: https://www.terraform.io/language/state/locking

https://www.terraform.io/cli/commands/force-unlock

Anyone can publish and share modules on the Terraform Registry.

https://www.terraform.io/docs/registry/modules/publish.html

A dynamic block acts much like a for expression, but produces nested blocks instead of a complex typed value. It iterates over a given complex value and generates a nested block for each element of that complex value.

https://www.terraform.io/docs/configuration/expressions.html#dynamic-blocks

Terraform Cloud's private module registry helps you share Terraform modules across your organization. It includes support for module versioning, a searchable and filterable list of available modules, and a configuration designer to help you build new workspaces faster.

By design, the private module registry works much like the public Terraform Registry. If you're already used the public registry, Terraform Cloud's registry will feel familiar.

Understand the different offerings in Terraform OS, Terraform Cloud and Terraform Enterprise. Terraform Cloud's private module registry helps you share Terraform modules across your organization.

https://www.terraform.io/docs/cloud/registry/index.html

https://www.terraform.io/docs/cloud/registry/publish.html

https://www.terraform.io/docs/configuration/locals.html

https://learn.hashicorp.com/terraform/getting-started/destroy

terraform workspace list

The command will list all existing workspaces.

"The name of a variable can be any valid identifier except the following: source, version, providers, count, for_each, lifecycle, depends_on, locals." https://www.terraform.io/language/values/variables

https://www.terraform.io/language/expressions/splat

A splat expression provides a more concise way to express a common operation that could otherwise be performed with a for expression.

Most provisioners require access to the remote resource via SSH or WinRM, and expect a nested connection block with details about how to connect.

Terraform Cloud always encrypts state at rest and protects it with TLS in transit. Terraform Cloud also knows the identity of the user requesting state and maintains a history of state changes. This can be used to control access and track activity. Terraform Enterprise also supports detailed audit logging.

https://www.terraform.io/docs/state/sensitive-data.html#recommendations

https://www.terraform.io/docs/registry/modules/publish.html

The -var and -var-file methods of assigning variables have the highest precedence.

https://www.terraform.io/docs/configuration/variables.html

The terraform taint command manually marks a Terraform-managed resource as tainted, forcing it to be destroyed and recreated on the next apply.

This command will not modify infrastructure, but does modify the state file in order to mark a resource as tainted. Once a resource is marked as tainted, the next plan will show that the resource will be destroyed and recreated and the next apply will implement this change.

Forcing the recreation of a resource is useful when you want a certain side effect of recreation that is not visible in the attributes of a resource. For example: re-running provisioners will cause the node to be different or rebooting the machine from a base image will cause new startup scripts to run.

Note that tainting a resource for recreation may affect resources that depend on the newly tainted resource. For example, a DNS resource that uses the IP address of a server may need to be modified to reflect the potentially new IP address of a tainted server. The plan command will show this if this is the case.

https://www.terraform.io/docs/commands/taint.html

https://www.terraform.io/docs/state/remote.html

The terraform state command is used for advanced state management. Rather than modify the state directly, the terraform state commands can be used in many cases instead.

https://www.terraform.io/docs/commands/state/index.html

You can optionally define multiple configurations for the same provider, and select which one to use on a per-resource or per-module basis. The primary reason for this is to support multiple regions for a cloud platform; other examples include targeting multiple Docker hosts, multiple Consul hosts, etc.

To include multiple configurations for a given provider, include multiple provider blocks with the same provider name, but set the alias meta-argument to an alias name to use for each additional configuration. For example:

# The default provider configuration

provider "aws" {

region = "us-east-1"

}

# Additional provider configuration for west coast region

provider "aws" {

alias = "west"

region = "us-west-2"

}

The provider block without alias set is known as the default provider configuration. When alias is set, it creates an additional provider configuration. For providers that have no required configuration arguments, the implied empty configuration is considered to be the default provider configuration.

https://www.terraform.io/docs/configuration/providers.html#alias-multiple-provider-instances

The terraform refresh command is used to reconcile the state Terraform knows about (via its state file) with the real-world infrastructure. This can be used to detect any drift from the last-known state, and to update the state file.

This does not modify infrastructure, but does modify the state file. If the state is changed, this may cause changes to occur during the next plan or apply.

https://www.terraform.io/docs/configuration/functions/lookup.html

Collection Types

A collection type allows multiple values of one other type to be grouped together as a single value. The type of value within a collection is called its element type. All collection types must have an element type, which is provided as the argument to their constructor.

For example, the type list(string) means "list of strings", which is a different type than list(number), a list of numbers. All elements of a collection must always be of the same type.

The three kinds of collection type in the Terraform language are:

* list(...): a sequence of values identified by consecutive whole numbers starting with zero.

The keyword list is a shorthand for list(any), which accepts any element type as long as every element is the same type. This is for compatibility with older configurations; for new code, we recommend using the full form.

* map(...): a collection of values where each is identified by a string label.

The keyword map is a shorthand for map(any), which accepts any element type as long as every element is the same type. This is for compatibility with older configurations; for new code, we recommend using the full form.

* set(...): a collection of unique values that do not have any secondary identifiers or ordering.

https://www.terraform.io/docs/configuration/types.html

Structural Types

A structural type allows multiple values of several distinct types to be grouped together as a single value. Structural types require a schema as an argument, to specify which types are allowed for which elements.

The two kinds of structural type in the Terraform language are:

* object(...): a collection of named attributes that each have their own type.

The schema for object types is { = , = , ... } — a pair of curly braces containing a comma-separated series of = pairs. Values that match the object type must contain all of the specified keys, and the value for each key must match its specified type. (Values with additional keys can still match an object type, but the extra attributes are discarded during type conversion.)

* tuple(...): a sequence of elements identified by consecutive whole numbers starting with zero, where each element has its own type.

The schema for tuple types is [, , ...] — a pair of square brackets containing a comma-separated series of types. Values that match the tuple type must have exactly the same number of elements (no

more and no fewer), and the value in each position must match the specified type for that position.

For example: an object type of object({ name=string, age=number }) would match a value like the following:

{

name = "John"

age = 52

}

Also, an object type of object({ id=string, cidr_block=string }) would match the object produced by a reference to an aws_vpc resource, like aws_vpc.example_vpc; although the resource has additional attributes, they would be discarded during type conversion.

Finally, a tuple type of tuple([string, number, bool]) would match a value like the following:

["a", 15, true]

https://www.terraform.io/docs/configuration/types.html

The terraform refresh command is used to reconcile the state Terraform knows about (via its state file) with the real-world infrastructure. This can be used to detect any drift from the last-known state, and to update the state file. This does not modify infrastructure, but does modify the state file.

https://www.terraform.io/docs/commands/refresh.html

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/device_naming.html

"The terraform plan command creates an execution plan, which lets you preview the changes that Terraform plans to make to your infrastructure. By default, when Terraform creates a plan it:

Reads the current state of any already-existing remote objects to make sure that the Terraform state is up-to-date.

Compares the current configuration to the prior state and noting any differences.

Proposes a set of change actions that should, if applied, make the remote objects match the configuration."

"The plan command alone will not actually carry out the proposed changes, and so you can use this command to check whether the proposed changes match what you expected before you apply the changes or share your changes with your team for broader review.

If Terraform detects that no changes are needed to resource instances or to root module output values, terraform plan will report that no actions need to be taken."

https://www.terraform.io/cli/commands/plan

Although this will only output to stderr and if you need to review log file you will need to include TF_LOG_PATH=pathtofile https://www.terraform.io/internals/debugging

Terraform supports both HashiCorp Configuration Language (HCL) and JSON formats for configurations.

https://www.terraform.io/docs/configuration/

Provisioners are a Last Resort

Terraform includes the concept of provisioners as a measure of pragmatism, knowing that there will always be certain behaviors that can't be directly represented in Terraform's declarative model.

However, they also add a considerable amount of complexity and uncertainty to Terraform usage. Firstly, Terraform cannot model the actions of provisioners as part of a plan because they can in principle take any action. Secondly, successful use of provisioners requires coordinating many more details than Terraform usage usually requires: direct network access to your servers, issuing Terraform credentials to log in, making sure that all of the necessary external software is installed, etc.

The following sections describe some situations which can be solved with provisioners in principle, but where better solutions are also available. We do not recommend using provisioners for any of the use-cases described in the following sections.

Even if your specific use-case is not described in the following sections, we still recommend attempting to solve it using other techniques first, and use provisioners only if there is no other option.

https://www.terraform.io/docs/provisioners/index.html

The .gitignore file should be configured to ignore Terraform files that either contain sensitive data or are not required to save.

Terraform state (terraform.tfstate) can contain sensitive data, depending on the resources in use and your definition of "sensitive." The state contains resource IDs and all resource attributes. For resources such as databases, this may contain initial passwords.

When using local state, state is stored in plain-text JSON files.

The terraform.tfvars file may contain sensitive data, such as passwords or IP addresses of an environment that you may not want to share with others.

Environment variables can be used to set variables. The environment variables must be in the format TF_VAR_name and this will be checked last for a value. For example:

export TF_VAR_region=us-west-1

export TF_VAR_ami=ami-049d8641

export TF_VAR_alist='[1,2,3]'

export TF_VAR_amap='{ foo = "bar", baz = "qux" }'

https://www.terraform.io/docs/commands/environment-variables.html

The remote backend stores Terraform state and may be used to run operations in Terraform Cloud.

When using full remote operations, operations like terraform plan or terraform apply can be executed in Terraform Cloud's run environment, with log output streaming to the local terminal.

Remote plans and applies use variable values from the associated Terraform Cloud workspace.

https://www.terraform.io/docs/backends/types/remote.html

Data sources allow data to be fetched or computed for use elsewhere in Terraform configuration. Use of data sources allows a Terraform configuration to build on information defined outside of Terraform, or defined by another separate Terraform configuration.

The terraform state mv command changes which resource address in your configuration is associated with a particular real-world object. Use this to preserve an object when renaming a resource, or when moving a resource into or out of a child module.

https://www.terraform.io/downloads

https://www.terraform.io/language/functions

Providers usually require some configuration of their own to specify endpoint URLs, regions, authentication settings.

Providers Initialization can be done by either explicitly via a provider block or by adding a resource from that provide

https://www.terraform.io/docs/configuration/providers.html

https://www.terraform.io/language/state/workspaces#when-to-use-multiple-workspaces