Azure - HashiCorp Certified: Terraform Associate - 70 Demos

Course Modules

Infrastructure as Code (IaC)
Install Tools on MacOs, LinuxOS and WindowsOS
Command Basics
Language Syntax
Settings Block
Providers Block
Multiple Providers usage
Dependency Lock File Importance
Resources Syntax and Behavior
Resources Meta-Argument - depends_on
Resources Meta-Argument - count
Resources Meta-Argument - for_each
Resources Meta-Argument - for_each Maps
Resources Meta-Argument - for_each ToSet
Resources Meta-Argument - for_each Chaining
Azure Linux Virtual Machine with Terraform
Resources Meta-Argument - lifecycle create_before_destroy
Resources Meta-Argument - lifecycle prevent_destroy
Resources Meta-Argument - lifecycle ignore_changes
Input Variables - Basics
Input Variables - Assign When Prompted
Input Variables - Override default with cli var
Input Variables - Override with environment variables
Input Variables - Assign with terraform.tfvars
Input Variables - Assign with tfvars var-file argument
Input Variables - Assign with auto tfvars
Input Variables - Lists
Input Variables - Maps
Input Variables - Validation Rules
Input Variables - Sensitive Input Variables
Input Variables - Structural Type Object
Input Variables - Structural Type tuple
Input Variables - Structural Type sets
Output Values - Basics
Output Values - With Count and Splat Expression
Output Values - With for_each and for loops
Local Values
Conditional Expressions
Datasources
Backends - Remote State Storage
Remote State Datasource
State Commands
Terraform Apply -refresh-only Command
CLI Workspaces with local backend
CLI Workspaces with remote backend
File Provisioner
local-exec Provisioner
remote-exec Provisioner
Null Resource
State Import
Modules from Public Registry
Terraform Azure Static Website
Build Local Module
Publish Modules to Terraform Public Registry
Module Sources
Terraform Cloud - VCS-Driven Workflow
Terraform Cloud - CLI-Driven Workflow
Terraform Cloud - Share modules in private module registry
Migrate State to Terraform Cloud
Basic Sentinel & Cost Control Policies
Foundational Sentinel Policies
Dynamic Blocks
Terraform Debug
Override Files
External Provider Basic Demo
External Provider Integrated Demo
CLI Config File on MacOS and Linux
CLI Config File on WindowsOS
Manage Providers
Terraform Functions

Terraform Functions Used

element() function
file() function
filebase64() function
toset() function
length() function
lookup() function
substr() function
contains() function
lower() function
upper() function
regex() function
can() function
keys() function
values() function
sum() function

What will students learn in your course?

You will learn to master Terraform in a practical perspective with 70 demo's
You will learn each and every concept of Terraform (basic to advanced)
You will learn to write and understand Terraform Resource Behavior in combination with all the Meta-Arguments with 15 Demos
You will learn each and every way (14 types) you can implement the Terraform Input Variables with 14 Demos
You will learn Output Values concept in combination with Terraform Splat Expressions and For Loops with two Meta-Arguments Count and for_each with 3 Demos
You will learn in detail about Terrafrom State, Remote Backends, Terraform Cloud Backends and many Terraform State commands with 5 Demos
You will learn and implement Terraform CLI based workspaces
You will learn and implement all Terraform Provisioners with 4 Demos including Null Resources
You will learn and implement Terraform Modules with 6 Demos (Build Local Module, Public to Public and Private Terraform Registries)
You will learn and implement two important usecases on Terraform Cloud (VCS-Driven and CLI-Driven Workflows)
You will learn about sentinel policies and implement 3 types of sentinel policies
You will learn and implement Terraform Dynamic Expressions, Dynamic Blocks and 15 Terraform Functions
You will also learn and implement Terraform Datasources, Remote State Datasources and Terraform External Providers and Datasources.

Are there any course requirements or prerequisites?

You must have an Azure Cloud account to follow with me for hands-on activities.
You don't need to have any basic knowledge of Terraform. Course will get started from very very basics of Terraform and take you to very advanced levels

Who are your target students?

Infrastructure Architects or Sysadmins or Developers who are planning to master Terraform
Any beginner who is interested in learning IaC Infrastructure as Code current trending tool Terraform
Anyone who want to learn Terraform from a practical perspective

Github Repositories used for this course

HashiCorp Certified: Terraform Associate on Azure
Terraform Cloud Demo
Terraform Module Published to Public Registry
Terraform Module Published to Terraform Cloud Private Registry
Terraform Sentinel Policies
Course PPT Presentation
Important Note: Please go to these repositories and FORK these repositories and make use of them during the course.

Each of my courses come with

Amazing Hands-on Step By Step Learning Experiences
Real Implementation Experience
Friendly Support in the Q&A section
30 Day "No Questions Asked" Money Back Guarantee!

My Other Courses

Udemy Enroll

Stack Simplify Udemy Profile

Udemy Profile

AWS EKS - Elastic Kubernetes Service - Masterclass

Azure Kubernetes Service with Azure DevOps and Terraform

HashiCorp Certified: Terraform Associate - 50 Practical Demos

Terraform on AWS with SRE & IaC DevOps | Real-World 20 Demos

Additional References

Infrastructure as Code Basics

Step-01: Understand Problems with Traditional way of Managing Infrastructure

Time it takes for building multiple environments
Issues we face with different environments
Scale-Up and Scale-Down On-Demand

Step-02: Discuss how IaC with Terraform Solves them

Visibility
Stability
Scalability
Security
Audit--- title: Install Terraform, Azure CLI and VSCode Editor description: Install all the tools required for learning Terraform on Azure Cloud

Step-01: Introduction

Install Terraform CLI
Install Azure CLI
Install VS Code Editor
Install HashiCorp Terraform plugin for VS Code
Install Git Client

Step-02: MACOS: Terraform Install

# Copy binary zip file to a folder
mkdir /Users/<YOUR-USER>/Documents/terraform-install
COPY Package to "terraform-install" folder

# Unzip
unzip <PACKAGE-NAME>
unzip terraform_0.15.4_darwin_amd64.zip

# Copy terraform binary to /usr/local/bin
echo $PATH
mv terraform /usr/local/bin

# Verify Version
terraform version

# To Uninstall Terraform (NOT REQUIRED)
rm -rf /usr/local/bin/terraform

Step-03: MACOS: IDE for Terraform - VS Code Editor

Microsoft Visual Studio Code Editor
Hashicorp Terraform Plugin for VS Code
Configure Course Github Repository using VS Code Editor

Step-04: MACOS: Install Azure CLI

# Install XCode
brew update 
xcode-select --install
Observation: Verify images for reference in "image-reference" folder

# Sample Error (Without Xcode if we try az cli install it will through this error)
Error: python@3.8: the bottle needs the Apple Command Line Tools to be installed.
  You can install them, if desired, with:
    xcode-select --install


# AZ CLI Current Version (if installed)
az --version

# Install Azure CLI (if not installed)
brew update 
brew install azure-cli

# Upgrade az cli version
az --version
brew upgrade azure-cli 
[or]
az upgrade
az --version

Step-05: Terraform - Authenticating using the Azure CLI

Azure Provider: Authenticating using the Azure CLI

# Azure CLI Login
az login

# List Subscriptions
az account list

# Set Specific Subscription (if we have multiple subscriptions)
az account set --subscription="SUBSCRIPTION_ID"

Step-06: Install Git Client

Step-07: WindowsOS: Terraform & Azure CLI Install

Step-07-01: Install Git Client

Download Git Client
This is required when we are working with Terraform Modules

Step-07-02: Install Azure CLI

Install Azure CLI
Step-05:Terraform - Authenticating using the Azure CLI is going to be same for WindowsOS too.

# Azure CLI Login
az login

# List Subscriptions
az account list

# Set Specific Subscription (if we have multiple subscriptions)
az account set --subscription="SUBSCRIPTION_ID"

Step-07-03: Install Terraform

Download Terraform
Install CLI
Unzip the package
Create new folder terraform-bins
Copy the terraform.exe to a terraformbins
Set PATH in windows

Step-07-04: Configure Course Git Repo

Course Git Repo
Shorten Course folder name to smaller one. Put it in C:\ Drive root path

Step-07-05: Install Visual Studio Code and Terraform Plugin

Microsoft Visual Studio Code Editor
Hashicorp Terraform Plugin for VS Code
Configure Course Github Repository using VS Code Editor

Step-07-06: WindowsOS: Long Path Issues for Terraform CLI

Windows10 Long File Name or Path
Microsoft fix
Our fix is to shorten our git repo names to see if that helps

Step-08: LinuxOS: Terraform & Azure CLI Install

Download Terraform
Linux OS - Terraform Install
Install Azure CLI
Step-05:Terraform - Authenticating using the Azure CLI is going to be same for LinuxOS too.
Course Git Repo--- title: Terraform Command Basics description: Learn Terraform Commands like init, validate, plan, apply and destroy

Step-01: Introduction

Understand basic Terraform Commands

terraform init
terraform validate
terraform plan
terraform apply
terraform destroy

Step-02: Review terraform manifests

Pre-Conditions-1: Get Azure Regions and decide the region where you want to create resources

# Get Azure Regions
az account list-locations -o table

Pre-Conditions-2: If not done earlier, complete az login via Azure CLI. We are going to use Azure CLI Authentication for Terraform when we use Terraform Commands.

# Azure CLI Login
az login

# List Subscriptions
az account list

# Set Specific Subscription (if we have multiple subscriptions)
az account set --subscription="SUBSCRIPTION_ID"

# Terraform Settings Block
terraform {
  required_version = ">= 1.0.0"
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = ">= 2.0" # Optional but recommended in production
    }    
  }
}
# Configure the Microsoft Azure Provider
provider "azurerm" {
  features {}
}
# Create Resource Group 
resource "azurerm_resource_group" "my_demo_rg1" {
  location = "eastus"
  name = "my-demo-rg1"  
}

Step-03: Terraform Core Commands

# Terraform Initialize
terraform init

# Terraform Validate
terraform validate

# Terraform Plan to Verify what it is going to create / update / destroy
terraform plan

# Terraform Apply to Create Resources
terraform apply

Step-04: Verify Azure Resource Group in Azure Management Console

Go to Azure Management Console -> Resource Groups
Verify newly created Resource Group
Review terraform.tfstate file

Step-05: Destroy Infrastructure

# Destroy Azure Resource Group 
terraform destroy
Observation:
1. Verify if the resource group got deleted in Azure Management Console
2. Verify terraform.tfstate file and resource group info should be removed
3. Verify terraform.tfstate.backup, it should have the resource group info here stored as backup. 

# Delete Terraform files 
rm -rf .terraform*
rm -rf terraform.tfstate*

Step-08: Conclusion

Re-iterate what we have learned in this section
Learned about Important Terraform Commands

terraform init
terraform validate
terraform plan
terraform apply
terraform destroy

title: Terraform Configuration Language Syntax description: Learn Terraform Configuration Language Syntax like Blocks, Arguments, Comments etc

Step-01: Introduction

Understand Terraform Language Basics

Understand Blocks
Understand Arguments, Attributes & Meta-Arguments
Understand Identifiers
Understand Comments

Step-02: Terraform Configuration Language Syntax

Understand Blocks
Understand Arguments
Understand Identifiers
Understand Comments
Terraform Configuration
Terraform Configuration Syntax

# Template
<BLOCK TYPE> "<BLOCK LABEL>" "<BLOCK LABEL>"   {
  # Block body
  <IDENTIFIER> = <EXPRESSION> # Argument
}

# Azure Example
# Create a resource group
resource "azurerm_resource_group" "myrg" { # Resource BLOCK
  name = "myrg-1" # Argument
  location = "East US" # Argument 
}
# Create Virtual Network
resource "azurerm_virtual_network" "myvnet" { # Resource BLOCK
  name                = "myvnet-1" # Argument
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.myrg.location # Argument with value as expression
  resource_group_name = azurerm_resource_group.myrg.name # Argument with value as expression
}

Step-03: Understand about Arguments, Attributes and Meta-Arguments.

Step-04: Understand about Terraform Top-Level Blocks

Discuss about Terraform Top-Level blocks

Terraform Settings Block
Provider Block
Resource Block
Input Variables Block
Output Values Block
Local Values Block
Data Sources Block
Modules Block

title: Terraform Settings, Providers and Resource Blocks description: Learn Key blocks of Terraform like Settings, Providers and Resource Blocks

Step-01: Introduction

Terraform Block

Understand about Terraform Block and its importance
Understand how to handle version constraints for Terraform Version and Provider Version in Terraform Block

Provider Block

What are Terraform Providers?
What Providers Do?
Where do providers reside (Terraform Registry)?
How to use Providers?
What are Provider Badges?

Step-02: Understand about Terraform Settings Block

Terraform Settings Block
Required Terraform Version
Provider Requirements
Terraform backends
Experimental Language Features
Passing Metadata to Providers
Reference sample-terraform-settings.tf for additional understanding.

Step-03: Create a simple terraform block and play with required_version

required_version focuses on underlying Terraform CLI installed on your desktop
If the running version of Terraform on your local desktop doesn't match the constraints specified in your terraform block, Terraform will produce an error and exit without taking any further actions.
By changing the versions try terraform init and observe whats happening

# Play with Terraform CLI Version (We installed 1.0.0 version)
  required_version = "~> 0.14.3" - Will fail
  required_version = "~> 0.14"   - Will fail  
  required_version = "= 0.14.4"  - Will fail
  required_version = ">= 0.13"   - will pass
  required_version = "= 1.0.0"   - will pass
  required_version = "1.0.0"     - will pass 
  required_version = ">= 1.0.0"   - will pass   
 
# Terraform Block
terraform {
  required_version = ">= 1.0.0"
}

# To view my Terraform CLI Version installed on my desktop
terraform version

# Initialize Terraform
terraform init

Step-04: Terraform Providers

What are Terraform Providers?
What Providers Do?
Where do providers reside (Terraform Registry)?

Step-05: Provider Requirements

Define required providers in Terraform Block
Understand about three things about defining required_providers in terraform block
- local names
- source
- version

# Terraform Block
terraform {
  required_version = ">= 1.0.0"
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = ">= 2.0"
    }
  }
}

Step-06: Provider Block

Create a Provider Block for Azure Resource Management azurerm

# Provider Block
provider "azurerm" {
features {}
}

Discuss about Authentication Types
Authenticating to Azure using the Azure CLI
Authenticating to Azure using Managed Service Identity
Authenticating to Azure using a Service Principal and a Client Certificate
Authenticating to Azure using a Service Principal and a Client Secret
Finally, understand about Features Block in Provider Block

# Initialize Terraform
terraform init

# Validate Terraform Configuration files
terraform validate

# Execute Terraform Plan
terraform plan

Step-07: Add Provider and play with Provider version

required_providers block specifies all of the providers required by the current module, mapping each local provider name to a source address and a version constraint.

# Play with Provider Version
      version = "~> 2.0"            
      version = ">= 2.0.0, < 2.60.0"
      version = ">= 2.0.0, <= 2.64.0"

# Terraform Init with upgrade option to change provider version
terraform init -upgrade

Step-08: Create a simple Resource Block - c2-resource-group.tf

# Resource Block
# Create a resource group
resource "azurerm_resource_group" "myrg" {
  name = "myrg-1"
  location = "East US"
}

Step-09: Execute Terraform commands

# Initialize Terraform
terraform init

# Validate Terraform Configuration files
terraform validate

# Execute Terraform Plan
terraform plan

# Create Resources using Terraform Apply
terraform apply -auto-approve

Step-10: Clean-Up

# Destroy Terraform Resources
terraform destroy -auto-approve

# Delete Terraform Files
rm -rf .terraform*
rm -rf terraform.tfstate*

References

title: Azure Terraform VSCode Extension description: Explore Terraform Azure VSCode Extension

Pre-requisite: Configure Azure Cloud Shell

Configure Azure Cloud Shell.

Step-01: Introduction

For students, who have difficulty in running in local desktops (windows or mac), they can use this plugin to run on Azure Cloud Shell.
Learn about Azure Terraform VSCode Extension

Step-02: Install graphviz

Graphviz

# Install Graphviz
brew install graphviz

Step-03: Install NodeJS

Download NodeJs Package
Install the Package

Step-04: Install the Azure Terraform Visual Studio Code extension

Azure Terraform VSCode Extension
The features in this extension support execution in integrated terminal mode or remotely using Azure Cloud Shell.
Some features only run locally at this time and will require some local dependencies.

Azure Terraform: init
Azure Terraform: plan
Azure Terraform: apply
Azure Terraform: validate
Azure Terraform: refresh
Azure Terraform: destroy
Azure Terraform: visualize
Azure Terraform: push
Azure Terraform: Execute Test

Step-05: VS Code - Integrated Terminal: Run Commands Terraform init, plan, apply, visualize

Update VS Code Settings -> Extensions -> Azure Terraform -> Azure Terraform: Terminal -> Integrated
Open 06-Azure-Terraform-VsCode-Plugin/terraform-manifests in a new vscode window.
Test the following commands (CMD + SHIFT + P)

Azure Terraform: init
Azure Terraform: validate
Azure Terraform: plan
Azure Terraform: apply
Azure Terraform: destroy
Azure Terraform: visualize

Review the Terraform Graph

Step-06: VS Code - CloudShell Terminal: Run Commands Terraform init, plan, apply, visualize

Create CloudShell storage if not created or not accessed Cloudshell for the first time.
Update VS Code Settings -> Extensions -> Azure Terraform -> Azure Terraform: Terminal -> CloudShell
Open 06-Azure-Terraform-VsCode-Plugin/terraform-manifests in a new vscode window.
Test the following commands

Azure Terraform: Push
Azure Terraform: init
Azure Terraform: validate
Azure Terraform: plan
Azure Terraform: apply
Azure Terraform: destroy

Make change to c1-versions.tf and run Azure Terraform: Push command and Verify in Azure cloudshell

Azure Terraform: Push
Azure Terraform: plan

Step-06: Clean-up

# Clean-Up files (if any exists of below type)
rm -rf .terraform*
rm -rf terraform.tfstate

References

Azure Terraform Visual Studio Code extension
Terraform Graph--- title: Terraform Multiple Provider Blocks on Azure Cloud description: Learn how to use multiple Terraform provider blocks on Azure Cloud

Multiple Provider Configurations

Step-01: Introduction

Understand and Implement Multiple Provider Configurations

Step-02: How to define multiple provider configuration of same Provider?

Understand about default provider
Understand and define multiple provider configurations of same provider

# Provider-1 for EastUS (Default Provider)
provider "azurerm" {
  features {}
}

# Provider-2 for WestUS Region
provider "azurerm" {
  features {
    virtual_machine {
      delete_os_disk_on_deletion = false # This will ensure when the Virtual Machine is destroyed, Disk is not deleted, default is true and we can alter it at provider level
    }
  }
  alias = "provider2-westus"
  #client_id = "XXXX"
  #client_secret = "YYY"
  #environment = "german"
  #subscription_id = "JJJJ"
}

Step-03: How to reference the non-default provider configuration in a resource?

# Provider-2: Create a resource group in WestUS region - Uses "provider2-westus" provider
resource "azurerm_resource_group" "myrg2" {
  name = "myrg-2"
  location = "West US"
    #<PROVIDER NAME>.<ALIAS NAME>
  provider = azurerm.provider2-westus
}

Step-04: Execute Terraform Commands

# Initialize Terraform
terraform init

# Validate Terraform Configuration Files
terraform validate

# Generate Terraform Plan
terraform plan

# Create Resources
terraform apply -auto-approve

# Verify the same
1. Verify the Resource Group created in EastUS region
2. Verify the Resource Group created in WestUS region

Step-05: Clean-Up

# Destroy Terraform Resources
terraform destroy -auto-approve

# Delete Terraform Files
rm -rf .terraform*
rm -rf terraform.tfstate*

References

Provider Meta Argument
Azure Provider - Argument and Attribute References--- title: Terraform Provider Dependency Lock File description: Learn about Terraform Provider Dependency Lock File

Step-01: Introduction

Understand the importance of Dependency Lock File which is introduced in Terraform v0.14 onwards

Step-02: Create or Review c1-versions.tf

c1-versions.tf

Discuss about Terraform, Azure and Random Pet Provider Versions
Discuss about Azure RM Provider version 1.44.0
In provider block, features {} block is not present in Azure RM provider verion 1.44.0
Also discuss about Random Provider
Azure Provider v1.44.0 Documentation

# Terraform Block
terraform {
  required_version = ">= 1.0.0"
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = "1.44.0"
      #version = ">= 2.0" # Commented for Dependency Lock File Demo
    }
    random = {
      source = "hashicorp/random"
      version = ">= 3.0"
    }
  }
}

# Provider Block
provider "azurerm" {
# features {}          # Commented for Dependency Lock File Demo
}

Step-03: Create or Review c2-resource-group-storage-container.tf

c2-resource-group-storage-container.tf

Discuss about Azure Resource Group Resource
Discuss about Random String Resource
Discuss about Azure Storage Account Resource - Latest
Discuss about Azure Storage Account Resource - v1.44.0

# Resource-1: Azure Resource Group
resource "azurerm_resource_group" "myrg1" {
  name = "myrg-1"
  location = "East US"
}

# Resource-2: Random String 
resource "random_string" "myrandom" {
  length = 16
  upper = false 
  special = false
}

# Resource-3: Azure Storage Account 
resource "azurerm_storage_account" "mysa" {
  name                     = "mysa${random_string.myrandom.id}"
  resource_group_name      = azurerm_resource_group.myrg1.name
  location                 = azurerm_resource_group.myrg1.location
  account_tier             = "Standard"
  account_replication_type = "GRS"
  account_encryption_source = "Microsoft.Storage"

  tags = {
    environment = "staging"
  }
}

Step-04: Initialize and apply the configuration

# We will start with Base v1.44 `.terraform.lock.hcl` file
cp .terraform.lock.hcl-v1.44 .terraform.lock.hcl
Observation: This will ensure, when we run terraform init, everything related to providers will be picked from this file

# Initialize Terraform
terraform init

# Compare both files
diff .terraform.lock.hcl-v1.44 .terraform.lock.hcl

# Validate Terraform Configuration files
terraform validate

# Execute Terraform Plan
terraform plan

# Create Resources using Terraform Apply
terraform apply

Discuss about following 3 items in .terraform.lock.hcl

Provider Version
Version Constraints
Hashes

Step-05: Upgrade the Azure provider version

For Azure Provider, with version constraint version = ">= 2.0.0", it is going to upgrade to latest version with command terraform init -upgrade

# c1-versions.tf - Comment 1.44.0  and Uncomment ">= 2.0"
      #version = "1.44.0"
      version = ">= 2.0" 

# Upgrade Azure Provider Version
terraform init -upgrade

# Backup
cp .terraform.lock.hcl terraform.lock.hcl-V2.X.X

Review .terraform.lock.hcl

Discuss about Azure Provider Versions
Compare .terraform.lock.hcl-v1.44 & terraform.lock.hcl-V2.X.X

Step-06: Run Terraform Apply with latest Azure Provider

Should fail due to argument account_encryption_source for Resource azurerm_storage_account not present in Azure v2.x provider when compared to Azure v1.x provider

# Terraform Plan
terraform plan

# Terraform Apply
terraform apply

Error Message

Kalyans-MacBook-Pro:terraform-manifests kdaida$ terraform plan
╷
│ Error: Unsupported argument
│ 
│   on c2-resource-group-storage-container.tf line 21, in resource "azurerm_storage_account" "mysa":
│   21:   account_encryption_source = "Microsoft.Storage"
│ 
│ An argument named "account_encryption_source" is not expected here.
╵
Kalyans-MacBook-Pro:terraform-manifests kdaida$

Step-07: Comment account_encryption_source

When we do a major version upgrade to providers, it might break few features.
So with .terraform.lock.hcl, we can avoid this type of issues by maintaining our Provider versions consistent across any machine by having a copy of .terraform.lock.hcl file with us.

# Comment account_encryption_source Attribute
# Resource-3: Azure Storage Account 
resource "azurerm_storage_account" "mysa" {
  name                     = "mysa${random_string.myrandom.id}"
  resource_group_name      = azurerm_resource_group.myrg1.name
  location                 = azurerm_resource_group.myrg1.location
  account_tier             = "Standard"
  account_replication_type = "GRS"
  #account_encryption_source = "Microsoft.Storage"

  tags = {
    environment = "staging"
  }
}

Step-08: Uncomment or add features block in Azure Provider Block

As part of Azure Provider 2.x.x latest versions, it needs features {} block in Provider block.
Please Uncomment features {} block

# Provider Block
provider "azurerm" {
 features {}          
}

Error Log of features block not present

Kalyans-MacBook-Pro:terraform-manifests kdaida$ terraform plan
╷
│ Error: Insufficient features blocks
│ 
│   on  line 0:
│   (source code not available)
│ 
│ At least 1 "features" blocks are required.
╵
Kalyans-MacBook-Pro:terraform-manifests kdaida$

Step-09: Run Terraform Plan and Apply

Everything should pass and Storage account should migrate to StorageV2
Also Azure Provider v2.x default changes should be applied

# Terraform Plan
terraform plan

# Terraform Apply
terraform apply

Step-10: Clean-Up

# Destroy Resources
terraform destroy

# Delete Terraform Files
rm -rf .terraform    
rm -rf .terraform.lock.hcl
Observation:  We are not removing files named ".terraform.lock.hcl-V2.X.X, .terraform.lock.hcl-V1.44" which are needed for this demo for you.

# Delete Terraform State File
rm -rf terraform.tfstate*

Step-11: To put back this to original demo state for students to have seamless demo

# Change-1: c1-versions.tf
      version = "1.44.0"
      #version = ">= 2.0" 

# Change-2: c1-versions.tf: Features block in commented state
# features {}          

# Change-3: c2-resource-group-storage-container.tf 
  account_encryption_source = "Microsoft.Storage"

References

title: Terraform Resource Syntax, Behavior and State description: Learn concepts like Terraform Resource Syntax, Behavior and State

Step-01: Introduction

Understand Resource Syntax
Understand Resource Behavior
Understanding Terraform State File
- terraform.tfstate
Understanding Desired and Current States (High Level Only)

Step-02: Understand Resource Syntax

We are going to understand about below concepts from Resource Syntax perspective
Resource Block
Resource Type
Resource Local Name
Resource Arguments
Resource Meta-Arguments

Step-03: c1-versions.tf

# Terraform Block
terraform {
  required_version = ">= 1.0.0"
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = ">= 2.0" 
    }
  }
}

# Provider Block
provider "azurerm" {
 features {}          
}

Step-04: c2-resource-group.tf

# Resource-1: Azure Resource Group
resource "azurerm_resource_group" "myrg" {
  name = "myrg-1"
  location = "East US"
}

Step-05: c3-virtual-network.tf

Resource-2: Create Virtual Network
Resource-3: Create Subnet
Resource-4: Create Public IP Address
Resource-5: Create Network Interface

# Resource-2: Create Virtual Network
resource "azurerm_virtual_network" "myvnet" {
  name                = "myvnet-1"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name
}

# Resource-3: Create Subnet
resource "azurerm_subnet" "mysubnet" {
  name                 = "mysubnet-1"
  resource_group_name  = azurerm_resource_group.myrg.name
  virtual_network_name = azurerm_virtual_network.myvnet.name
  address_prefixes     = ["10.0.2.0/24"]
}

# Resource-4: Create Public IP Address
resource "azurerm_public_ip" "mypublicip" {
  name                = "mypublicip-1"
  resource_group_name = azurerm_resource_group.myrg.name
  location            = azurerm_resource_group.myrg.location
  allocation_method   = "Static"
  tags = {
    environment = "Dev"
  }
}

# Resource-5: Create Network Interface
resource "azurerm_network_interface" "myvm1nic" {
  name                = "vm1-nic"
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name

  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.mysubnet.id
    private_ip_address_allocation = "Dynamic"
    public_ip_address_id = azurerm_public_ip.mypublicip.id 
  }
}

Step-06: Understand Resource Behavior

We are going to understand resource behavior in combination with Terraform State

Create Resource
Update in-place Resources
Destroy and Re-create Resources
Destroy Resource

Step-07: Resource: Create Resources

# Initialize Terraform
terraform init

Observation: 
1) Successfully downloaded providers in .terraform folder
2) Created lock file named ".terraform.lock.hcl"

# Validate Terraform configuration files
terraform validate
Observation: No files changed / added in current working directory

# Format Terraform configuration files
terraform fmt
Observations: *.tf files will change to format them if any format changes exists

# Review the terraform plan
terraform plan 
Observation-1: Nothing happens during the first run from terraform state perspective
Observation-2: From Resource Behavior perspective you can see "+ create", we are creating 

# Create Resources 
terraform apply -auto-approve
Observation: 
1) Creates terraform.tfstate file in local working directory
2) Creates actual resource in Azure Cloud

Important Note: Here we have seen example for Create Resource

Step-08: Understanding Terraform State File

What is Terraform State ?

It is the primary core thing for terraform to function
In a short way, its the underlying database containing the resources information which are provisioning using Terraform
Primary Purpose: To store bindings between objects in a remote system and resource instances declared in your configuration.
When Terraform creates a remote object in response to a change of configuration, it will record the identity of that remote object against a particular resource instance, and then potentially update or delete that object in response to future configuration changes.
Terraform state file created when we first run the terraform apply
Terraform state file is created locally in working directory.
If required, we can confiure the backend block in terraform block which will allow us to store state file remotely. Storing remotely is recommended option which we will see in the next section of the course.

Step-09: Review terraform.tfstate file

Terraform State files are JSON based
Manual editing of Terraform state files is highly not recommended
Review terraform.tfstate file step by step

Step-10: Resource: Update In-Place: Make changes by adding new tag to Virtual Network Resource

Add a new tag in azurerm_virtual_network resource

# Add this for Virtual Network Resource
    "Environment" = "Dev"

Review Terraform Plan

# Review the terraform plan
terraform plan 
Observation: You should see "~ update in-place" 
"Plan: 0 to add, 1 to change, 0 to destroy."

# Create / Update Resources 
terraform apply -auto-approve
Observation: "Apply complete! Resources: 0 added, 1 changed, 0 destroyed."

Important Note: Here we have seen example for update in-place

Step-11: Resource: Destroy and Re-create Resources: Update Virtual Network Name

This will destroy the Virtual Network, Subnet and Recreate them.

# Before
  name                = "vm1-nic"

# After
  name                = "vm1-nic1"

Execute Terraform Commands

# Review the terraform plan
terraform plan 
Observation: 
1)   -/+ destroy and then create replacement
2) -/+ resource "azurerm_network_interface" "myvm1nic" {
3) -/+ resource "azurerm_network_interface" "myvm1nic" {
4) Plan: 2 to add, 0 to change, 2 to destroy.

# Create / Update Resources 
terraform apply -auto-approve
Observation: 
1. Apply complete! Resources: 2 added, 0 changed, 2 destroyed.

Step-12: Resource: Destroy Resource

# Destroy Resource
terraform destroy 

Observation: 
1) - destroy
2) All 7 resources will be destroyed
3) Plan: 0 to add, 0 to change, 7 to destroy.
4) Destroy complete! Resources: 7 destroyed.

Step-13: Understand Desired and Current States (High-Level Only)

Desired State: Local Terraform Manifest (All *.tf files)
Current State: Real Resources present in your cloud

Step-14: Clean-Up

# Destroy Resource
terraform destroy -auto-approve 

# Remove Terraform Files
rm -rf .terraform*
rm -rf terraform.tfstate*

Step-15: Revert files to Demo State for Students

# Change-1: Comment in azurerm_virtual_network
#"Environment" = "Dev"  # Uncomment during Step-10

# Change-2: Revert name back in azurerm_network_interface Resource 
name                = "vm1-nic"

References

Terraform State
Manipulating Terraform State--- title: Terraform Resource Meta-Argument depends_on description: Learn Terraform Resource Meta-Argument depends_on

Step-01: Introduction

We will create the below Azure Resources using Terraform

Azure Resource Group
Azure Virtual Network
Azure Subnet
Azure Public IP
Azure Network Interface

Use depends_on Resource Meta-Argument attribute when creating Azure Public IP

Step-02: c1-versions.tf - Create Terraform & Provider Blocks

Create Terraform Block
Create Provider Block
Create Random Resource Block

# Terraform Block
terraform {
  required_version = ">= 1.0.0"
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = ">= 2.0" 
    }
    random = {
      source = "hashicorp/random"
      version = ">= 3.0"
    }
  }
}

# Provider Block
provider "azurerm" {
 features {}          
}

# Random String Resource
resource "random_string" "myrandom" {
  length = 6
  upper = false 
  special = false
  number = false   
}

Step-03: c2-resource-group.tf

# Resource-1: Azure Resource Group
resource "azurerm_resource_group" "myrg" {
  name = "myrg-1"
  location = "East US"
}

Step-04: c3-vritual-network.tf - Virtual Network Resource

# Create Virtual Network
resource "azurerm_virtual_network" "myvnet" {
  name                = "myvnet-1"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name
}

Step-05: c3-vritual-network.tf - Azure Subnet Resource

# Create Subnet
resource "azurerm_subnet" "mysubnet" {
  name                 = "mysubnet-1"
  resource_group_name  = azurerm_resource_group.myrg.name
  virtual_network_name = azurerm_virtual_network.myvnet.name
  address_prefixes     = ["10.0.2.0/24"]
}

Step-06: c3-vritual-network.tf - Azure Public IP Resource

# Create Public IP Address
resource "azurerm_public_ip" "mypublicip" {
  name                = "mypublicip-1"
  resource_group_name = azurerm_resource_group.myrg.name
  location            = azurerm_resource_group.myrg.location
  allocation_method   = "Static"
  domain_name_label = "app1-vm-${random_string.myrandom.id}"
  tags = {
    environment = "Dev"
  }
}

Step-07: c3-vritual-network.tf - Network Interface Resource

# Create Network Interface
resource "azurerm_network_interface" "myvmnic" {
  name                = "vmnic"
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name

  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.mysubnet.id
    private_ip_address_allocation = "Dynamic"
    public_ip_address_id = azurerm_public_ip.mypublicip.id 
  }
}

Step-08: Execute Terraform commands in terraform-manifests-v1

# Change Directory
cd terraform-manifests-v1

# Initialize Terraform
terraform init

# Terraform Validate
terraform validate

# Terraform Plan 
terraform plan

# Terraform Apply 
terraform apply 

# Observation
1. Public IP Resource will get created in parallel with Virtual Network Resource

# Terraform Destroy 
terraform destroy -auto-approve

# Clean-Up
rm -rf .terraform*
rm -rf terraform.tfstate*

Step-09: c3-virtual-network.tf - depends_on for azurerm_public_ip

We will review this in terraform-manifests-v2 folder

# Create Public IP Address
resource "azurerm_public_ip" "mypublicip" {
  # Add Explicit Dependency to have this resource created only after Virtual Network and Subnet Resources are created. 
  depends_on = [
    azurerm_virtual_network.myvnet,
    azurerm_subnet.mysubnet
  ]
  name                = "mypublicip-1"
  resource_group_name = azurerm_resource_group.myrg.name
  location            = azurerm_resource_group.myrg.location
  allocation_method   = "Static"
  domain_name_label = "app1-vm-${random_string.myrandom.id}"
  tags = {
    environment = "Dev"
  }
}

Step-10: Execute Terraform commands in terraform-manifests-v2

# Change Directory
cd terraform-manifests-v2

# Initialize Terraform
terraform init

# Terraform Validate
terraform validate

# Terraform Plan 
terraform plan

# Terraform Apply 
terraform apply 

# Observation
1. Public IP Resource will get created only afer Virtual Network and Subnet Resource got created.
2. As we have defined explicit dependency `depends_on` in Public IP Resource, it will wait till those two other resources got created. 
3. Important Point to remember is "Explicitly specifying a dependency is only necessary when a resource or module relies on some other resource's behavior but doesn't access any of that resource's data in its arguments."

# Terraform Destroy 
terraform destroy -auto-approve

# Clean-Up
rm -rf .terraform*
rm -rf terraform.tfstate*

References

Azure Resource Group
Azure Virtual Network
Azure Subnet
Azure Public IP
Azure Network Interface
Azure Virtual Machine--- title: Provision Azure Linux VM using Terraform description: Learn to Provision Azure Linux VM using Terraform

Step-01: Introduction

We will create the below Azure Resources using Terraform

Azure Resource Group
Azure Virtual Network
Azure Subnet
Azure Public IP
Azure Network Interface
Azure Linux Virtual Machine
random_string Resource

We will use Azure custom_data argument in azurerm_linux_virtual_machine to install a simple webserver during the creation of VM.
Terraform file Function
Terraform filebase64 Function

Step-02: Create SSH Keys for Azure Linux VM

# Create Folder
cd terraform-manifests/
mkdir ssh-keys

# Create SSH Key
cd ssh-ekys
ssh-keygen \
    -m PEM \
    -t rsa \
    -b 4096 \
    -C "azureuser@myserver" \
    -f terraform-azure.pem 
Important Note: If you give passphrase during generation, during everytime you login to VM, you also need to provide passphrase.

# List Files
ls -lrt ssh-keys/

# Files Generated after above command 
Public Key: terraform-azure.pem.pub -> Rename as terraform-azure.pub
Private Key: terraform-azure.pem

# Permissions for Pem file
chmod 400 terraform-azure.pem

Step-03: c1-versions.tf - Create Terraform & Provider Blocks

Create Terraform Block
Create Provider Block
Create Random Resource Block

# Terraform Block
terraform {
  required_version = ">= 1.0.0"
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = ">= 2.0" 
    }
    random = {
      source = "hashicorp/random"
      version = ">= 3.0"
    }
  }
}

# Provider Block
provider "azurerm" {
 features {}          
}

# Random String Resource
resource "random_string" "myrandom" {
  length = 6
  upper = false 
  special = false
  number = false   
}

Step-04: c2-resource-group.tf

# Resource-1: Azure Resource Group
resource "azurerm_resource_group" "myrg" {
  name = "myrg-1"
  location = "East US"
}

Step-05: c3-vritual-network.tf - Virtual Network Resource

# Create Virtual Network
resource "azurerm_virtual_network" "myvnet" {
  name                = "myvnet-1"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name
}

Step-06: c3-vritual-network.tf - Azure Subnet Resource

# Create Subnet
resource "azurerm_subnet" "mysubnet" {
  name                 = "mysubnet-1"
  resource_group_name  = azurerm_resource_group.myrg.name
  virtual_network_name = azurerm_virtual_network.myvnet.name
  address_prefixes     = ["10.0.2.0/24"]
}

Step-07: c3-vritual-network.tf - Azure Public IP Resource

# Create Public IP Address
resource "azurerm_public_ip" "mypublicip" {
  name                = "mypublicip-1"
  resource_group_name = azurerm_resource_group.myrg.name
  location            = azurerm_resource_group.myrg.location
  allocation_method   = "Static"
  domain_name_label = "app1-vm-${random_string.myrandom.id}"
  tags = {
    environment = "Dev"
  }
}

Step-08: c3-vritual-network.tf - Network Interface Resource

# Create Network Interface
resource "azurerm_network_interface" "myvmnic" {
  name                = "vmnic"
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name

  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.mysubnet.id
    private_ip_address_allocation = "Dynamic"
    public_ip_address_id = azurerm_public_ip.mypublicip.id 
  }
}

Step-09: c4-linux-virtual-machine.tf

# Resource: Azure Linux Virtual Machine
resource "azurerm_linux_virtual_machine" "mylinuxvm" {
  name                = "mylinuxvm-1"
  computer_name       = "devlinux-vm1" # Hostname of the VM
  resource_group_name = azurerm_resource_group.myrg.name
  location            = azurerm_resource_group.myrg.location
  size                = "Standard_DS1_v2"
  admin_username      = "azureuser"
  network_interface_ids = [
    azurerm_network_interface.myvmnic.id
  ]
  admin_ssh_key {
    username   = "azureuser"
    public_key = file("${path.module}/ssh-keys/terraform-azure.pub")
  }
  os_disk {
    name = "osdisk"
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }
  source_image_reference {
    publisher = "RedHat"
    offer     = "RHEL"
    sku       = "83-gen2"
    version   = "latest"
  }
  custom_data = filebase64("${path.module}/app-scripts/app1-cloud-init.txt")
}

Step-10: app1-cloud-init.txt

#cloud-config
package_upgrade: false
packages:
  - httpd
write_files:
  - owner: root:root 
    path: /var/www/html/index.html
    content: |
      <h1>Welcome to StackSimplify - APP-1</h1>
  - owner: root:root 
    path: /var/www/html/app1/index.html
    content: |
      <!DOCTYPE html> <html> <body style="background-color:rgb(250, 210, 210);"> <h1>Welcome to Stack Simplify - APP-1</h1> <p>Terraform Demo</p> <p>Application Version: V1</p> </body></html>      
runcmd:
  - sudo systemctl start httpd  
  - sudo systemctl enable httpd
  - sudo systemctl stop firewalld
  - sudo mkdir /var/www/html/app1 
  - [sudo, curl, -H, "Metadata:true", --noproxy, "*", "http://169.254.169.254/metadata/instance?api-version=2020-09-01", -o, /var/www/html/app1/metadata.html]

Step-11: Execute Terraform commands to Create Resources using Terraform

# Initialize Terraform
terraform init

# Terraform Validate
terraform validate

# Terraform Plan 
terraform plan

# Terraform Apply 
terraform apply

Step-12: Verify the Resources

Verify Resources

Azure Resource Group
Azure Virtual Network
Azure Subnet
Azure Public IP
Azure Network Interface
Azure Virtual Machine

# Connect to VM and Verify 
ssh -i ssh-keys/terraform-azure.pem azureuser@<PUBLIC-IP>

# Access Application
http://<PUBLIC_IP>
http://<PUBLIC_IP>/app1
http://<PUBLIC_IP>/app1/metadata.html

Step-13: Destroy Terraform Resources

# Destroy Terraform Resources
terraform destroy

# Remove Terraform Files
rm -rf .terraform*
rm -rf terraform.tfstate*

References

Azure Resource Group
Azure Virtual Network
Azure Subnet
Azure Public IP
Azure Network Interface
Azure Virtual Machine--- title: Terraform Resource Meta-Argument count description: Learn Terraform Resource Meta-Argument count

Step-01: Introduction

Resources: Count Meta-Argument
Understand Resource Meta-Argument count
Also implement count and count index practically
In general, 1 Azure VM Instance Resource in Terraform equals to 1 VM Instance in Real Azure Cloud
5 Azure VM Instance Resources = 5 Azure VM Instances in Azure Cloud
With Meta-Argument count this is going to become super simple.
Lets see how.
Learn about Terraform element Function
Learn about Terarform Splat Expression
Learn about Terraform Length Function
Learn about Terraform Console

Step-02: Simple Example - Review terraform-manifests-v1

Folder Path: terraform-manifests-v1
c1-versions.tf
c2-resource-group.tf

# Resource-1: Azure Resource Group
resource "azurerm_resource_group" "myrg" {
  name = "myrg-${count.index}"
  location = "East US"
  count = 3
}

Step-03: Execute Terraform Commands

# Change Directory
cd terraform-manifests-v1

# Terraform Initialize
terraform init

# Terraform Validate
terraform validate

# Terraform Plan 
terraform plan

# Terraform Apply 
terraform apply 

# Terraform Destroy
terraform destroy -auto-approve

# Verify
1. We should see 3 Resource groups created.
2. Verify the count.index number for each resource group

Step-04: Review Terraform Configs V2

Usecase: Create two Azure Linux VMs using Meta-Argument count

We need two Public IPs for two VMs
We need two Network Interfaces two VMs

We are going to learn the following concepts over the process
Learn about Terraform Console
Learn about Terraform Length Function
Learn about Terraform element Function
Learn about Terarform Splat Expression
Folder Path: terraform-manifests-v2
c1-versions.tf: No changes
c2-resource-group.tf: No changes
c3-virtual-network.tf: Has changes for Network Interface
c4-linux-virtual-machine.tf: Has changes

Step-05: terraform-manifests-v2 - c3-virtual-network.tf

For Public IP resource add count=2

# Create Azure Public IP Address
resource "azurerm_public_ip" "mypublicip" {
  count = 2
  name                = "mypublicip-${count.index}"
  resource_group_name = azurerm_resource_group.myrg.name
  location            = azurerm_resource_group.myrg.location
  allocation_method   = "Static"
  domain_name_label = "app1-vm-${count.index}-${random_string.myrandom.id}"  
}

Step-06: Understand about Splat Expression

# Terraform console
terraform console
element(["kalyan", "reddy", "daida"], 0)
element(["kalyan", "reddy", "daida"], 1)
element(["kalyan", "reddy", "daida"], 2)

# To get last element from list
length(["kalyan", "reddy", "daida"])
element(["kalyan", "reddy", "daida"], length(["kalyan", "reddy", "daida"])-1)

Step-07: terraform-manifests-v2 - c3-virtual-network.tf

For Network Interface resource add count=2
Associate Public IP using Element Function and Splat Expression

# Create Network Interface
resource "azurerm_network_interface" "myvmnic" {
  count = 2
  name                = "vmnic-${count.index}"
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name

  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.mysubnet.id
    private_ip_address_allocation = "Dynamic"
    public_ip_address_id = element(azurerm_public_ip.mypublicip[*].id, count.index)
  }
}

Step-08: c4-linux-virtual-machine.tf

For Linux Virtual machine resource add count=2
Associate Network interface to VM using Element Function and Splat Expression

# Resource: Azure Linux Virtual Machine
resource "azurerm_linux_virtual_machine" "mylinuxvm" {
  count = 2
  name                = "mylinuxvm-${count.index}"
  computer_name       = "devlinux-${count.index}" # Hostname of the VM
  resource_group_name = azurerm_resource_group.myrg.name
  location            = azurerm_resource_group.myrg.location
  size                = "Standard_DS1_v2"
  admin_username      = "azureuser"
  network_interface_ids = [element(azurerm_network_interface.myvmnic[*].id, count.index)]
  admin_ssh_key {
    username   = "azureuser"
    public_key = file("${path.module}/ssh-keys/terraform-azure.pub")
  }
  os_disk {
    name = "osdisk${count.index}"
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
    #disk_size_gb = 20
  }
  source_image_reference {
    publisher = "RedHat"
    offer     = "RHEL"
    sku       = "83-gen2"
    version   = "latest"
  }
  custom_data = filebase64("${path.module}/app-scripts/app1-cloud-init.txt")
}

Step-09: Execute Terraform Commands

# Change Directory
cd terraform-manifests-v2

# Terraform Initialize
terraform init

# Terraform Validate
terraform validate

# Terraform Plan 
terraform plan

# Terraform Apply 
terraform apply 

# Verify
1. Azure Resource Group
2. Azure Virtual Network
3. Azure Subnet
4. Azure Public IP - 2 Resources created as specified in count
5. Azure Network Interface - 2 Resources created as specified in count
6. Azure Linux Virtual Machine - - 2 Resources created as specified in count

# Access Application
http://<PUBLIC_IP-1>
http://<PUBLIC_IP-2>

Step-10: Destroy Terraform Resources

# Destroy Terraform Resources
terraform destroy

# Remove Terraform Files
rm -rf .terraform*
rm -rf terraform.tfstate*

References

Resources: Count Meta-Argument--- title: Terraform Resource Meta-Argument for_each Maps description: Learn Terraform Resource Meta-Argument for_each Maps

Step-01: Introduction

Understand about Meta-Argument for_each
Implement for_each with Maps
Resource Meta-Argument: for_each

Step-02: c1-versions.tf

# Terraform Block
terraform {
  required_version = ">= 0.15"
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = ">= 2.0" 
    }
  }
}

# Provider Block
provider "azurerm" {
 features {}          
}

Step-03: c2-resource-group.tf - Implement for_each with Maps

# Resource-1: Azure Resource Group
resource "azurerm_resource_group" "myrg" {
  for_each = {
    dc1apps = "eastus"
    dc2apps = "eastus2"
    dc3apps = "westus"
  }
  name = "${each.key}-rg"
  location = each.value
}

Step-03: Execute Terraform Commands

# Terraform Init
terraform init

# Terraform Validate
terraform validate

# Terraform Format
terraform fmt

# Terraform Plan
terraform plan
Observation: 
1) 3 Resource Groups Resources will be generated in plan
2) Review Resource Names ResourceType.ResourceLocalName[each.key] in Terraform Plan
3) Review Resource Group Names 

# Terraform Apply
terraform apply
Observation: 
1) 3 Resource Group will be created
2) Review Resource Group names in Azure Management console

# Terraform Destroy
terraform destroy

# Clean-Up 
rm -rf .terraform*
rm -rf terraform.tfstate*

title: Terraform Resource Meta-Argument for_each toset description: Learn Terraform Resource Meta-Argument for_each toset

Step-01: Introduction

Understand about Meta-Argument for_each
Implement for_each with Set of Strings
Resource Meta-Argument: for_each
Understand about toset function

Step-02: Terraform toset() function

toset converts its argument to a set value. In short, it does a explicit type conversion to normalize the types.
Important Note-1: Terraform's concept of a set requires all of the elements to be of the same type, mixed-typed elements will be converted to the most general type
Important Note-2: Set collections are unordered and cannot contain duplicate values, so the ordering of the argument elements is lost and any duplicate values are coalesced

# Terraform console
terraform console

# All Strings to Strings
toset(["kalyan", "reddy", "daida"])

# Mixed Type (Strings and Numbers) - Converted to Strings 
toset(["kalyan", "reddy", 123, 456])

# Removes duplicates (Set collections are unordered and cannot contain duplicate values,) 
toset(["z", "k", "r", "a", "k"])

# Also arranges in the order (The order provided will be gone) - In short set collections are unordered
toset([4, 100, 20, 11, 21, 7, 6, 4, 100])

Step-03: c1-versions.tf

# Terraform Block
terraform {
  required_version = ">= 1.0.0"
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = ">= 2.0" 
    }
  }
}

# Provider Block
provider "azurerm" {
 features {}          
}

Step-04: c2-resource-group.tf - Implement for_each with Maps

# Resource-1: Azure Resource Group
resource "azurerm_resource_group" "myrg" {
  for_each = toset(["eastus", "eastus2", "westus"])
  name = "myrg-${each.value}" 
  location = each.key 
  # we can also use each.value as each.key = each.value in this case  
}

Step-05: Execute Terraform Commands

# Terraform Init
terraform init

# Terraform Validate 
terraform validate

# Terraform Format
terraform fmt

# Terraform Plan
terraform plan
Observation: 
1) 3 Resource Groups will be generated in plan
2) Review Resource Names ResourceType.ResourceLocalName[each.key]
3) Review Resource Group name 

# Terarform Apply
terraform apply
Observation: 
1) 3 Azure Resource Groups should be created
2) Review Resource Group names Azure Management console

# Terraform Destroy
terraform destroy

# Clean-Up 
rm -rf .terraform*
rm -rf terraform.tfstate*

title: Terraform Resource Meta-Argument for_each Chaining description: Learn Terraform Resource Meta-Argument for_each Chaining

Step-01: Introduction

Understand about Meta-Argument for_each
Implement for_each Chaining
Because a resource using for_each appears as a map of objects or set of strings when used in expressions elsewhere, you can directly use one resource as the for_each of another in situations where there is a one-to-one relationship between two sets of objects.
In our case, we will use the azurerm_network_interface.myvmnic resource directly in azurerm_linux_virtual_machine.mylinuxvm Resource.

Step-02: Review Terarform Manifests

Copy the terraform-manifests from Section 11-Meta-Argument-count\terraform-manifests-v2 and re-implement this usecase using for_each.
Also apply for_each chaining concept

c1-versions.tf
c2-resource-group.tf
c3-virtual-machine.tf: Changes for Public IP and Network Interface Resources with for_each same argument in both resources.
c4-linux-virtual-machine.tf: for_each using Network Interface Resource

Step-03: c3-virtual-machine.tf - Azure Public IP Resource

# Create Azure Public IP Address
resource "azurerm_public_ip" "mypublicip" {
  #count = 2  
  for_each = toset(["vm1", "vm2"])
  name                = "mypublicip-${each.key}"
  resource_group_name = azurerm_resource_group.myrg.name
  location            = azurerm_resource_group.myrg.location
  allocation_method   = "Static"
  domain_name_label = "app1-${each.key}-${random_string.myrandom.id}"  
}

Step-04: c3-virtual-machine.tf - Azure Network Interface Resource

# Create Network Interface
resource "azurerm_network_interface" "myvmnic" {
  #count = 2
  for_each = toset(["vm1", "vm2"])  
  name                = "vmnic-${each.key}"
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name

  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.mysubnet.id
    private_ip_address_allocation = "Dynamic"
    #public_ip_address_id = element(azurerm_public_ip.mypublicip.*.id, each.key)
    public_ip_address_id = azurerm_public_ip.mypublicip[each.key].id
  }
}

Step-05: c4-linux-virtual-machine.tf

# Resource: Azure Linux Virtual Machine

resource "azurerm_linux_virtual_machine" "mylinuxvm" {
  #count = 2
  #for_each = toset(["vm1", "vm2"])  
  for_each = azurerm_network_interface.myvmnic #for_each chaining
  # Define Explicit Dependency that if VM Nic exists, then only create VM
  depends_on = [ azurerm_network_interface.myvmnic ]
  name                = "mylinuxvm-${each.key}"
  computer_name       = "devlinux-${each.key}" # Hostname of the VM
  resource_group_name = azurerm_resource_group.myrg.name
  location            = azurerm_resource_group.myrg.location
  size                = "Standard_DS1_v2"
  admin_username      = "azureuser"
  #network_interface_ids = [element(azurerm_network_interface.myvmnic.*.id, each.key)]
  network_interface_ids = [azurerm_network_interface.myvmnic[each.key].id]
  admin_ssh_key {
    username   = "azureuser"
    public_key = file("${path.module}/ssh-keys/terraform-azure.pub")
  }
  os_disk {
    name = "osdisk${each.key}"
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
    #disk_size_gb = 20
  }
  source_image_reference {
    publisher = "RedHat"
    offer     = "RHEL"
    sku       = "83-gen2"
    version   = "latest"
  }
  custom_data = filebase64("${path.module}/app-scripts/app1-cloud-init.txt")
}

Step-06: Observe Linux Virtual Machine for_each Argument

In azurerm_linux_virtual_machine resource we are using the for_each argument by referring to Network Interface Resource named azurerm_network_interface.myvmnic. This is called for_each chaining.

# for_each chaining
  for_each = azurerm_network_interface.myvmnic

Step-07: Execute Terraform Commands

# Terraform Init
terraform init

# Terraform Validate
terraform validate

# Terraform Format
terraform fmt

# Terraform Plan
terraform plan
Observation: 
1) 2 Public IP, 2 Network Interface and 2 Linux VM Resources will be generated in plan
2) Review Resource Names ResourceType.ResourceLocalName[each.key]
3) Review Resource Names

# Terarform Apply
terraform apply
 
# Verify
1. Azure Resource Group
2. Azure Virtual Network
3. Azure Subnet
4. Azure Public IP - 2 Resources created as specified in count
5. Azure Network Interface - 2 Resources created as specified in count
6. Azure Linux Virtual Machine - - 2 Resources created as specified in count

# Access Application
http://<PUBLIC_IP-1>
http://<PUBLIC_IP-2>

Step-08: Destroy Terraform Resources

# Destroy Terraform Resources
terraform destroy

# Remove Terraform Files
rm -rf .terraform*
rm -rf terraform.tfstate*

title: Terraform Meta-Argument lifecycle create_before_destroy description: Learn Terraform Resource Meta-Argument lifecycle create_before_destroy

Step-01: Introduction

lifecyle Meta-Argument block contains 3 arguments

create_before_destroy
prevent_destroy
ignore_changes

We are going to practically understand and implement create_before_destroy

Step-02: Review Terraform Manifests

c1-versions.tf
c2-resource-group.tf
c3-virtual-network.tf

Step-03: lifecyle - create_before_destroy

Default Behavior of a Resource: Destroy Resource & re-create Resource
With Lifecycle Block we can change that using create_before_destroy=true
- First new resource will get created
- Second old resource will get destroyed
Add Lifecycle Block inside Resource Block to alter behavior

# Lifecycle Block inside a Resource
  lifecycle {
    create_before_destroy = true
  }

Step-04: Observe without Lifecycle Block

# Switch to Working Directory
cd terraform-manifests

# Initialize Terraform
terraform init

# Validate Terraform Configuration Files
terraform validate

# Format Terraform Configuration Files
terraform fmt

# Generate Terraform Plan
terraform plan

# Create Resources
terraform apply -auto-approve

# Modify Resource Configuration
Change Virtual Network Name from  myvnet-1 to myvnet-2

# Apply Changes
terraform apply -auto-approve
Observation: 
1) First myvnet-1 resource will be destroyed
2) Second myvnet-2 resource will get

Step-05: With Lifecycle Block

Add Lifecycle block in the resource (Uncomment lifecycle block)

# Generate Terraform Plan
terraform plan

# Apply Changes
terraform apply -auto-approve

# Modify Resource Configuration
Change Virtual Network Name from myvnet-2 to myvnet-1

# Apply Changes
terraform apply -auto-approve
Observation: 
1) First myvnet-1 resource will get created
2) Second myvnet-2 resource will get deleted

Step-06: Clean-Up Resources

# Destroy Resources
terraform destroy -auto-approve

# Clean-Up 
rm -rf .terraform*
rm -rf terraform.tfstate*

References

Resource Meat-Argument: Lifecycle--- title: Terraform Meta-Argument lifecycle prevent_destroy description: Learn Terraform Resource Meta-Argument lifecycle prevent_destroy

Step-01: Introduction

lifecyle Meta-Argument block contains 3 arguments

create_before_destroy
prevent_destroy
ignore_changes

We are going to practically understand and implement prevent_destroy

Step-02: Review Terraform Manifests

c1-versions.tf
c2-resource-group.tf
c3-virtual-network.tf

Step-03: lifecycle - prevent_destroy

This meta-argument prevent_destroy, when set to true, will cause Terraform to reject with an error any plan that would destroy the infrastructure object associated with the resource, as long as the argument remains present in the configuration.
This can be used as a measure of safety against the accidental replacement of objects that may be costly to reproduce, such as database instances
However, it will make certain configuration changes impossible to apply, and will prevent the use of the terraform destroy command once such objects are created, and so this option should be used sparingly.
Since this argument must be present in configuration for the protection to apply, note that this setting does not prevent the remote object from being destroyed if the resource block were removed from configuration entirely: in that case, the prevent_destroy setting is removed along with it, and so Terraform will allow the destroy operation to succeed.

# Lifecycle Block
  lifecycle {
    prevent_destroy = true # Default is false
  }

Step-04: Execute Terraform Commands

# Switch to Working Directory
cd terraform-manifests

# Initialize Terraform
terraform init

# Validate Terraform Configuration Files
terraform validate

# Format Terraform Configuration Files
terraform fmt

# Generate Terraform Plan
terraform plan

# Create Resources
terraform apply -auto-approve

# Destroy Resource
terraform destroy

Sample Output when we run destroy

Kalyans-MacBook-Pro:v7-terraform-manifests kdaida$ terraform apply -auto-approve
random_string.myrandom: Refreshing state... [id=xpeska]
azurerm_resource_group.myrg: Refreshing state... [id=/subscriptions/82808767-144c-4c66-a320-b30791668b0a/resourceGroups/myrg-1]
azurerm_virtual_network.myvnet: Refreshing state... [id=/subscriptions/82808767-144c-4c66-a320-b30791668b0a/resourceGroups/myrg-1/providers/Microsoft.Network/virtualNetworks/myvnet-1]
╷
│ Error: Instance cannot be destroyed
│ 
│   on c3-virtual-network.tf line 2:
│    2: resource "azurerm_virtual_network" "myvnet" {
│ 
│ Resource azurerm_virtual_network.myvnet has lifecycle.prevent_destroy set, but the
│ plan calls for this resource to be destroyed. To avoid this error and continue
│ with the plan, either disable lifecycle.prevent_destroy or reduce the scope of the
│ plan using the -target flag.
╵
Kalyans-MacBook-Pro:v7-terraform-manifests kdaida$

Step-05: Comment Lifecycle block to destroy Resources

# Remove/Comment Lifecycle block
- Remove or Comment lifecycle block and clean-up

# Destroy Resource after removing lifecycle block
terraform destroy

# Clean-Up
rm -rf .terraform*
rm -rf terraform.tfstate*

References

Resource Meat-Argument: Lifecycle--- title: Terraform Meta-Argument lifecycle ignore_changes description: Learn Terraform Resource Meta-Argument lifecycle ignore_changes

Step-01: Introduction

lifecyle Meta-Argument block contains 3 arguments

create_before_destroy
prevent_destroy
ignore_changes

We are going to practically understand and implement ignore_changes

Step-02: Review Terraform Manifests

c1-versions.tf
c2-resource-group.tf
c3-virtual-network.tf

Step-03: Create a Azure Virtual Network, make manual changes and understand the behavior

Create Azure Virtual Network

# Switch to Working Directory
cd terraform-manifests

# Initialize Terraform
terraform init

# Terraform Validate
terraform validate

# Terraform Plan 
terraform plan

# Terraform Apply 
terraform apply

Step-04: Update the tag by going to Azure management console

Add a new tag manually to Azure Virtual Network Resource
Try terraform apply now
Terraform will find the difference in configuration on remote side when compare to local and tries to remove the manual change when we execute terraform apply

# Add new tag manually using Azure Portal
WebServer = Apache

# Terraform Plan 
terraform plan

# Terraform Apply 
terraform apply 
Observation: 
1) It will remove the changes which we manually added using Azure Management console

Step-05: Add the lifecyle - ignore_changes block

Enable the block in c3-virtual-network.tf

# Lifecycle Block
   lifecycle {
    ignore_changes = [
      # Ignore changes to tags, e.g. because a management agent
      # updates these based on some ruleset managed elsewhere.
      tags,
    ]
  }

Add new tags manually using Azure Management console for Azure Virtual Network Resource

# Add new tag manually
WebServer = Apache2
ignorechanges = test1

# Terraform Plan 
terraform plan

# Terraform Apply 
terraform apply 
Observation: 
1) Manual changes should not be touched. They should be ignored by terraform
2) Verify the same on Azure management console

Step-06: Lets see the downside of this Lifecycle Block

Add new tag from Terraform Configs by editing the c3-virtual-network.tf

# Terraform Plan
terraform plan
Observation:
1. "No changes" will be reported as we cannot add new tag because it is present in ignore_changes lifecycle block

# Terraform Apply
terraform apply
Observation:
1. "No changes" will be reported as we cannot add new tag because it is present in ignore_changes lifecycle block

Step-07: Clean-Up

# Destroy Resource
terraform destroy -auto-approve

# Clean-Up
rm -rf .terraform*
rm -rf terraform.tfstate*

References

Resource Meat-Argument: Lifecycle--- title: Terraform Input Variables Basics description: Learn Terraform Input Variables Basics

Step-01: Introduction

What are Terraform Input Variables ?
How many ways we can define Terraform Input Variables ?
Learm about Input Variables - Basics

Step-02: Input Variables Basics

Create / Review the terraform manifests

c1-versions.tf
c2-variables.tf
c3-resource-group.tf
c4-virtual-network.tf

We are going to define c2-variables.tf and define the below listed variables

# Input Variables

# 1. Business Unit Name
variable "business_unit" {
  description = "Business Unit Name"
  type = string
  default = "hr"
}
# 2. Environment Name
variable "environment" {
  description = "Environment Name"
  type = string
  default = "dev"
}
# 3. Resource Group Name
variable "resoure_group_name" {
  description = "Resource Group Name"
  type = string
  default = "myrg"
}
# 4. Resource Group Location
variable "resoure_group_location" {
  description = "Resource Group Location"
  type = string
  default = "East US"
}
# 5. Virtual Network Name
variable "virtual_network_name" {
  description = "Virtual Network Name"
  type = string 
  default = "myvnet"
}

Step-03: Use the Variables in Resources - c3-resource-group.tf

# Resource-1: Azure Resource Group
resource "azurerm_resource_group" "myrg" {
  #name = var.resource_group_name
  name = "${var.business_unit}-${var.environment}-${var.resoure_group_name}"
  location = var.resoure_group_location
}

Step-04: Use the Variables in Resources - c4-virtual-network.tf

# Create Virtual Network
resource "azurerm_virtual_network" "myvnet" {
  name                = "${var.business_unit}-${var.environment}-${var.virtual_network_name}"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name
}

Step-05: Execute Terraform Commands

# Initialize Terraform
terraform init

# Validate Terraform configuration files
terraform validate

# Format Terraform configuration files
terraform fmt

# Review the terraform plan
terraform plan

# Create Resources
terraform apply

# Verify the same on Azure Management Console
1. Resource Group Name
2. Virtual Network Name

Step-06: Clean-Up

# Clean-Up
terraform destroy -auto-approve
rm -rf .terraform*
rm -rf terraform.tfstate*

References

Terraform Input Variables

title: Terraform Input Variables Assign when prompted description: Learn Terraform Input Variables Assign when prompted

Step-01: Introduction

Provide Input Variables when prompted during terraform plan or apply in CLI

Step-02: Input Variables Assign When Prompted

Add a new variable in c2-variables.tf named subnet_name without any default value.
As the variable doesn't have any default value when you execute terraform plan or terraform apply it will prompt for the variable.

# 6. Subnet Name: Assign When Prompted using CLI
variable "subnet_name" {
  description = "Virtual Network Subnet Name"
  type = string 
}

Step-03: Update c4-virtual-network.tf Subnet Resource

# Create Subnet
resource "azurerm_subnet" "mysubnet" {
  #name                 = var.subnet_name
  name                 = "${azurerm_virtual_network.myvnet.name}-${var.subnet_name}"
  resource_group_name  = azurerm_resource_group.myrg.name
  virtual_network_name = azurerm_virtual_network.myvnet.name
  address_prefixes     = ["10.0.2.0/24"]
}

Step-04: Execute Terraform Commands

# Initialize Terraform
terraform init

# Validate Terraform configuration files
terraform validate

# Format Terraform configuration files
terraform fmt

# Review the terraform plan
terraform plan

# Observation
1. Verify Resource Group Name
2. Verify Virtual Network Name
3. Verify Virtual Network Subnet Name

Step-05: Clean-Up

# Delete Files
rm -rf .terraform*

References

Terraform Input Variables

title: Terraform Input Variables CLI Argument var description: Learn Terraform Input Variables CLI Argument -var

Step-01: Introduction

Override default variable values using CLI argument -var
Also learn about Terraform Plan Generation

Step-02: Input Variables Override default value with cli argument `-var`

We are going to override the default values defined in c2-variables.tf by providing new values using the -var argument using CLI

# Initialize Terraform
terraform init

# Validate Terraform configuration files
terraform validate

# Format Terraform configuration files
terraform fmt

# Option-1 (Always provide -var for both plan and apply)
# Review the terraform plan
terraform plan -var="resoure_group_name=demorg" -var="resoure_group_location=westus" -var="virtual_network_name=demovnet" -var="subnet_name=demosubnet" 

# Create Resources (optional - We are just learning concept)
terraform apply -var="resoure_group_name=demorg" -var="resoure_group_location=westus" -var="virtual_network_name=demovnet" -var="subnet_name=demosubnet"

Step-03: Generate Terraform Plan and use that using Terraform Apply

# Option-2 (Generate plan file with -var and use that with apply)
# Generate Terraform plan file
terraform plan -var="resoure_group_name=demorg" -var="resoure_group_location=westus" -var="virtual_network_name=demovnet" -var="subnet_name=demosubnet"  -out v1.plan

# Terraform Show
terraform show v1.plan

# Create / Deploy Terraform Resources using Plan file
terraform apply v1.plan

Step-04: Clean-Up Files

# Destroy Resources
terraform destroy -auto-approve
Subnet Name: demosubnet (When Prompted)

# Delete Files
rm -rf .terraform*
rm -rf terraform.tfstate*
mv v1.plan v1.plan_bkup

References

Terraform Input Variables

title: Terraform Input Variables using Environment Variables description: Learn Terraform Input Variables using Environment Variables

Step-01: Introduction

Override default variable values using Environment Variables

Step-02: Input Variables Override with Environment Variables

Set environment variables and execute terraform plan to see if it overrides default values

# Sample
export TF_VAR_variable_name=value

# SET Environment Variables
export TF_VAR_resoure_group_name=rgenv
export TF_VAR_resoure_group_location=westus2
export TF_VAR_virtual_network_name=vnetenv
export TF_VAR_subnet_name=subnetenv
echo $TF_VAR_resoure_group_name, $TF_VAR_resoure_group_location, $TF_VAR_virtual_network_name, $TF_VAR_subnet_name

Step-03: Execute Terraform Commands

# Initialize Terraform
terraform init

# Validate Terraform configuration files
terraform validate

# Format Terraform configuration files
terraform fmt

# Review the terraform plan
terraform plan

# UNSET Environment Variables after demo
unset TF_VAR_resoure_group_name
unset TF_VAR_resoure_group_location
unset TF_VAR_virtual_network_name
unset TF_VAR_subnet_name
echo $TF_VAR_resoure_group_name, $TF_VAR_resoure_group_location, $TF_VAR_virtual_network_name, $TF_VAR_subnet_name

Step-04: Clean-Up Files

# Delete Files
rm -rf .terraform*
rm -rf terraform.tfstate*

References

Terraform Input Variables

title: Terraform Input Variables using terraform.tfvars description: Learn Terraform Input Variables using terraform.tfvars

Step-01: Introduction

Provide Input Variables using terraform.tfvars files

Step-02: Assign Input Variables from terraform.tfvars

Create a file named terraform.tfvars and define variables
If the file name is terraform.tfvars, terraform will auto-load the variables present in this file by overriding the default values in c2-variables.tf

business_unit = "it"
environment = "stg"
resoure_group_name = "rg-tfvars"
resoure_group_location = "eastus2"
virtual_network_name = "vnet-tfvars"
subnet_name = "subnet-tfvars"

Step-03: Execute Terraform Commands

# Initialize Terraform
terraform init

# Validate Terraform configuration files
terraform validate

# Format Terraform configuration files
terraform fmt

# Review the terraform plan
terraform plan

# Create Resources
terraform apply

# Verify Resources
1. Resource Group Name
2. Resource Group Location
3. Virtual Network Name
4. Virtual Network Subnet Name 
5. Compare with names present in  c2-variables.tf to reconfirm it has overrided it and took from terraform.tfvars

Step-04: Clean-Up Files

# Destroy Resources
terraform destroy -auto-approve

# Delete Files
rm -rf .terraform*
rm -rf terraform.tfstate*

References

Terraform Input Variables

title: Terraform Input Variables using -var-file Argument description: Learn Terraform Input Variables using -var-file Argument

Step-01: Introduction

Provide Input Variables using <any-name>.tfvars file with CLI argument -var-file

Step-02: Assign Input Variables with -var-file argument

If we plan to use different names for .tfvars files, then we need to explicitly provide the argument -var-file during the terraform plan or apply
We will use following things in this example
terraform.tfvars: All other common variables will be picked from this file and environment specific files will be picked from specific env.tfvars files
dev.tfvars: environment and resoure_group_location variable will be picked from this file
qa.tfvars: environment and resoure_group_location variable will be picked from this file

terraform.tfvars

business_unit = "it"
resoure_group_name = "rg-tfvars"
virtual_network_name = "vnet-tfvars"
subnet_name = "subnet-tfvars"

dev.tfvars

environment = "dev"
resoure_group_location = "eastus2"

qa.tfvars

environment = "qa"
resoure_group_location = "eastus"

Step-03: Execute Terraform Commands

# Initialize Terraform
terraform init

# Validate Terraform configuration files
terraform validate

# Format Terraform configuration files
terraform fmt

# Review the terraform plan
terraform plan -var-file="dev.tfvars"
terraform plan -var-file="qa.tfvars"

# Terraform Apply - Dev Environment
terraform apply -var-file="dev.tfvars"

# Terraform Apply - QA Environment
terraform apply -var-file="qa.tfvars" # DONT DO THIS FROM SAME WORKING DIRECTORY AS OF NOW
Observation
1. When we run the above command with "qa.tfvars" it will try to replace current dev resources with qa which is not right fundamentally. This is due to Resources Local Name reference is same for both Dev and QA. 
2. Later when we learn Terraform Workspaces concept we can create multiple environments in same working directory under different workspaces. 
3. As of now we didn't reach that state of learning. 
4. In next sections of the course we will learn.

Step-04: Destroy Resources

# Destroy Resources
terraform destroy -auto-approve

# Delete Files
rm -rf .terraform*
rm -rf terraform.tfstate*

References

Terraform Input Variables

title: Terraform Input Variables using .auto.tfvars description: Learn Terraform Input Variables using .auto.tfvars

Step-01: Introduction

Provide Input Variables using auto.tfvars files

Step-02: Auto load input variables with .auto.tfvars files

We will create a file with extension as .auto.tfvars.
With this extension, whatever may be the file name, the variables inside these files will be auto loaded during terraform plan or apply

# Initialize Terraform
terraform init

# Validate Terraform configuration files
terraform validate

# Format Terraform configuration files
terraform fmt

# Review the terraform plan
terraform plan

References

Terraform Input Variables

title: Terraform Input Variables with Collection Type lists description: Learn about Terraform Input Variables with Collection Type lists

Step-01: Introduction

Implement complex type constructors like list

Step-02: Implement complex type cosntructors like `list`

Type Constraints
list (or tuple): a sequence of values, like ["10.0.0.0/16", "10.1.0.0/16", 10.2.0.0/16].
Elements in a list or tuple are identified by consecutive whole numbers, starting with zero.
Implement List function for variable virtual_network_address_space

c2-variables.tf

# 7. Virtual Network address_space
variable "virtual_network_address_space" {
  description = "Virtual Network Address Space"
  type = list(string)
  default = ["10.0.0.0/16", "10.1.0.0/16", "10.2.0.0/16"]
}

terraform.tfvars

business_unit = "it"
environment = "dev"
resoure_group_name = "rg-list"
resoure_group_location = "eastus2"
virtual_network_name = "vnet-list"
subnet_name = "subnet-list"
virtual_network_address_space = ["10.3.0.0/16", "10.4.0.0/16", "10.5.0.0/16"]

Step-03: Update the variable in c4-virtual-network.tf

# Create Virtual Network
resource "azurerm_virtual_network" "myvnet" {
  name                = "${var.business_unit}-${var.environment}-${var.virtual_network_name}"
  #address_space      = ["10.0.0.0/16"]
  address_space       = var.virtual_network_address_space
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name
}

Step-04: Update subnet range

# Create Subnet
resource "azurerm_subnet" "mysubnet" {
  #name                 = var.subnet_name
  name                 = "${azurerm_virtual_network.myvnet.name}-${var.subnet_name}"
  resource_group_name  = azurerm_resource_group.myrg.name
  virtual_network_name = azurerm_virtual_network.myvnet.name
  address_prefixes     = ["10.3.0.0/24"]
}

Step-06: Execute Terraform Commands

# Initialize Terraform
terraform init

# Validate Terraform configuration files
terraform validate

# Format Terraform configuration files
terraform fmt

# Review the terraform plan
terraform plan 

# Terraform Apply
terraform apply -auto-approve

# Observation
1. Verify Virtual Network using Azure Management Console
2. You should see 3 address spaces for Vnet

Step-07: Reference List values individually

# Reference List values individually
var.virtual_network_address_space[0]
var.virtual_network_address_space[1]
var.virtual_network_address_space[2]

# Access 
address_space       = [var.virtual_network_address_space[0]]

Step-08: Update c4-virtual-network.tf

# Create Virtual Network
resource "azurerm_virtual_network" "myvnet" {
  name                = "${var.business_unit}-${var.environment}-${var.virtual_network_name}"
  #address_space      = ["10.0.0.0/16"]
  #address_space       = var.virtual_network_address_space
  address_space       = [var.virtual_network_address_space[0]]
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name
}

Step-09: Execute Terraform Commands

# Terraform Plan
terraform plan 

# Terraform Apply
terraform apply -auto-approve

# Observation
1. Verify the Virtual Network using Azure Management Console
2. You should see only one address space for vnet

Step-10: Clean-Up

# Destroy Resources
terraform destroy -auto-approve

# Delete Files
rm -rf .terraform* 
rm -rf terraform.tfstate*

# Rollback c4-virtual-network.tf (Below line should be enabled)
address_space       = var.virtual_network_address_space

References

Terraform Input Variables

title: Terraform Input Variables with Collection Type maps description: Terraform Input Variables with Collection Type maps

Step-01: Introduction

Implement complex type constructors like maps
Learn to use lookup function

Step-02: Implement complex type cosntructors like `maps`

Type Constraints
map (or object): a group of values identified by named labels, like {name = "Mabel", age = 52}.
Implement Map function for variable public_ip_sku and common_tags

# 8. Public IP SKU
variable "public_ip_sku" {
  description = "Azure Public IP Address SKU"
  type = map(string)
  default = {
    "eastus" = "Basic"
    "eastus2" = "Standard" 
  }
}

# 9. Common Tags
variable "common_tags" {
  description = "Common Tags for Azure Resources"
  type = map(string)
  default = {
    "CLITool" = "Terraform"
    "Tag1" = "Azure"
  } 
}

Step-03: Update c4-virtual-network.tf Public IP Resource

# Create Public IP Address
resource "azurerm_public_ip" "mypublicip" {
  name                = "mypublicip-1"
  resource_group_name = azurerm_resource_group.myrg.name
  location            = azurerm_resource_group.myrg.location
  allocation_method   = "Static"
  domain_name_label = "app1-vm-${random_string.myrandom.id}"
  #sku = var.public_ip_sku["eastus"]
  sku = lookup(var.public_ip_sku, var.resoure_group_location)
  tags = var.common_tags
}

Step-04: Add tags maps variable to following resources

azurerm_resource_group
azurerm_virtual_network
azurerm_public_ip
azurerm_network_interface

  tags = var.common_tags

Step-04-02: lookup() function

Terraform lookup function

# Terraform lookup() Function
lookup({a="ay", b="bee"}, "a", "what?")
lookup({a="ay", b="bee"}, "b", "what?")
lookup({a="ay", b="bee"}, "c", "what?")

# Terraform lookup() Function with our map
lookup({"eastus"="Basic", "eastus2"="Standard"},"eastus", "Basic")
lookup({"eastus"="Basic", "eastus2"="Standard"},"eastus2", "Basic")
lookup({"eastus"="Basic", "eastus2"="Standard"},"", "Basic")

Step-05: Execute Terraform Commands

# Initialize Terraform
terraform init

# Validate Terraform configuration files
terraform validate

# Format Terraform configuration files
terraform fmt

# Review the terraform plan
terraform plan 

# Terraform Apply
terraform apply -auto-approve

# Observation
1. Verify Public IP SKU should be "Standard"
2. Verify Tags for Resource Group, Vnet, Public IP and Network Interface

Step-06: Uncomment Public Resource below line

Understand how to reference a specific value from a map

## Uncomment
# Reference Specific value from Maps variable var.public_ip_sku
  sku = var.public_ip_sku["eastus"]

## Comment
  sku = lookup(var.public_ip_sku, var.resoure_group_location)  

# Terraform Plan
terraform plan

# Observation
1. Verify Public IP resource and SKU should be "Basic"

Step-07: Clean-Up

# Destroy Resources
terraform destroy -auto-approve

# Delete files
rm -rf .terraform*
rm -rf terraform.tfstate*

Step-08: Important Notation about maps

If the key starts with a number in a map 1-development, you must use the colon syntax : instead of =

variable "my_env_names" {
  type = map(string)
  default = {
    "1-development": "dev-apps"
    "2-staging": "staging-apps"
    "3-production": "prod-apps"
  }
}

References

Terraform Input Variables

title: Terraform Input Variables with Validation Rules description: Learn Terraform Input Variables with Validation Rules

Step-01: Introduction

Learn some Terraform Functions

length()
substr()
contains()
lower()
regex()
can()

Implement Custom Validation Rules in Variables

Step-02: Learn Terraform Length Function

The terraform console command provides an interactive console for evaluating expressions.
Terraform Console
Terraform Length Function

# Go to Terraform Console
terraform console

# Test length function
Template: length()

# String
length("hi")
length("hello")

# List
length(["a", "b", "c"]) 

# Map
length({"key" = "value"}) 
length({"key1" = "value1", "key2" = "value2" })

Step-03: Learn Terraform SubString Function

Terraform Sub String Function

# Go to Terraform Console
terraform console

# Test substr function
Template: substr(string, offset, length)
substr("stack simplify", 1, 4)
substr("stack simplify", 0, 6)
substr("stack simplify", 0, 1)
substr("stack simplify", 0, 0)
substr("stack simplify", 0, 10)

Step-04: Learn Terraform contains() Function

Terraform Contains Function

# Go to Terraform Console
terraform console

# Test contains() function
Template: contains(list, value)
contains(["a", "b", "c"], "a")
contains(["a", "b", "c"], "d")
contains(["eastus", "eastus2"], "westus2")

Step-05: Learn Terraform lower() and upper() Function

# Go to Terraform Console
terraform console

# Test lower() function
Template: lower("STRING")
lower("KALYAN REDDY")
lower("STACKSIMPLIFY")

# Test upper() function
Template: lower("string")
upper("kalyan reddy")
upper("stacksimplify")

Step-06: Create Resource Group Variable with Validation Rules

Understand and implement custom validation rules in variables
condition: Defines the expression used to evaluate the Input Variable value. Must return either true for valid, or false for invalid value.
error_message: Defines the error message displayed by Terraform when the condition expression returns false for an invalid value. Must be ended with period or question mark
c2-variables.tf

# 4. Resource Group Location
variable "resoure_group_location" {
  description = "Resource Group Location"
  type = string
  default = "eastus"
  validation {
    condition  = var.resoure_group_location == "eastus" || var.resoure_group_location == "eastus2"
    #condition = contains(["eastus", "eastus2"], lower(var.resoure_group_location))
    error_message = "We only allow Resources to be created in eastus or eastus2 Locations."
  }  
}

Step-07: Run Terraform commands

# Initialize Terraform
terraform init

# Validate Terraform configuration files
terraform validate

# Format Terraform configuration files
terraform fmt

# Review the terraform plan
terraform plan

# Observation
1. When `resoure_group_location = "eastus"`, terraform plan should pass
2. When `resoure_group_location = "eastus2"`, terraform plan should pass
3. When `resoure_group_location = "westus"`, terraform plan should fail with error message as validation rule failed. 

# Uncomment validation rule with contains() function and comment previous one
condition = contains(["eastus", "eastus2"], lower(var.resoure_group_location))

# Review the terraform plan
terraform plan

# Observation
1. When `resoure_group_location = "eastus"`, terraform plan should pass
2. When `resoure_group_location = "eastus2"`, terraform plan should pass
3. When `resoure_group_location = "westus"`, terraform plan should fail with error message as validation rule failed.

Step-08: Learn Terraform regex() and can() Function

# Go to Terraform Console
terraform console

# Test regex() function
Template: regex(pattern, string)
### TRUE CASES
regex("india$", "westindia")
regex("india$", "southindia")
can(regex("india$", "westindia"))
can(regex("india$", "southindia"))

### FAILURE CASES
regex("india$", "eastus")
can(regex("india$", "eastus"))

Step-09: Update Resource Group Location Variable with can() and regex() function related Validation Rule

Update Resource Group Location Variable with can() and regex() function related Validation Rule

# 4. Resource Group Location
variable "resoure_group_location" {
  description = "Resource Group Location"
  type = string
  default = "eastus"
  validation {
    #condition  = var.resoure_group_location == "eastus" || var.resoure_group_location == "eastus2"
    #condition = contains(["eastus", "eastus2"], lower(var.resoure_group_location))
    #error_message = "We only allow Resources to be created in eastus or eastus2 Locations."
    condition = can(regex("india$", var.resoure_group_location))
    error_message = "We only allow Resources to be created in westindia and southindia locations."
  }  
}

Step-10: Run Terraform commands

# Validate Terraform configuration files
terraform validate

# Review the terraform plan
terraform plan

# Observation
1. When `resoure_group_location = "westinida"`, terraform plan should pass
2. When `resoure_group_location = "southindia"`, terraform plan should pass
3. When `resoure_group_location = "eastus2"`, terraform plan should fail with error message as validation rule failed.

Step-11: Clean-Up

# Delete Files
rm -rf .terraform*

# Roll back to state as below for Students seamless demo before git check-in
# Change-1: c1-variables.tf
# 4. Resource Group Location
variable "resoure_group_location" {
  description = "Resource Group Location"
  type = string
  default = "eastus"
  validation {
    condition  = var.resoure_group_location == "eastus" || var.resoure_group_location == "eastus2"
    #condition = contains(["eastus", "eastus2"], lower(var.resoure_group_location))
    error_message = "We only allow Resources to be created in eastus or eastus2 Locations."
    #condition = can(regex("india$", var.resoure_group_location))
    #error_message = "We only allow Resources to be created in westindia and southindia locations."
  }  
}

# Change-2: terraform.tfvars
resoure_group_location = "eastus"
#resoure_group_location = "westus2"
#resoure_group_location = "westindia"
#resoure_group_location = "eastus2"

References

Terraform Input Variables

title: Terraform Sensitive Input Variables description: Learn about Terraform Sensitive Input Variables

Step-01: Introduction

Variables of Type Boolean
Variables of Type Number
Variables of Type Sensitive
Protect Sensitive Input Variables

Step-02: Protect Sensitive Input Variables

Vault Provider
When using environment variables to set sensitive values, keep in mind that those values will be in your environment and command-line history Example: export TF_VAR_db_username=admin TF_VAR_db_password=adifferentpassword
When you use sensitive variables in your Terraform configuration, you can use them as you would any other variable.
Terraform will redact these values in command output and log files, and raise an error when it detects that they will be exposed in other ways.
Important Note-1: Never check-in secrets.tfvars to git repositories
Important Note-2: Terraform state file contains values for these sensitive variables terraform.tfstate. You must keep your state file secure to avoid exposing this data.

Step-03: c1-versions.tf

We are not using any random resource in this demo.
So removed both the Random Provider and Random Resource

# Terraform Block
terraform {
  required_version = ">= 0.15"
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = ">= 2.0" 
    }
  }
}

# Provider Block
provider "azurerm" {
 features {}          
}

Step-04: c2-variables.tf

We are going to add 5 DB variables with following combinations

Azure MySQL DB Name (Variable Type: String)
Azure MySQL DB Username (Variable Type: Sensitive String)
Azure MySQL DB Password (Variable Type: Sensitive String)
Azure MySQL DB Storage in MB (Variable Type: Number)
Azure MYSQL DB auto_grow_enabled (Variable Type: Boolean)

# Input Variables
# 6. Azure MySQL DB Name (Variable Type: String)
variable "db_name" {
  description = "Azure MySQL Database DB Name"
  type        = string
}

# 7. Azure MySQL DB Username (Variable Type: Sensitive String)
variable "db_username" {
  description = "Azure MySQL Database Administrator Username"
  type        = string
  sensitive   = true
}

# 8. Azure MySQL DB Password (Variable Type: Sensitive String)
variable "db_password" {
  description = "Azure MySQL Database Administrator Password"
  type        = string
  sensitive   = true
}

# 9. Azure MySQL DB Storage in MB (Variable Type: Number)
variable "db_storage_mb" {
  description = "Azure MySQL Database Storage in MB"
  type = number
}

# 10. Azure MYSQL DB auto_grow_enabled (Variable Type: Boolean)
variable "db_auto_grow_enabled" {
  description = "Azure MySQL Database - Enable or Disable Auto Grow Feature"
  type = bool
}

Step-05: c4-azure-mysql-database.tf

Create Azure MySQL Database Server

# Azure MySQL Database Server
resource "azurerm_mysql_server" "mysqlserver" {
  name                = "${var.business_unit}-${var.environment}-${var.db_name}" 
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name

  administrator_login          = var.db_username
  administrator_login_password = var.db_password

  sku_name   = "B_Gen5_2"
  storage_mb = var.db_storage_mb
  version    = "8.0"

  auto_grow_enabled                 = var.db_auto_grow_enabled
  backup_retention_days             = 7
  geo_redundant_backup_enabled      = false
  infrastructure_encryption_enabled = false
  public_network_access_enabled     = true
  ssl_enforcement_enabled           = false
  #ssl_minimal_tls_version_enforced  = "TLS1_2"
  tags = var.common_tags
}

Step-06: c4-azure-mysql-database.tf

Create Azure MySQL Database Schema inside Azure MySQL Database Server

# Create Database inside Azure MySQL Database Server
resource "azurerm_mysql_database" "webappdb1" {
  name                = "webappdb1"
  resource_group_name = azurerm_resource_group.myrg.name
  server_name         = azurerm_mysql_server.mysqlserver.name
  charset             = "utf8"
  collation           = "utf8_unicode_ci"
}

Step-07: terraform.tfvars

Discuss about terraform.tfvars file

# Generic Variables
business_unit = "it"
environment = "dev"

# Resource Group Variables
resoure_group_name = "rg"
resoure_group_location = "eastus"

# DB Variables
db_name = "mydb101"
db_storage_mb = 5120
db_auto_grow_enabled = true

Step-08: secrets.tfvars

# Database Secure Variables
db_username = "mydbadmin"
db_password = "H@Sh1CoR3!"

Step-09: Execute Terraform Command

# Initialize Terraform
terraform init

# Validate Terraform configuration files
terraform validate

# Format Terraform configuration files
terraform fmt

# Review the terraform plan
terraform plan -var-file="secrets.tfvars"
Observation:
1. Review the values for db_username and db_password in azurerm_mysql_server resource
2. You should see they were marked as sensitive

# Sample Output
  + resource "azurerm_mysql_server" "mysqlserver" {
      + administrator_login               = (sensitive)
      + administrator_login_password      = (sensitive value)

# Create Resources
terraform apply -var-file="secrets.tfvars"

# Verify Terraform State files
grep administrator_login terraform.tfstate
grep administrator_login_password terraform.tfstate 
Observation:
1. Both values will be in clear-text in terraform.tfstate file
2. Which means we should not check-in "terraform.tfstate" files to git repos for security reasons
3. Same applies to secrets.tfvars file too.

Step-10: Verify and Connect to MySQL DB

# Azure Mgmt Console (if you have mysql client installed on your desktop)
1. Verify the Azure MySQL Database on Azure Mgmt Console
2. Go to Settings -> Connection Security -> Add Client IP (Add your Public IP) -> Click on Save
3. Run MySQL Commands and Verify "webappdb1" schema got created
Template: mysql -h <Azure DB Server Name> -u <Server admin login name> -pH@Sh1CoR3!
kalyan@MyLocalDesktop:~$ mysql -h it-dev-mydb101.mysql.database.azure.com -u mydbadmin@it-dev-mydb101 -pH@Sh1CoR3!
mysql> show schemas;
mysql> exit

# Azure Mgmt Console - Azure Shell
1. Login to Azure shell
2. Run mysql command
Template: mysql -h <Azure DB Server Name> -u <Server admin login name> -pH@Sh1CoR3!
stack@Azure:~$ mysql -h it-dev-mydb101.mysql.database.azure.com -u mydbadmin@it-dev-mydb101 -pH@Sh1CoR3!
3. It should display public IP of Azure shell
4. Go ahead and add that in Azure DB Firewall Rules
5. Go to Settings -> Connection Security -> Add Client IP (Azure Shell Public IP) -> Click on Save
6. Run the mysql connect command
Template: mysql -h <Azure DB Server Name> -u <Server admin login name> -pH@Sh1CoR3!
stack@Azure:~$ mysql -h it-dev-mydb101.mysql.database.azure.com -u mydbadmin@it-dev-mydb101 -pH@Sh1CoR3!
7.  Run show schemas; command and Verify our "webappdb1" schema created or not 
mysql> show schemas;
mysql> exit

Step-11: Clean-Up

# Destroy Resources
terraform destroy -var-file="secrets.tfvars"

# Clean-Up
rm -rf .terraform*
rm -rf terraform.tfstate*

Step-12: Variable Definition Precedence

Discuss about Terraform Variable Definition Precedence

References

Terraform Input Variables

title: Terraform Input Variables with Structural Type object description: Learn about Terraform Input Variables with Structural Type object

Step-01: Introduction

Learn about Terraform Variables Structural Types
Structural types in Terraform allow multiple values of different types to be grouped together as a single value.
Using structural types requires a data schema to be defined for the Input Variables type so that Terraform knows what a valid value is.
Implement Input Variable Structural Type object
object(): A collection of values each with their own type.

# Sample object()
variable "os_configs" {
  type = object({
    location       = string
    size           = string
    instance_count = number
  })
}

Step-02: c2-variables.tf

We are going to enable Threat Detection Policy in Azure MySQL Database.
For that threat_detection_policy block we are going to implement the Input Variable Structural Type object()
Review documentation azurerm_mysql_server

# 11. Azure MySQL DB Threat Detection Policy (Variable Type: Object)
variable "tdpolicy" {
    description = "Azure MySQL DB Threat Detection Policy"
    type = object({
        enabled = bool
        retention_days = number
        email_account_admins = bool
        email_addresses = list(string)
  })
}

Step-03: Update Azure MySQL Server sku_name Tier

Threat Detection Policy is not supported for Basic Tier
We need to Update that to General Purpose Tier
c4-azure-mysql-database.tf

# Before
 sku_name   = "B_Gen5_2" # Basic Tier

# After
 sku_name = "GP_Gen5_2"   # General Purpose Tier

# Supported Values (as on today)
[B_Gen4_1 B_Gen4_2 B_Gen5_1 B_Gen5_2 GP_Gen4_2 GP_Gen4_4 GP_Gen4_8 GP_Gen4_16 GP_Gen4_32 GP_Gen5_2 GP_Gen5_4 GP_Gen5_8 GP_Gen5_16 GP_Gen5_32 GP_Gen5_64 MO_Gen5_2 MO_Gen5_4 MO_Gen5_8 MO_Gen5_16 MO_Gen5_32]

Step-04: Update terraform.tfvars

# DB Variables
db_name = "mydb101"
db_storage_mb = 5120
db_auto_grow_enabled = true
tdpolicy = {
    enabled = true
    retention_days = 10
    email_account_admins = true
    email_addresses = [ "dkalyanreddy@gmail.com", "stacksimplify@gmail.com" ]
}

Step-05: Add the Threat Detection Policy Block in c4-azure-mysql-database.tf

Refer both types below

# With Hard Coded Values
  threat_detection_policy {
    enabled = true
    retention_days = 10
    email_account_admins = true
    email_addresses = [ "dkalyanreddy@gmail.com", "stacksimplify@gmail.com" ]
  }  

# With Structural Type object() defined in Variables
  threat_detection_policy {
    enabled = var.tdpolicy.enabled
    retention_days = var.tdpolicy.retention_days
    email_account_admins = var.tdpolicy.email_account_admins
    email_addresses = var.tdpolicy.email_addresses    
  }

Step-06: Execute Terraform Command

# Initialize Terraform
terraform init

# Validate Terraform configuration files
terraform validate

# Format Terraform configuration files
terraform fmt

# Review the terraform plan
terraform plan -var-file="secrets.tfvars"
Observation:
1. Review the values for Threat Detection Policy
2. All the values defined in "terraform.tfvars", tdpolicy variable should be replaced and shown in terraform execution plan. 

# Terraform Apply (Optional)
terraform apply -var-file="secrets.tfvars"

Step-07: Verify Azure MySQL DB Threat Detection Policy Settings

Go to Azure MySQL Database -> it-dev-mydb101 -> Security -> Azure Defender for MySQL
Verify the settings

Step-08: Clean-Up

# Destroy Resources
terraform destroy -var-file="secrets.tfvars"

# Clean-Up
rm -rf .terraform*
rm -rf terraform.tfstate*

References

Terraform Input Variables

title: Terraform Input Variables with Structural Type tuple description: Learn about Terraform Input Variables with Structural Type tuple

Step-01: Introduction

Learn about Terraform Variables Structural Types
Structural types in Terraform allow multiple values of different types to be grouped together as a single value.
Using structural types requires a data schema to be defined for the Input Variables type so that Terraform knows what a valid value is.
Implement Input Variable Structural Type object
object(): A collection of values each with their own type.

# Sample Object
variable "os_configs" {
  type = object({
    location       = string
    size           = string
    instance_count = number
  })
}

tuple(): A sequence of values each with their own type.

# Sample tuple()
variable "tuple_sample" {
  type = tuple([string, number, bool])
}

Step-02: c2-variables.tf

We are going to enable Threat Detection Policy in Azure MySQL Database.
For that threat_detection_policy block we are going to implement the Input Variable Structural Type tuple()
Review documentation azurerm_mysql_server

# 12. Azure MySQL DB Threat Detection Policy (Variable Type: tuple)
variable "tdpolicy" {
    description = "Azure MySQL DB Threat Detection Policy"
    type = tuple([bool, number, bool, list(string)])
}

Step-03: Update Azure MySQL Server sku_name Tier

Threat Detection Policy is not supported for Basic Tier
We need to Update that to General Purpose Tier
c4-azure-mysql-database.tf

# Before
 sku_name   = "B_Gen5_2" # Basic Tier

# After
 sku_name = "GP_Gen5_2"   # General Purpose Tier

# Supported Values (as on today)
[B_Gen4_1 B_Gen4_2 B_Gen5_1 B_Gen5_2 GP_Gen4_2 GP_Gen4_4 GP_Gen4_8 GP_Gen4_16 GP_Gen4_32 GP_Gen5_2 GP_Gen5_4 GP_Gen5_8 GP_Gen5_16 GP_Gen5_32 GP_Gen5_64 MO_Gen5_2 MO_Gen5_4 MO_Gen5_8 MO_Gen5_16 MO_Gen5_32]

Step-04: Update terraform.tfvars

# DB Variables
db_name = "mydb101"
db_storage_mb = 5120
db_auto_grow_enabled = true
tdpolicy = [true, 10, true, [ "dkalyanreddy@gmail.com", "stacksimplify@gmail.com" ]]

Step-05: Add the Threat Detection Policy Block in c4-azure-mysql-database.tf

Refer both types below

# With Hard Coded Values
  threat_detection_policy {
    enabled = true
    retention_days = 10
    email_account_admins = true
    email_addresses = [ "dkalyanreddy@gmail.com", "stacksimplify@gmail.com" ]
  }  

# With Structural Type tuple() defined in Variables
  threat_detection_policy {
    enabled = var.tdpolicy[0]
    retention_days = var.tdpolicy[1]
    email_account_admins = var.tdpolicy[2]
    email_addresses = var.tdpolicy[3]
  }

Step-06: Execute Terraform Command

# Initialize Terraform
terraform init

# Validate Terraform configuration files
terraform validate

# Format Terraform configuration files
terraform fmt

# Review the terraform plan
terraform plan -var-file="secrets.tfvars"
Observation:
1. Review the values for Threat Detection Policy
2. All the values defined in "terraform.tfvars", tdpolicy variable should be replaced and shown in terraform execution plan. 

# Terraform Apply (Optional)
terraform apply -var-file="secrets.tfvars"

Step-07: Verify Azure MySQL DB Threat Detection Policy Settings

Go to Azure MySQL Database -> it-dev-mydb101 -> Security -> Azure Defender for MySQL
Verify the settings

Step-08: Clean-Up

# Destroy Resources
terraform destroy -var-file="secrets.tfvars"

# Clean-Up
rm -rf .terraform*
rm -rf terraform.tfstate*

References

Terraform Input Variables

title: Terraform Input Variables with Collection Type set description: Learn about Terraform Input Variables with Collection Type set

Step-01: Introduction

Implement Collection Type set
What is set ?

Usecase

We will implement 4 environments (dev, qa, staging and prod) using single set of templates
We will use for_each and set combination to do that.
For each environment, following Resources will be created with single set of Terraform Configs

Resource Group
Virtual Network
Subnet
Public IP & Public Azure DNS Name
Network Interface
RHEL Virtual machine
Provision sample webserver in that RHEL VM

Step-02: Implement complex type cosntructors like `list`

sets:

Sets do not support element ordering, meaning that traversing sets is not guaranteed to yield the same order each time and that their elements can not be accessed in a targeted way.

They contain unique elements repeated exactly once, and specifying the same element multiple times will result in them being coalesced with only one instance being present in the set.
Declaring a set is similar to declaring a list, the only difference being the type of the variable:

# 2. Environment Name
variable "environment" {
  description = "Environment Name"
  type = set(string)
  default = ["dev1", "qa1", "staging1", "prod1"]
}

Step-03: c2-variables.tf

Define the Input Variable Type set for environment.

# 2. Environment Name
variable "environment" {
  description = "Environment Name"
  type = set(string)
  default = ["dev1", "qa1", "staging1", "prod1"]
}

Step-04: terraform.tfvars

Core focus on variables will be on environment variable of type set
Rest variables are hard-coded in those respective resources.
Review environment variable in terraform.tfvars

business_unit = "it"
environment = ["dev2", "myqa2", "staging2", "prod2"]
resoure_group_name = "rg"

Step-05: c1-versions.tf

As we are going to create 4 environments, our Random String Resource also need to be traversed in for_each loop to create 4 random strings per environment
Create 4 Random Strings using for_each with set variable var.environment

# Random String Resource
resource "random_string" "myrandom" {
  for_each = var.environment
  length = 6
  upper = false 
  special = false
  number = false   
}

Step-06: c3-resource-group.tf

Create 4 Resource Groups using for_each with set variable var.environment

# Resource-1: Azure Resource Group
resource "azurerm_resource_group" "myrg" {
  for_each = var.environment
  name = "${var.business_unit}-${each.key}-${var.resoure_group_name}"
  location = var.resoure_group_location
}

Step-07: c4-virtual-network.tf - Virtual Network

Create 4 Virtual Networks using for_each with set variable var.environment
One Virtual Network will be created in each Resource Group

# Create Virtual Network
resource "azurerm_virtual_network" "myvnet" {
  for_each = var.environment
  name                = "${var.business_unit}-${each.key}-${var.virtual_network_name}"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.myrg[each.key].location
  resource_group_name = azurerm_resource_group.myrg[each.key].name
}

Step-08: c4-virtual-network.tf - Subnet

Create 4 Subnets using for_each with set variable var.environment
One Subnet will be created in each Virtual Network

# Create Subnet
resource "azurerm_subnet" "mysubnet" {
  for_each = var.environment
  #name                 = "mysubnet-1"
  name = "${var.business_unit}-${each.key}-${var.virtual_network_name}-mysubnet"
  resource_group_name  = azurerm_resource_group.myrg[each.key].name
  virtual_network_name = azurerm_virtual_network.myvnet[each.key].name
  address_prefixes     = ["10.0.2.0/24"]
}

Step-09: c4-virtual-network.tf - Public IP

Create 4 Public IPs using for_each with set variable var.environment
One Public IP will be created and associated to respective Network Interface in each Virtual Network

# Create Public IP Address
resource "azurerm_public_ip" "mypublicip" {
  for_each = var.environment
  #name                = "mypublicip-1"
  name = "${var.business_unit}-${each.key}-${var.virtual_network_name}-mypublicip"  
  resource_group_name = azurerm_resource_group.myrg[each.key].name
  location            = azurerm_resource_group.myrg[each.key].location
  allocation_method   = "Static"
  #domain_name_label = "app1-vm-${random_string.myrandom[each.key].id}"
   domain_name_label = "app1-vm-${each.key}-${random_string.myrandom[each.key].id}"
  tags = {
    environment = "Dev"
  }
}

Step-10: c4-virtual-network.tf - Network Interface

Create 4 Network Interfaces using for_each with set variable var.environment
One Network Interface will be created and associated to respective Virtual Machine in each Virtual Network

# Create Network Interface
resource "azurerm_network_interface" "myvmnic" {
  for_each = var.environment
  #name                = "vmnic"
  name = "${var.business_unit}-${each.key}-${var.virtual_network_name}-myvmnic"    
  location            = azurerm_resource_group.myrg[each.key].location
  resource_group_name = azurerm_resource_group.myrg[each.key].name

  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.mysubnet[each.key].id
    private_ip_address_allocation = "Dynamic"
    public_ip_address_id = azurerm_public_ip.mypublicip[each.key].id 
  }
}

Step-11: c5-linux-virtual-machine.tf - Linux Virutal Machine

Create 4 Virtual Machines using for_each with set variable var.environment
One Virtual Machine will be created in each Virtual Network and associated to respective Network Interface

# Resource: Azure Linux Virtual Machine
resource "azurerm_linux_virtual_machine" "mylinuxvm" {
  for_each = var.environment
  name                = "mylinuxvm-${each.key}"
  computer_name       = "devlinux-${each.key}" # Hostname of the VM
  resource_group_name = azurerm_resource_group.myrg[each.key].name
  location            = azurerm_resource_group.myrg[each.key].location
  size                = "Standard_DS1_v2"
  admin_username      = "azureuser"
  network_interface_ids = [azurerm_network_interface.myvmnic[each.key].id]
  admin_ssh_key {
    username   = "azureuser"
    public_key = file("${path.module}/ssh-keys/terraform-azure.pub")
  }
  os_disk {
    name = "osdisk${each.key}"
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
    #disk_size_gb = 20
  }
  source_image_reference {
    publisher = "RedHat"
    offer     = "RHEL"
    sku       = "83-gen2"
    version   = "latest"
  }
  custom_data = filebase64("${path.module}/app-scripts/app1-cloud-init.txt")
}

Step-12: Execute Terraform Commands

# Initialize Terraform
terraform init

# Validate Terraform configuration files
terraform validate

# Format Terraform configuration files
terraform fmt

# Review the terraform plan
terraform plan 

# Terraform Apply
terraform apply -auto-approve

# Observation
1. Verify 4 Random Resources created
2. Verify 4 Resource Groups created
3. Verify 4 Virtual Networks created
4. Verify 4 Subnets created
5. Verify 4 Network Interfaces created
6. Verify 4 Virtual Machines created
7. Verify 4 public ips created
8. Verify Disks for Virtual Machines - 4 osdisk created

# Access Sample App
## Root Context
http://app1-vm-dev2-yjedfa.eastus.cloudapp.azure.com
http://app1-vm-myqa2-ysutkd.eastus.cloudapp.azure.com
http://app1-vm-prod2-qoaqpq.eastus.cloudapp.azure.com
http://app1-vm-staging2-pcyeuc.eastus.cloudapp.azure.com

## App1 Context
http://app1-vm-dev2-yjedfa.eastus.cloudapp.azure.com/app1/index.html
http://app1-vm-myqa2-ysutkd.eastus.cloudapp.azure.com/app1/index.html
http://app1-vm-prod2-qoaqpq.eastus.cloudapp.azure.com/app1/index.html
http://app1-vm-staging2-pcyeuc.eastus.cloudapp.azure.com/app1/index.html

## metadata.html
http://app1-vm-dev2-yjedfa.eastus.cloudapp.azure.com/app1/metadata.html
http://app1-vm-myqa2-ysutkd.eastus.cloudapp.azure.com/app1/metadata.html
http://app1-vm-prod2-qoaqpq.eastus.cloudapp.azure.com/app1/metadata.html
http://app1-vm-staging2-pcyeuc.eastus.cloudapp.azure.com/app1/metadata.html

Step-10: Clean-Up

# Destroy Resources
terraform destroy -auto-approve

# Delete Files
rm -rf .terraform* 
rm -rf terraform.tfstate*

References

Terraform Input Variables

title: Terraform Output Values Basics description: Learn about Terraform Output Values - Basics

Step-01: Introduction

Understand about Output Values and implement them
Query outputs using terraform output
Understand about redacting secure attributes in output values
Generate machine-readable output
You can export both Argument & Attribute References
Redact the sensitive outputs using sensitve = true in output block

Step-02: c1-versions.tf

# Terraform Block
terraform {
  required_version = ">= 1.0.0"
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = ">= 2.0" 
    }
  }
}

# Provider Block
provider "azurerm" {
 features {}          
}

Step-03: c2-variables.tf

# Input Variables

# 1. Business Unit Name
variable "business_unit" {
  description = "Business Unit Name"
  type = string
  default = "hr"
}
# 2. Environment Name
variable "environment" {
  description = "Environment Name"
  type = string
  default = "poc"
}
# 3. Resource Group Name
variable "resoure_group_name" {
  description = "Resource Group Name"
  type = string
  default = "myrg"
}
# 4. Resource Group Location
variable "resoure_group_location" {
  description = "Resource Group Location"
  type = string
  default = "East US"
}

# 5. Virtual Network Name
variable "virtual_network_name" {
  description = "Virtual Network Name"
  type = string 
  default = "myvnet"
}

Step-04: c3-resource-group.tf

# Resource-1: Azure Resource Group
resource "azurerm_resource_group" "myrg" {
  name = "${var.business_unit}-${var.environment}-${var.resoure_group_name}"
  location = var.resoure_group_location
}

Step-05: c4-virtual-network.tf

# Create Virtual Network
resource "azurerm_virtual_network" "myvnet" {
  name                = "${var.business_unit}-${var.environment}-${var.virtual_network_name}"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name
}

Step-06: terraform.tfvars

business_unit = "it"
environment = "dev"
resoure_group_name = "rg"
virtual_network_name = "vnet"

Step-07: c5-outputs.tf

# 1. Output Values - Resource Group
output "resource_group_id" {
  description = "Resource Group ID"
  # Atrribute Reference
  value = azurerm_resource_group.myrg.id 
}
output "resource_group_name" {
  description = "Resource Group name"
  # Argument Reference
  value = azurerm_resource_group.myrg.name  
}

# 2. Output Values - Virtual Network
output "virtual_network_name" {
  description = "Virutal Network Name"
  value = azurerm_virtual_network.myvnet.name 
}

Step-06: Execute Terraform Commands

# Initialize Terraform
terraform init

# Validate Terraform configuration files
terraform validate

# Format Terraform configuration files
terraform fmt

# Review the terraform plan
terraform plan 

# Create Resources
terraform apply -auto-approve

# Observation
1. Review the outputs in CLI Output

Step-07: Query Terraform Outputs

Terraform will load the project state in state file, so that using terraform output command we can query the state file.

# Terraform Output Commands
terraform output
terraform output resource_group_id
terraform output virtual_network_name

Step-08: Output Values - Suppressing Sensitive Values in Output

We can redact the sensitive outputs using sensitve = true in output block
This will only redact the cli output for terraform plan and apply
When you query using terraform output, you will be able to fetch exact values from terraform.tfstate files
Add sensitve = true for output virtual_network_name

# 2. Output Values - Virtual Network
output "virtual_network_name" {
  description = "Virutal Network Name"
  value = azurerm_virtual_network.myvnet.name 
  sensitive = true
}

Test the flow

# Terraform Apply
terraform apply -auto-approve
Observation: 
1. You should see the value as sensitive

# Query using terraform output
terraform output virtual_network_name
Observation: 
1. You should get non-redacted original value from terraform.tfstate file

Step-09: Generate machine-readable output

# Generate machine-readable output
terraform output -json

Step-10: Destroy Resources

# Destroy Resources
terraform destroy -auto-approve

# Clean-Up
rm -rf .terraform*
rm -rf terraform.tfstate*

# Comment sensitive=true
In c5-outputs.tf, roll back "sensitive=true"

References

Terraform Output Values--- title: Terraform Output Values with Splat Expression description: Learn about Terraform Output Values with Splat Expression

Step-01: Introduction

Understand how to define outputs when we are using the Meta-Argument count
What is Splat Expression ?
Why do we ned to use in outputs when we use count ?
Splat Expression: A splat expression provides a more concise way to express a common operation that could otherwise be performed with a for expression.
The special [*] symbol iterates over all of the elements of the list given to its left and accesses from each one the attribute name given on its right.

# With for expression
[for o in var.list : o.id]

# With Splat Expression [*]
var.list[*].id

Step-02: c4-virtual-networ.tf

Add Resource Meta-Argument count to azurerm_virtual_network resource

# Create Virtual Network
resource "azurerm_virtual_network" "myvnet" {
  count = 4
  name                = "${var.business_unit}-${var.environment}-${var.virtual_network_name}-${count.index}"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name
}

Step-03: Execute Terraform Commands

# Initialize Terraform
terraform init

# Validate Terraform configuration files
terraform validate

# Observation
1. It should fail

# Sample Output
Kalyans-MacBook-Pro:terraform-manifests kdaida$ terraform validate
╷
│ Error: Missing resource instance key
│ 
│   on c5-outputs.tf line 16, in output "virtual_network_name":
│   16:   value = azurerm_virtual_network.myvnet.name 
│ 
│ Because azurerm_virtual_network.myvnet has "count" set, its attributes must be
│ accessed on specific instances.
│ 
│ For example, to correlate with indices of a referring resource, use:
│     azurerm_virtual_network.myvnet[count.index]
Kalyans-MacBook-Pro:terraform-manifests kdaida$

Step-04: c5-outputs.tf

Update Splat Expression for output named virtual_network_name

# 2. Output Values - Virtual Network
output "virtual_network_name" {
  description = "Virutal Network Name"
  value = azurerm_virtual_network.myvnet[*].name 
}

Step-06: Execute Terraform Commands

# Validate Terraform configuration files
terraform validate
Observation: Should passs

# Format Terraform configuration files
terraform fmt

# Review the terraform plan
terraform plan 
Observation: should pass

# Sample Output
Plan: 5 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + resource_group_id    = (known after apply)
  + resource_group_name  = "it-dev-rg"
  + virtual_network_name = [
      + "it-dev-vnet-0",
      + "it-dev-vnet-1",
      + "it-dev-vnet-2",
      + "it-dev-vnet-3",
    ]



# Create Resources (Optional)
terraform apply -auto-approve

# Observation
1. Should get all the virtual network names as a list

Step-07: Destroy Resources

# Destroy Resources
terraform destroy -auto-approve

# Clean-Up
rm -rf .terraform*
rm -rf terraform.tfstate*

References

Terraform Output Values--- title: Terraform Output Values with for_each and for loop description: Learn about Terraform Output Values for_each and for loop

Step-01: Introduction

We are going to define output values of a resource when we use the Resource Meta-Argument for_each
Splat Expression is not going to work for this.
Resources that use the for_each argument will appear in expressions as a map of objects, so you can't use splat expressions with those resources.
We need to use regular for loop in output values to get the values of a specific attribute or argument from a Resource in Outputs.
Terraform For expression
Terraform Keys Function
Terraform Values Function

Step-02: c2-variables.tf

Update environment variable to Variable Type set

# 2. Environment Name
variable "environment" {
  description = "Environment Name"
  type = set(string)
  default = ["dev1", "qa1", "staging1", "prod1" ]
}

Step-03: terraform.tfvars

Update the values for variable environment

business_unit = "it"
environment =  ["dev2", "qa2", "staging2", "prod2" ]
resoure_group_name = "rg"
virtual_network_name = "vnet"

Step-04: c4-virtual-network.tf

Convert the existing vnet resource with for_each

# Create Virtual Network
resource "azurerm_virtual_network" "myvnet" {
  for_each = var.environment
  name                = "${var.business_unit}-${each.key}-${var.virtual_network_name}"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name
}

Step-05: c5-outputs.tf

Test using splat expression in output values (same as we used for count)

# 2. Output Values - Virtual Network
output "virtual_network_name" {
  description = "Virutal Network Name"
  value = azurerm_virtual_network.myvnet[*].name 
  #sensitive = true
}

# Initialize Terraform
terraform init

# Validate Terraform configuration files
terraform validate

# Review the terraform plan
terraform plan 
Observation: Should fail

# Sample Ouput
Kalyans-MacBook-Pro:terraform-manifests kdaida$ terraform plan
╷
│ Error: Unsupported attribute
│ 
│   on c5-outputs.tf line 18, in output "virtual_network_name":
│   18:   value = azurerm_virtual_network.myvnet[*].name 
│ 
│ This object does not have an attribute named "name".
╵
Kalyans-MacBook-Pro:terraform-manifests kdaida$

Step-06: c5-outputs.tf

Implement for loop

For Loop One Input and List Output with VNET Name
For Loop Two Inputs, List Output which is Iterator i (var.environment)
For Loop One Input and Map Output with VNET ID and VNET Name
For Loop Two Inputs and Map Output with Iterator env and VNET Name
Terraform keys() function
Terraform values() function

# Output - For Loop One Input and List Output with VNET Name 
output "virtual_network_name_list_one_input" {
  description = "Virutal Network Name"
  value = [ for vnet in azurerm_virtual_network.myvnet: vnet.name]
}

# Output - For Loop Two Inputs, List Output which is Iterator i (var.environment)
output "virtual_network_name_list_two_inputs" {
  description = "Virutal Network Name"
  #value = [ for i, vnet in azurerm_virtual_network.myvnet: i]
  value = [ for env, vnet in azurerm_virtual_network.myvnet: env]
}

# Output - For Loop One Input and Map Output with VNET ID and VNET Name
output "virtual_network_name_map_one_input" {
  description = "Virutal Network Name"
  value = {for vnet in azurerm_virtual_network.myvnet: vnet.id => vnet.name}
}

# Output - For Loop Two Inputs and Map Output with Iterator env and VNET Name
output "virtual_network_name_map_two_inputs" {
  description = "Virutal Network Name"
  value = {for env, vnet in azurerm_virtual_network.myvnet: env => vnet.name}
}

# Terraform keys() function: keys takes a map and returns a list containing the keys from that map.
output "virtual_network_name_keys_function" {
  description = "Virutal Network Name - keys() Function Explore"
  value = keys({for vnet in azurerm_virtual_network.myvnet: vnet.id => vnet.name})
}

# Terraform values() function: values takes a map and returns a list containing the values of the elements in that map.
output "virtual_network_name_values_function" {
  description = "Virutal Network Name - values() Function Explore"
  value = values({for vnet in azurerm_virtual_network.myvnet: vnet.id => vnet.name})
}

Step-07: Execute Terraform Commands

# Initialize Terraform
terraform init

# Validate Terraform configuration files
terraform validate

# Review the terraform plan
terraform plan 
Observation:
1. Command should successfully generate the terraform plan

# Sample Output
Changes to Outputs:
  + resource_group_id    = (known after apply)
  + resource_group_name  = "myrg1-demo"
  + virtual_network_name = [
      + "it-dev2-vnet",
      + "it-prod2-vnet",
      + "it-qa2-vnet",
      + "it-staging2-vnet",
    ]

# Create Resources (Optional)
terraform apply -auto-approve

Step-08: Destroy Resources

# Destroy Resources
terraform destroy -auto-approve

# Clean-Up
rm -rf .terraform*
rm -rf terraform.tfstate*

References

Terraform Output Values--- title: Terraform Local Values description: Learn about Terraform Local Values

Step-01: Introduction

Understand DRY Principle
What is local value in terraform?
When To Use Local Values?
What is the problem locals are solving ?

What is DRY Principle ?
Don't repeat yourself

What is local value in terraform?
The local block defines one or more local variables within a module. 
A local value assigns a name to an terraform expression, allowing it to be used multiple times within a module without repeating it.

When To Use Local Values?
Local values can be helpful to avoid repeating the same values or expressions multiple times in a configuration
If overused they can also make a configuration hard to read by future maintainers by hiding the actual values used.
Use local values only in moderation, in situations where a single value or result is used in many places and that value is likely to be changed in future. The ability to easily change the value in a central place is the key advantage of local values.

What is the problem locals are solving ?
Currently terraform doesn’t allow variable substitution within variables. The terraform way of doing this is by using local values or locals where you can somehow keep your code DRY.

Another use case (at least for me) for locals is to shorten references on upstream terraform projects as seen below. This will make your terraform templates/modules more readable.

We can define as many local blocks as required in that respective Module.  The names given for the items in the local block must be unique throughout a module.

Step-02: c1-versions.tf

# Terraform Block
terraform {
  required_version = ">= 0.15"
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = ">= 2.0" 
    }
  }
}
# Provider Block
provider "azurerm" {
 features {}          
}

Step-03: c2-variables.tf

# Input Variables

# 1. Business Unit Name
variable "business_unit" {
  description = "Business Unit Name"
  type = string
  default = "hr"
}
# 2. Environment Name
variable "environment" {
  description = "Environment Name"
  type = string
  default = "dev"
}
# 3. Resource Group Name
variable "resoure_group_name" {
  description = "Resource Group Name"
  type = string
  default = "myrg"
}
# 4. Resource Group Location
variable "resoure_group_location" {
  description = "Resource Group Location"
  type = string
  default = "East US"
}
# 5. Virtual Network Name
variable "virtual_network_name" {
  description = "Virtual Network Name"
  type = string 
  default = "myvnet"
}

Step-04: c3-local-values.tf

# Local Values Block

locals {
  # Use-case-1: Shorten the names for more readability
  rg_name = "${var.business_unit}-${var.environment}-${var.resoure_group_name}"
  vnet_name = "${var.business_unit}-${var.environment}-${var.virtual_network_name}"

  # Use-case-2: Common tags to be assigned to all resources
  service_name = "Demo Services"
  owner = "Kalyan Reddy"
  common_tags = {
    Service = local.service_name
    Owner   = local.owner
  }

  # Use-case-3: Terraform Dynamic or Conditional Expressions
  # We will learn this when we are dealing with Dynamic Expressions
  # The expressions assigned to local value names can either be simple constants or can be more complex expressions that transform or combine values from elsewhere in the module.
}

Step-05: c4-resource-group.tf

# Resource-1: Azure Resource Group
resource "azurerm_resource_group" "myrg" {
  #name = "${var.business_unit}-${var.environment}-${var.resoure_group_name}"
  name = local.rg_name
  location = var.resoure_group_location
  tags = local.common_tags
}

Step-06: c5-virtual-network.tf

# Create Virtual Network
resource "azurerm_virtual_network" "myvnet" {
  #name                = "${var.business_unit}-${var.environment}-${var.virtual_network_name}"
  name                = local.vnet_name
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name
  tags = local.common_tags
}

Step-07: Execute Terraform Commands

# Initialize Terraform
terraform init

# Validate Terraform configuration files
terraform validate

# Format Terraform configuration files
terraform fmt

# Review the terraform plan
terraform plan 
Observation: 
1. Verify Resource Group Name
2. Verify Virtual Network Name
3. Verify Common Tags for Resource Group and Virtual Network.

# Create Resources (Optional)
terraform apply -auto-approve
Observation: Review the below directly in Azure Management Console
1. Verify Resource Group Name
2. Verify Virtual Network Name
3. Verify Common Tags for Resource Group and Virtual Network.

Step-08: Clean-Up

# Destroy Resources
terraform destroy -auto-approve

# Delete files
rm -rf .terraform*
rm -rf terraform.tfstate*

References

Terraform Local values--- title: Terraform Conditional Expressions description: Learn about Terraform Conditional Expressions

Step-01: Introduction

Learn Terraform Conditional Expressions in Terraform
Conditional Expression: A conditional expression uses the value of a bool expression to select one of two values.

# Example-1
condition ? true_val : false_val

# Example-2
var.a != "" ? var.a : "default-a"

Step-02: c2-variables.tf

In extension to previous section Terraform Local Values, we have added Conditional Expressions in local values block.
As part of that we have added two more variables in c2-variables.tf for this demo

# 6. Virtual Network Address - Dev
variable "vnet_address_space_dev" {
  description = "Virtual Network Address Space for Dev Environment"
  type = list(string)
  default = ["10.0.0.0/16"]
}

# 7. Virtual Network Address - 
variable "vnet_address_space_all" {
  description = "Virtual Network Address Space for All Environment except Dev"
  type = list(string)
  default = ["10.1.0.0/16", "10.2.0.0/16", "10.3.0.0/16"]
}

Step-03: c3-local-values.tf

In extension to previous section Terraform Local Values, we have added Conditional Expressions in local values block.

# Local Values Block

locals {
  # Use-case-1: Shorten the names for more readability
  rg_name = "${var.business_unit}-${var.environment}-${var.resoure_group_name}"
  vnet_name = "${var.business_unit}-${var.environment}-${var.virtual_network_name}"

  # Use-case-2: Common tags to be assigned to all resources
  service_name = "Demo Services"
  owner = "Kalyan Reddy Daida"
  common_tags = {
    Service = local.service_name
    Owner   = local.owner
  }

  # Use-case-3: Terraform Conditional Expressions
  # We will learn this when we are dealing with Conditional Expressions
  # The expressions assigned to local value names can either be simple constants or can be more complex expressions that transform or combine values from elsewhere in the module.
  # With Equals (==)
  vnet_address_space = (var.environment == "dev" ? var.vnet_address_space_dev : var.vnet_address_space_all)
  # With Not Equals (!=)
  #vnet_address_space = (var.environment != "dev" ? var.vnet_address_space_all : var.vnet_address_space_dev)
}

Step-04: c5-virtual-network.tf

Reference address_space argument with local value.

# Create Virtual Network
resource "azurerm_virtual_network" "myvnet" {
  #name                = "${var.business_unit}-${var.environment}-${var.virtual_network_name}"
  name                = local.vnet_name
  #address_space       = ["10.0.0.0/16"]
  address_space       = local.vnet_address_space
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name
  tags = local.common_tags
}

Step-05: Execute Terraform Commands

# Terraform Initialize
terraform init

# Terraform Validate
terraform validate

# Terraform Plan: When Variable values, environment = dev 
terraform plan
Observation: 
1) Plan will generate vnet `address_space` with 1 value


# Terraform Plan: When Variable values, environment = qa
terraform plan
1) Plan will generate vnet `address_space` with 3 values


# Terraform Apply (Optional)
terraform apply -auto-approve

Step-06: c5-virtual-network.tf

Understand and implement Terraform Conditional Expressions in Resources

# Create Virtual Network - Conditional Expressions in a Resource Demo
resource "azurerm_virtual_network" "myvnet2" {
  #count = 2
  count = var.environment == "dev" ? 1 : 5
  name                = "${var.business_unit}-${var.environment}-${var.virtual_network_name}-${count.index}"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name
  tags = local.common_tags
}

# Terraform Plan: When Variable values, environment = dev 
terraform plan
Observation: 
1) Plan will generate with 1 Virtual Network for  azurerm_virtual_network.myvnet2 Resource

# Terraform Plan: When Variable values, environment = qa 
terraform plan
Observation: 
1) Plan will generate with 5 Virtual Network for  azurerm_virtual_network.myvnet2 Resource

Step-07: Clean-Up

# Terraform Destroy
terraform destroy -auto-approve

# Clean-Up
rm -rf .terraform*
rm -rf terraform.tfstate*

# Uncomment and Comment right values in c2-variables.tf (Roll back to put ready for student demo)
- For "environment" Variable, enable default = "dev"

title: Terraform Datasources description: Learn about Terraform Datasources

Step-01: Introduction

Understand about Datasources in Terraform
Implement a sample usecase with Datasources.

Step-02: c6-datasource-resource-group.tf

# Datasources
data "azurerm_resource_group" "rgds" {
  depends_on = [ azurerm_resource_group.myrg ]
  name = local.rg_name 
}

## TEST DATASOURCES using OUTPUTS
# 1. Resource Group Name from Datasource
output "ds_rg_name" {
  value = data.azurerm_resource_group.rgds.name
}

# 2. Resource Group Location from Datasource
output "ds_rg_location" {
  value = data.azurerm_resource_group.rgds.location
}

# 3. Resource Group ID from Datasource
output "ds_rg_id" {
  value = data.azurerm_resource_group.rgds.id
}

Step-03: c7-datasource-virtual-network.tf

# Datasources
data "azurerm_virtual_network" "vnetds" {
  depends_on = [ azurerm_virtual_network.myvnet ]
  name = local.vnet_name
  resource_group_name = local.rg_name
}

## TEST DATASOURCES using OUTPUTS
# 1. Virtual Network Name from Datasource
output "ds_vnet_name" {
  value = data.azurerm_virtual_network.vnetds.name 
}

# 2. Virtual Network ID from Datasource
output "ds_vnet_id" {
  value = data.azurerm_virtual_network.vnetds.id 
}

# 3. Virtual Network address_space from Datasource
output "ds_vnet_address_space" {
  value = data.azurerm_virtual_network.vnetds.address_space
}

Step-04: c8-datasource-subscription.tf

# Datasources
# https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/subscription
data "azurerm_subscription" "current" {
}

## TEST DATASOURCES using OUTPUTS
# 1. My Current Subscription Display Name
output "current_subscription_display_name" {
  value = data.azurerm_subscription.current.display_name
}

# 2. My Current Subscription Id
output "current_subscription_id" {
  value = data.azurerm_subscription.current.subscription_id
}

# 3. My Current Subscription Spending Limit
output "current_subscription_spending_limit" {
  value = data.azurerm_subscription.current.spending_limit
}

Step-05: Execute Terraform Commands

# Initialize Terraform
terraform init

# Validate Terraform configuration files
terraform validate

# Format Terraform configuration files
terraform fmt

# Review the terraform plan
terraform plan 
Observation: 
1. Verify the Resource Group Datasource Outputs
2. Verify the Virtual Network Datasource Outputs
3. Verify the Subscription Datasource Outputs

# Create Resources (Optional)
terraform apply -auto-approve

Step-06: c9-datasource-resource-group-existing.tf

Create a Resource group named dsdemo in Azure using Azure Managment Console
Using Datasources TF Config listed below try and access the information
Uncomment the contents in this file c9-datasource-resource-group-existing.tf during this step execution.

# Datasources
# https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/resource_group
data "azurerm_resource_group" "rgds1" {
  name = "dsdemo"
}

## TEST DATASOURCES using OUTPUTS
# 1. Resource Group Name from Datasource
output "ds_rg_name1" {
  value = data.azurerm_resource_group.rgds1.name
}

# 2. Resource Group Location from Datasource
output "ds_rg_location1" {
  value = data.azurerm_resource_group.rgds1.location
}

# 3. Resource Group ID from Datasource
output "ds_rg_id1" {
  value = data.azurerm_resource_group.rgds1.id
}

Step-07: Execute Terraform Commands

# Terraform Plan
terraform plan

# Observation
1. You should get the "dsdemo" resource group created on Azure Portal manually in outputs. 

# Comment Content in c9-datasource-resource-group-existing.tf
Comment the contents in this file `c9-datasource-resource-group-existing.tf` after the above steps execution.

Step-08: Clean-Up

# Destroy Resources
terraform destroy -auto-approve

# Delete Files
rm -rf .terraform*
rm -rf terraform.tfstate*

References

Terraform Datasource

title: Terraform Remote State Storage & Locking description: Learn about Terraform Remote State Storage & Locking

Step-01: Introduction

Understand Terraform Backends
Understand about Remote State Storage and its advantages
This state is stored by default in a local file named terraform.tfstate, but it can also be stored remotely, which works better in a team environment.
Create Azure Storage Account to store terraform.tfstate file and enable backend configurations in terraform settings block

Step-02: Create Azure Storage Account

Step-02-01: Create Resource Group

Go to Resource Groups -> Add
Resource Group: terraform-storage-rg
Region: East US
Click on Review + Create
Click on Create

Step-02-02: Create Azure Storage Account

Go to Storage Accounts -> Add
Resource Group: terraform-storage-rg
Storage Account Name: terraformstate201 (THIS NAME SHOULD BE UNIQUE ACROSS AZURE CLOUD)
Region: East US
Performance: Standard
Redundancy: Geo-Redundant Storage (GRS)
In Data Protection, check the option Enable versioning for blobs
REST ALL leave to defaults
Click on Review + Create
Click on Create

Step-02-03: Create Container in Azure Storage Account

Go to Storage Account -> terraformstate201 -> Containers -> +Container
Name: tfstatefiles
Public Access Level: Private (no anonymous access)
Click on Create

Step-03: Terraform Backend Configuration

Reference Sub-folder: terraform-manifests
Terraform Backend as Azure Storage Account
Add the below listed Terraform backend block in Terrafrom Settings block in c1-versions.tf

# Terraform State Storage to Azure Storage Container
  backend "azurerm" {
    resource_group_name   = "terraform-storage-rg"
    storage_account_name  = "terraformstate201"
    container_name        = "tfstatefiles"
    key                   = "terraform.tfstate"
  }

Step-04: Review Terraform Configuration Files

c1-versions.tf
c2-variables.tf
c3-locals.tf
c4-resource-group.tf
c5-virtual-network.tf
c6-linux-virtual-machine.tf
c7-outputs.tf
terraform.tfvars

Step-05: Test with Remote State Storage Backend

# Initialize Terraform
terraform init
Observation: 
1. Review below message
2. Verify the Azure Storage Account and you should see terraform.tfstate file created
## Sample CLI Output
Initializing the backend...
Successfully configured the backend "azurerm"! Terraform will automatically
use this backend unless the backend configuration changes.

# Validate Terraform configuration files
terraform validate

# Review the terraform plan
terraform plan 
Observation:
1. Acquiring state lock. This may take a few moments...

# Create Resources 
terraform apply -auto-approve

# Verify Azure Storage Account for terraform.tfstate file
Observation: 
1. Finally at this point you should see the terraform.tfstate file in Azure Storage Account. 

# Access Application
http://<Public-IP>

Step-05: Storage Account Container Versioning Test

Update in c3-locals.tf
Uncomment Demo tag

  common_tags = {
    Service = local.service_name
    Owner   = local.owner
    Tag = "demo-tag1"  # Uncomment during step-05
  }

Execute Terraform Commands

# Review the terraform plan
terraform plan 

# Create Resources 
terraform apply -auto-approve

# Verify terraform.tfstate file in Azure Storage Account
Observation: 
1. New version of terraform.tfstate file will be created
2. Understand about Terraform State Locking 
3. terraform.tfsate file should be in "leased" state which means no one can apply changes using terraform to Azure Resources.
4. Once the changes are completed "terraform apply", Lease State should be in "Available" state.

Step-06: Destroy Resources

Destroy Resources and Verify Storage Account terraform.tfsate file Versioning

# Destroy Resources
terraform destroy -auto-approve

# Delete Files
rm -rf .terraform*

# c3-locals.tf - Comment demo tag for students seamless demo
  common_tags = {
    Service = local.service_name
    Owner   = local.owner
    #Tag = "demo-tag1"  
  }

References

Terraform Backends
Terraform State Storage
Terraform State Locking
Remote Backends - Enhanced--- title: Terraform Remote State Datasource description: Learn about Terraform Remote State Datasource

Step-01: Introduction

Understand about Terraform Remote State Datasource
Terraform Remote State Storage Demo with two projects

Step-02: Project-1: Create / Review Terraform Configs

c1-versions.tf
c2-variables.tf
c3-locals.tf
c4-resource-group.tf
c5-virtual-network.tf
c6-outputs.tf
terraform.tfvars

Step-03: Porject-1: Execute Terraform Commands

# Change Directory 
cd project-1-network

# Terraform Initialize
terraform init

# Terraform Validate
terraform validate

# Terraform Plan
terraform plan

# Terraform Apply
terraform apply -auto-approve

# Observation
1. Verify Resource Group 
2. Verify Virtual Network
3. Verify Virtual Network Subnet 
4. Verify Public IP
5. Verify Network Interface
6. Verify Storage Account - TFState file

Step-04: Project-2: Create / Review Terraform Configs

c0-terraform-remote-state-datasource.tf
c1-versions.tf
c2-variables.tf
c3-locals.tf
c4-linux-virtual-machine.tf
c5-outputs.tf
terraform.tfvars

Step-05: Project-2: c0-terraform-remote-state-datasource.tf

Understand in depth about Terraform Remote State Datasource

# Terraform Remote State Datasource
data "terraform_remote_state" "project1" {
  backend = "azurerm"
  config = {
    resource_group_name   = "terraform-storage-rg"
    storage_account_name  = "terraformstate201"
    container_name        = "tfstatefiles"
    key                   = "network-terraform.tfstate"
  }
}

/*
1. Resource Group Name
data.terraform_remote_state.project1.outputs.resource_group_name
2. Resource Group Location
data.terraform_remote_state.project1.outputs.resource_group_location
3. Network Interface ID
data.terraform_remote_state.project1.outputs.network_interface_id
*/

Step-06: Project-2: c4-linux-virtual-machine.tf

Understand the core changes in Virtual Machine Resource with Terraform Remote State Datasource

# Before (Using Single Project)
  resource_group_name = azurerm_resource_group.myrg.name
  location            = azurerm_resource_group.myrg.location
  network_interface_ids = [azurerm_network_interface.myvmnic.id]
  
# After (Using Two Projects and with Terraform Remote State Datasource)  
  # Getting Data using Terraform Remote State Datasource from Project-1
  resource_group_name = data.terraform_remote_state.project1.outputs.resource_group_name
  location = data.terraform_remote_state.project1.outputs.resource_group_location
  network_interface_ids = [data.terraform_remote_state.project1.outputs.network_interface_id]

Step-07: Project-2: Execute Terraform Commands

# Change Directory 
cd project-2-app1

# Terraform Initialize
terraform init

# Terraform Validate
terraform validate

# Terraform Plan
terraform plan

# Terraform Apply
terraform apply -auto-approve

# Observation
1. Verify Resource Group 
2. Verify Virtual Network
3. Verify Virtual Network Subnet 
4. Verify Public IP
5. Verify Network Interface
6. Verify Virtual Machine Resource (Location it created, Network Interface it used)
7. Verify Storage Account - TFState file

Step-08: Project-2: Clean-Up

# Change Directory 
cd project-2-app1

# Destroy Resources
terraform destroy -auto-approve

# Delete Files
rm -rf .terraform*

Step-09: Project-1: Clean-Up

# Change Directory 
cd project-1-network

# Destroy Resources
terraform destroy -auto-approve

# Delete Files
rm -rf .terraform*

title: Terraform State Commands description: Master Terraform State Commands

Step-00: Introduction

Terraform Commands

terraform show
terraform state
terraform force-unlock
terraform taint
terraform untaint
terraform apply -target command

Step-01: Review Terraform Configs

c1-versions.tf
c2-variables.tf
c3-local-values.tf
c4-resource-group.tf
c5-virtual-network.tf
c6-datasouce-subscription.tf

Step-02: Update the Terraform Backend Key

Update Terraform Backend Key
c1-versions.tf

# Terraform State Storage to Azure Storage Container
  backend "azurerm" {
    resource_group_name   = "terraform-storage-rg"
    storage_account_name  = "terraformstate201"
    container_name        = "tfstatefiles"
    key                   = "state-commands-demo1.tfstate"
  }

Step-03: Terraform Show Command to review Terraform plan files

The terraform show command is used to provide human-readable output from a state or plan file.
This can be used to inspect a plan to ensure that the planned operations are expected, or to inspect the current state as
Terraform plan output files are binary files. We can read them using terraform show command

# Initialize Terraform
terraform init

# Terraform Validate
terraform validate

# Create Plan 
terraform plan
terraform plan -out=v1plan.out

# Read the plan 
terraform show v1plan.out
terraform show  # Nothing as terraform.tfstate file not created yet

# Read the plan in json format (Unformatted / Not Readable)
terraform show -json v1plan.out 

# Install jq (for mac and fine tuned json output)
brew install jq
terraform show -json v1plan.out | jq

Step-04: Terraform Show command to Read State files

By default, in the working directory if we have terraform.tfstate file, when we provide the command terraform show it will read the state file automatically and display output.

# Terraform Show
terraform show
Observation: 
1. Ideally for AWS provider we get the message as "It should say "No State" because we will still didnt create any resources yet and no state file in current working directory"
2. For Azure Provider, empty response is coming. 

# Create Resources
#terraform apply -auto-approve
terraform apply v1plan.out

# Terraform Show 
terraform show
Observation: It should display the state file

Step-05: Terraform State Command

Step-05-01: Terraform State List and Show commands

These two commands comes under Terraform Inspecting State
terraform state list: This command is used to list resources within a Terraform state.
terraform state show: This command is used to show the attributes of a single resource in the Terraform state.

# List Resources from Terraform State
terraform state list

# Show the attributes of a single resource from Terraform State
terraform state show data.azurerm_resource_group.rgds
terraform state show data.azurerm_subscription.current
terraform state show azurerm_virtual_network.myvnet

Step-05-02: Terraform State mv command

This commands comes under Terraform Moving Resources
This command will move an item matched by the address given to the destination address.
This command can also move to a destination address in a completely different state file
Very dangerous command
Very advanced usage command
Results will be unpredictable if concept is not clear about terraform state files mainly desired state and current state.
Try this in production environments, only when everything worked well in lower environments.

# Terraform List Resources
terraform state list

# Terraform State Move Resources to different name
terraform state mv -dry-run azurerm_virtual_network.myvnet azurerm_virtual_network.myvnet-new
terraform state mv azurerm_virtual_network.myvnet azurerm_virtual_network.myvnet-new
terraform state list
ls -lrta # To verify state file backup


Observation: 
1) It renamed the name of "myvnet" in state file to "myvnet-new". 
2) Run terraform plan and observe what happens in next run of terraform plan and apply
-----------------------------
# WRONG APPROACH 
-----------------------------
# WRONG APPROACH OF MOVING TO TERRAFORM PLAN AND APPLY AFTER ABOVE CHANGE terraform state mv CHANGE
# WE NEED TO UPDATE EQUIVALENT RESOURCE in terraform manifests FIRST to match the same new name. 

# Terraform Plan
terraform plan
Observation: It will show "Plan: 1 to add, 0 to change, 1 to destroy."
1 to add: New VNET will be added
1 to destroy: Old VNET will be destroyed

 # azurerm_virtual_network.myvnet will be created
  + resource "azurerm_virtual_network" "myvnet" {

 # azurerm_virtual_network.myvnet-new will be destroyed
  - resource "azurerm_virtual_network" "myvnet-new" {


DON'T DO TERRAFORM APPLY because it shows make changes. Nothing changed other than state file local naming of a resource. Ideally nothing on current state (real cloud environment should not change due to this)
-----------------------------

Now run terraform plan and you should see no changes to Infra

# Terraform Plan
terraform plan
Observation: 
1) Message-1: No changes. Infrastructure is up-to-date
2) Message-2: This means that Terraform did not detect any differences between your TF configuration and real physical resources that exist. As a result, no actions need to be performed.
# Sample Message: 
Your configuration already matches the changes detected above. If you'd like to update the
Terraform state to match, create and apply a refresh-only plan:
  terraform apply -refresh-only

# Terraform Apply (refresh-only)
terraform apply -refresh-only

Step-05-03: Terraform State rm command

This commands comes under Terraform Moving Resources Section
The terraform state rm command is used to remove items from the Terraform state.
This command can remove single resources, single instances of a resource, entire modules, and more.

# Terraform List Resources
terraform state list

# Remove Resources from Terraform State
terraform state rm -dry-run azurerm_virtual_network.myvnet-new
terraform state rm azurerm_virtual_network.myvnet-new
Observation: 
1) Removes it from terraform.tfstate file

# Terraform Plan
terraform plan
Observation: It will tell you that resource is not in state file but same is present in your terraform manifests (c5-virtual-network.tf - DESIRED STATE). Do you want to re-create it?
This will re-create new Virtual Network excluding one created earlier and running

Make a  Choice
-------------
Choice-1: You want this resource to be running on cloud but should not be managed by terraform. Then remove its references in terraform manifests(DESIRED STATE). So that the one running in Azure cloud (current infra) this instance will be independent of terraform. 
Choice-2: You want a new resource to be created without deleting other one (non-terraform managed resource now in current state). Run terraform plan and apply
LIKE THIS WE NEED TO MAKE DECISIONS ON WHAT WOULD BE OUR OUTCOME OF REMOVING A RESOURCE FROM STATE.

PRIMARY REASON for this is command is that respective resource need to be removed from as terraform managed. 

# Run Terraform Plan (I made choice-2)
terraform plan # NO ERROR 
terraform apply -auto-approve # UNIQUE CONSTRAINT ERROR FOR VNET NAME

# Error Message
- YOU WILL get a unique resource name on Azure for Virtual Network under this resource group error when you run "terraform apply". 
- Change the Terraform Manifests Virtual Network name to different one and test
│ Error: A resource with the ID "/subscriptions/82808767-144c-4c66-a320-b30791668b0a/resourceGroups/hr-dev-myrg/providers/Microsoft.Network/virtualNetworks/hr-dev-myvnet" already exists - to be managed via Terraform this resource needs to be imported into the State. Please see the resource documentation for "azurerm_virtual_network" for more information.

# Update c5-virtual-network.tf
Before: name = local.vnet_name
After: name = "${local.vnet_name}-2"

# Update c7-datasource-virtual-network.tf
Before: name = local.vnet_name
After: name = "${local.vnet_name}-2"

# Run Terraform Plan Again
terraform plan
terraform plan -out=v2plan.out

# Run Terraform Apply
terraform apply v2plan.out

# Verify in Azure Portal
1. In Azure Portal, you should see two Virtual Networks in a Resource Group
- hr-dev-myvnet: Not managed by Terraform 
- hr-dev-myvnet-2: Managed by Terraform

Step-05-04: Terraform State replace-provider command

This commands comes under Terraform Moving Resources Section
Terraform State Replace Provider

Step-05-05: Terraform State pull / push command

This command comes under Terraform Disaster Recovery Concept
terraform state pull:

The terraform state pull command is used to manually download and output the state from remote state.
This command also works with local state.
This command will download the state from its current location and output the raw format to stdout.

terraform state push:

The terraform state push command is used to manually upload a local state file to remote state.

# Verify if any local state files
ls -lrta terraform.tfstate 

# Terraform state pull
terraform state pull # CLI will output the terraform state

# Create new state file locally
vi terraform.tfstate
COPY ABOVE "terraform state pull" output to this file

# Make a note of Current Remote State file last updated and Version ID (From Azure Storage Container )
LAST MODIFIED	6/11/2021, 12:50:22 PM
CREATION TIME	6/11/2021, 12:50:21 PM
VERSION ID	2021-06-11T07:20:22.2334683Z

# Terraform State Push
terraform state push terraform.tfstate

# Verify new State file copied in Azure Storage Container
LAST MODIFIED	6/11/2021, 12:57:23 PM
CREATION TIME	6/11/2021, 12:50:21 PM
VERSION ID	2021-06-11T07:27:23.0504198Z

Step-06: Terraform force-unlock command

This command comes under Terraform Disaster Recovery Concept
Manually unlock the state for the defined configuration.
This will not modify your infrastructure.
This command removes the lock on the state for the current configuration.
The behavior of this lock is dependent on the backend (if supports) being used.
Important Note: Local state files cannot be unlocked by another process.

# Manually Unlock the State
terraform force-unlock LOCK_ID

Step-07: Terraform taint & untaint commands

These commands comes under Terraform Forcing Re-creation of Resources
When a resource declaration is modified, Terraform usually attempts to update the existing resource in place (although some changes can require destruction and re-creation, usually due to upstream API limitations).
Example: A virtual machine that configures itself with cloud-init on startup might no longer meet your needs if the cloud-init configuration changes.
terraform taint: The terraform taint command manually marks a Terraform-managed resource as tainted, forcing it to be destroyed and recreated on the next apply.
terraform untaint:
- The terraform untaint command manually unmarks a Terraform-managed resource as tainted, restoring it as the primary instance in the state.
- This reverses either a manual terraform taint or the result of provisioners failing on a resource.
- This command will not modify infrastructure, but does modify the state file in order to unmark a resource as tainted.

# List Resources from state
terraform state list

# Taint a Resource
terraform taint <RESOURCE_NAME_IN_TERRAFORM_LOCALLY>
terraform taint azurerm_virtual_network.myvnet-new

# Terraform Plan
terraform plan
Observation: 
Message: "-/+ destroy and then create replacement"
Plan: 1 to add, 0 to change, 1 to destroy.

# Untaint a Resource
terraform untaint <RESOURCE_NAME_IN_TERRAFORM_LOCALLY>
terraform untaint azurerm_virtual_network.myvnet-new

# Terraform Plan
terraform plan
Observation: 
Message: "No changes. Your infrastructure matches the configuration."

Step-08: Terraform Resource Targeting - Plan, Apply (-target) Option

The -target option can be used to focus Terraform's attention on only a subset of resources.
Terraform Resource Targeting
This targeting capability is provided for exceptional circumstances, such as recovering from mistakes or working around Terraform limitations.
It is not recommended to use -target for routine operations, since this can lead to undetected configuration drift and confusion about how the true state of resources relates to configuration.
Instead of using -target as a means to operate on isolated portions of very large configurations, prefer instead to break large configurations into several smaller configurations that can each be independently applied.

# Lets make one change
Change-1: c5-virtual-network.tf: Add second value to address space 
  address_space       = ["10.0.0.0/16", "10.1.0.0/16"] 

Change-2: c5-virtual-network.tf: Add new Virtual Network Resource
# Another VNET - New Resource - Enable the below at step-08
resource "azurerm_virtual_network" "myvent9" {
  name = "myvnet9"
  address_space = [ "10.2.0.0/16" ]
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name  
}


# List Resources from state
terraform state list

# Terraform plan
terraform plan
Observation:
1. Message: Plan: 1 to add, 1 to change, 0 to destroy.
2. 1 new VNET will be created
3. 1 change to existing VNET

# Terraform Plan with -target
terraform plan -target=azurerm_virtual_network.myvnet-new
Observation:
1) Message: "Plan: 0 to add, 1 to change, 0 to destroy"
2) It is updating Change-1 because we are targeting that resource "aws_instance.my-ec2-vm-new"
3) It is not touching the new resource which we are creating now "azurerm_virtual_network.myvent9". It will be in terraform configuration but not getting provisioned when we are using -target

# Terraform Apply
terraform apply -target=azurerm_virtual_network.myvnet-new

Step-09: Terraform Destroy & Clean-Up

# Destory Resources
terraform destroy -auto-approve

# Clean-Up Files
rm -rf .terraform*
rm -rf terraform.tfstate*
rm -rf v1plan.out
rm -rf v2plan.out

Step-10: Put all Terraform Configs back for students at demo level

# Kalyan - Not to forgot to change these things after Recording for students seamless demo
Change-1: c5-virtual-network.tf (Change back to base demo state)
# Create Virtual Network
resource "azurerm_virtual_network" "myvnet" {     # Comment during step-05-02
#resource "azurerm_virtual_network" "myvnet-new" {  # Uncomment during step-05-02
  name                = local.vnet_name # Comment during step-05-03
  #name                = "${local.vnet_name}-2" # Uncomment during step-05-03
  address_space       = local.vnet_address_space      # Comment at Step-08 
  #address_space       = ["10.0.0.0/16", "10.1.0.0/16"] # Uncomment at Step-08
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name
  tags = local.common_tags 
}

# Another VNET - New Resource - Uncomment the below at step-08
/*
resource "azurerm_virtual_network" "myvent9" {
  name = "myvnet9"
  address_space = [ "10.2.0.0/16" ]
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name  
}
*/

References

title: Terraform Command apply refershonly description: Learn about Terraform Command apply -refershonly in detail

Step-01: Introduction

Terraform Refresh
Understand terraform apply -refresh-only in detail

Understand terraform refresh in detail

This commands comes under Terraform Inspecting State
Understanding terraform apply -refresh-only clears a lot of doubts in our mind and terraform state file and state feature
The terraform apply -refresh-onlycommand is used to reconcile the state Terraform knows about (via its state file) with the real-world infrastructure.
This can be used to detect any drift from the last-known state, and to update the state file.
This does not modify infrastructure, but does modify the state file. If the state is changed, this may cause changes to occur during the next plan or apply.
terraform apply -refresh-only: Update terraform.tfstate state file against real resources in cloud
Desired State: Local Terraform Manifest (All *.tf files)
Current State: Real Resources present in your cloud

Step-02: Review Terraform Configs

c1-versions.tf
c2-resource-group.tf

Step-03: Execute Terraform Commands

# Terraform Initialize
terraform init

# Terraform Validate
terraform validate

# Terraform Plan
terraform plan

# Terraform Apply
terraform apply -auto-approve

Step-04: Add a new tag to Resource using Azure Management Console

"tag3" = "my-tag-3"

Step-05: Execute terraform plan

You should observe no changes to state file because plan does the comparison in memory
Verify terraform.tfstate file and it should not have any changes
But it show the differences of tags.

# Execute Terraform plan
terraform plan 

# Verify Terraform State File (recent timestamp)
ls -lrta 

# Review Terraform State file using terraform show command
terraform show

Step-06: Execute terraform apply -refresh-only

You should see terraform state file updated with new demo tag

# Execute terraform plan -refresh-only
terraform plan -refresh-only

# Execute terraform apply -refresh-only
terraform apply -refresh-only

# Review terraform state file
1) terraform show
2) A new tag will be added to Azure Resource Group 
"tag3" = "my-tag-3"

Step-07: Update TF Configs

Now you have manual changes done on Azure Portal in your state file so that you can track that change via Terraform.
You also need to update your TF Configs (desired state) with that change so that, this new tag change "tag3" = "my-tag-3" can be officially managed by Terraform
c2-resource-group.tf: Add Tag3 referencing the state file.
Simply uncomment tag3

# Run Terraform Plan
terraform plan
Observation: 
1. Tag3 change present in Current State (Real Cloud Env on Azure Portal) and in Terraform State file but not present in TF Configs (desired state)
2. So `terraform plan` will say we need to get rid of that change in next `terraform apply`
3. Now add that `tag3` in c2-resource-group.tf

# Resource-1: Azure Resource Group
resource "azurerm_resource_group" "myrg" {
  name = "myrg1"
  location = "eastus"
  tags = {
    "tag1" = "my-tag-1"
    "tag2" = "my-tag-2"
    "tag3" = "my-tag-3"
  }
}

# Run Terraform Plan
terraform plan
Observation:
1. No changes to infrastructure
TF Configs (Desired State) - Good
TF State File - Good
Azure Portal (Current State) - Good

Step-08: Clean-Up

# Destroy Resources
terraform destroy -auto-approve

# Delete files
rm -rf .terraform*
rm -rf terraform.tfstate*

title: Terraform Workspaces with Local Backend description: Learn Terraform Workspaces with Local Backend

Step-01: Introduction

We are going to use Terraform Local Backend
We are going to create 2 workspaces (default, dev) in addition to default workspace
Update our terraform manifests to support terraform workspace
Master the below listed terraform workspace commands

terraform workspace show
terraform workspace list
terraform workspace new
terraform workspace select
terraform workspace delete

Step-02: Review Terraform Configs and make changes

Copy terraform-manifests from 38-Terraform-Remote-State-Storage-and-Locking and make following changes

Step-03: c1-versions.tf

Remove Backend block from Terraform Settings block if any present

# Terraform State Storage to Azure Storage Container
  backend "azurerm" {
    resource_group_name   = "terraform-storage-rg"
    storage_account_name  = "terraformstate201"
    container_name        = "tfstatefiles"
    key                   = "terraform.tfstate"
  }

Step-04: c3-locals.tf

What is ${terraform.workspace}? - It will get the workspace name
Popular Usage-1: Using the workspace name as part of naming or tagging behavior
Popular Usage-2: Referencing the current workspace is useful for changing behavior based on the workspace. For example, for non-default workspaces, it may be useful to spin up smaller cluster sizes.
Replace ${var.environment} with ${terraform.workspace} for all resource names

  rg_name = "${var.business_unit}-${terraform.workspace}-${var.resoure_group_name}"
  vnet_name = "${var.business_unit}-${terraform.workspace}-${var.virtual_network_name}"
  snet_name = "${var.business_unit}-${terraform.workspace}-${var.subnet_name}"
  pip_name = "${var.business_unit}-${terraform.workspace}-${var.publicip_name}"
  nic_name = "${var.business_unit}-${terraform.workspace}-${var.network_interface_name}"
  vm_name = "${var.business_unit}-${terraform.workspace}-${var.virtual_machine_name}"

Step-05: c5-virtual-network.tf

Update Public IP domain_name_label with ${terraform.workspace}

# Create Public IP Address
resource "azurerm_public_ip" "mypublicip" {
  name                = local.pip_name
  resource_group_name = azurerm_resource_group.myrg.name
  location            = azurerm_resource_group.myrg.location
  allocation_method   = "Static"
  domain_name_label = "app1-${terraform.workspace}-${random_string.myrandom.id}"
  tags = local.common_tags
}

Step-06: Create resources in default workspaces

Default Workspace: Every initialized working directory has at least one workspace.
If you haven't created other workspaces, it is a workspace named default
For a given working directory, only one workspace can be selected at a time.
Most Terraform commands (including provisioning and state manipulation commands) only interact with the currently selected workspace.

# Terraform Init
terraform init 

# List Workspaces
terraform workspace list

# Output Current Workspace using show
terraform workspace show

# Terraform Plan
terraform plan
Observation: 
1. The names of Resources should have "default" in them in place of environment
2. Resource Group Name: it-default-rg
3. Virtual Network: it-default-vnet
4. Subnet Name: it-default-subnet
5. Public IP Name: it-default-publicip
6. Network Interface Name: it-default-nic
7. Virtual Machine Name: it-default-vm

# Terraform Apply
terraform apply -auto-approve

# Verify
Verify the same in Azure Management console
Observation: 
1. The names of Resources should have "default" in them in place of environment
2. Resource Group Name: it-default-rg
3. Virtual Network: it-default-vnet
4. Subnet Name: it-default-subnet
5. Public IP Name: it-default-publicip
6. Network Interface Name: it-default-nic
7. Virtual Machine Name: it-default-vm

# Access Application
http://<public-ip-dns-name>

Step-07: Create New Workspace and Provision Infra

# Create New Workspace
terraform workspace new dev

# Verify the folder
cd terraform.tfstate.d 
cd dev
ls
cd ../../

# Terraform Plan
terraform plan
Observation:  
1. The names of Resources should have "dev" in them in place of environment
2. Resource Group Name: it-dev-rg
3. Virtual Network: it-dev-vnet
4. Subnet Name: it-dev-subnet
5. Public IP Name: it-dev-publicip
6. Network Interface Name: it-dev-nic
7. Virtual Machine Name: it-dev-vm

# Terraform Apply
terraform apply -auto-approve

# Verify Dev Workspace statefile
cd terraform.tfstate.d/dev
ls
cd ../../
Observation: You should fine "terraform.tfstate" in "current-working-directory/terraform.tfstate.d/dev" folder

# Verify Resources in Azure mgmt console
Observation:
1. The names of Resources should have "dev" in them in place of environment
2. Resource Group Name: it-dev-rg
3. Virtual Network: it-dev-vnet
4. Subnet Name: it-dev-subnet
5. Public IP Name: it-dev-publicip
6. Network Interface Name: it-dev-nic
7. Virtual Machine Name: it-dev-vm

# Access Application
http://<public-ip-dns-name>

Step-08: Switch workspace and destroy resources

Switch workspace from dev to default and destroy resources in default workspace

# Show current workspace
terraform workspace show

# List Worksapces
terraform workspace list

# Workspace select
terraform workspace select default

# Delete Resources from default workspace
terraform destroy -auto-approve

# Verify
1) Verify in Azure Mgmt Console (all the resources should be deleted)

Step-09: Delete dev workspace

We cannot delete "default" workspace
We can delete workspaces which we created (dev, qa etc)

# Delete Dev Workspace
terraform workspace delete dev
Observation: Workspace "dev" is not empty.
Deleting "dev" can result in dangling resources: resources that
exist but are no longer manageable by Terraform. Please destroy
these resources first.  If you want to delete this workspace
anyway and risk dangling resources, use the '-force' flag.

# Switch to Dev Workspace
terraform workspace select dev

# Destroy Resources
terraform destroy -auto-approve

# Delete Dev Workspace
terraform workspace delete dev
Observation:
Workspace "dev" is your active workspace.
You cannot delete the currently active workspace. Please switch
to another workspace and try again.

# Switch Workspace to default
terraform workspace select default

# Delete Dev Workspace
terraform workspace delete dev
Observation: Successfully delete workspace dev

# Verify 
In Azure mgmt console, all Resources should be deleted

Step-10: Clean-Up Local folder

# Clean-Up local folder
rm -rf .terraform*
rm -rf terraform.tfstate*

References

Terraform Workspaces
Managing Workspaces--- title: Terraform Workspaces with Remote Backend description: Learn Terraform Workspaces with Remote Backend

Step-01: Introduction

We are going to use Terraform Remote Backend (Azure Storage)
We are going to create 3 workspaces (default, dev, staging, prod) in addition to default workspace
We will understand how the Terraform TF State Files get created in Azure Storage Account as part of multiple workspaces concept.

Step-02: c1-versions.tf

Add Backend block in Terraform Settings block

# Terraform State Storage to Azure Storage Container
  backend "azurerm" {
    resource_group_name   = "terraform-storage-rg"
    storage_account_name  = "terraformstate201"
    container_name        = "tfstatefiles"
    key                   = "cliworkspaces-terraform.tfstate"
  }

Step-03: Create Workspaces and Verify State files in Storage Account

# Terraform Init
terraform init 
Observation:
1. Go to Azure Management Console -> terraform-storage-tg -> terraformstate201 -> tfstatefiles
2. Verify file with name "cliworkspaces-terraform.tfstate"
3. Verify file size (Approx 155B)

# List Workspaces
terraform workspace list

# Output Current Workspace using show
terraform workspace show

# Create Workspaces
terraform workspace new dev
terraform workspace new staging
terraform workspace new prod

# Verify the workspace file names in Storage Account
cliworkspaces-terraform.tfstate:dev
cliworkspaces-terraform.tfstate:staging
cliworkspaces-terraform.tfstate:prod

# Delete Workspaces
terraform workspace select default
terraform workspace delete dev
terraform workspace delete staging
terraform workspace delete prod

# Verify the workspace file names in Storage Account
Observation:
1. All the workspace specific state files should be deleted automatically when workspaces get deleted.
2. Only `cliworkspaces-terraform.tfstate` default worksapce file should be present because we will not be able to delete default workspace.

Step-04: Clean-Up Local folder

# Clean-Up local folder
rm -rf .terraform*

References

Terraform Workspaces
Managing Workspaces--- title: Terraform File Provisioner description: Learn Terraform File Provisioner

Step-00: Provisioner Concepts

Generic Provisioners

file
local-exec
remote-exec

Provisioner Timings
- Creation-Time Provisioners (by default)
- Destroy-Time Provisioners
Provisioner Failure Behavior
- continue
- fail
Provisioner Connections
Provisioner Without a Resource (Null Resource)

Pre-requisites - SSH Keys

Create SSH Keys for Azure VM Instance if not created

# Create Folder
cd terraform-manifests/
mkdir ssh-keys

# Create SSH Key
cd ssh-ekys
ssh-keygen \
    -m PEM \
    -t rsa \
    -b 4096 \
    -C "azureuser@myserver" \
    -f terraform-azure.pem 
Important Note: If you give passphrase during generation, during everytime you login to VM, you also need to provide passphrase.

# List Files
ls -lrt ssh-keys/

# Files Generated after above command 
Public Key: terraform-azure.pem.pub -> Rename as terraform-azure.pub
Private Key: terraform-azure.pem

# Permissions for Pem file
chmod 400 terraform-azure.pem

Connection Block for provisioners uses this to connect to newly created Azure VM instance to copy files using file provisioner, execute scripts using remote-exec provisioner

Step-01: Introduction

Understand about File Provisioners
Create Provisioner Connections block required for File Provisioners
We will also discuss about Creation-Time Provisioners (by default)
Understand about Provisioner Failure Behavior
- continue
- fail
Discuss about Destroy-Time Provisioners

Step-02: File Provisioner & Connection Block

Understand about file provisioner & Connection Block
Connection Block

We can have connection block inside resource block for all provisioners
[or] We can have connection block inside a provisioner block for that respective provisioner

Self Object

Important Technical Note: Resource references are restricted here because references create dependencies. Referring to a resource by name within its own block would create a dependency cycle.
Expressions in provisioner blocks cannot refer to their parent resource by name. Instead, they can use the special self object.
The self object represents the provisioner's parent resource, and has all of that resource's attributes.

  # Connection Block for Provisioners to connect to Azure Virtual Machine
  connection {
    type = "ssh"
    host = self.public_ip_address # Understand what is "self"
    user = self.admin_username
    password = ""
    private_key = file("${path.module}/ssh-keys/terraform-azure.pem")
  }

Step-03: Create multiple provisioners of various types

Creation-Time Provisioners:
By default, provisioners run when the resource they are defined within is created.
Creation-time provisioners are only run during creation, not during updating or any other lifecycle.
They are meant as a means to perform bootstrapping of a system.
If a creation-time provisioner fails, the resource is marked as tainted.
A tainted resource will be planned for destruction and recreation upon the next terraform apply.
Terraform does this because a failed provisioner can leave a resource in a semi-configured state.
Because Terraform cannot reason about what the provisioner does, the only way to ensure proper creation of a resource is to recreate it. This is tainting.
You can change this behavior by setting the on_failure attribute, which is covered in detail below.

 # File Provisioner-1: Copies the file-copy.html file to /tmp/file-copy.html
  provisioner "file" {
    source      = "apps/file-copy.html"
    destination = "/tmp/file-copy.html"
  }

  # File Provisioner-2: Copies the string in content into /tmp/file.log
  provisioner "file" {
    content     = "VM Host Name: ${self.computer_name}" # Understand what is "self"
    destination = "/tmp/file.log"
  }

  # File Provisioner-3: Copies the app1 folder to /tmp - FOLDER COPY
  provisioner "file" {
    source      = "apps/app1"
    destination = "/tmp"
  }

  # File Provisioner-4: Copies all files and folders in apps/app2 to /tmp - CONTENTS of FOLDER WILL BE COPIED
  provisioner "file" {
    source      = "apps/app2/" # when "/" at the end is added - CONTENTS of FOLDER WILL BE COPIED
    destination = "/tmp"
  }

Step-04: Create Resources using Terraform commands

# Terraform Initialize
terraform init

# Terraform Validate
terraform validate

# Terraform Format
terraform fmt

# Terraform Plan
terraform plan

# Terraform Apply
terraform apply -auto-approve

# Verify - Login to Azure Virtual Machine Instance
ssh -i ssh-keys/terraform-azure.pem azureuser@IP_ADDRESSS_OF_YOUR_VM
ssh -i ssh-keys/terraform-azure.pem azureuser@20.185.30.127
Verify /tmp for all files copied
cd /tmp
ls -lrta /tmp

# Clean-up
terraform destroy -auto-approve
rm -rf terraform.tfsate*
Observation: 
Q1: Why do we need to destroy and move with next steps?
A1: 
1. Provisioners can be created during resource creation-time or destroy-time. 
2. With that said, we need to test failure case of a provisioner which will faill "terraform apply". 
3. We will understand that in next few steps.

Step-05: Failure Behavior: Understand Decision making when provisioner fails (continue / fail)

By default, provisioners that fail will also cause the Terraform apply itself to fail. The on_failure setting can be used to change this. The allowed values are:

continue: Ignore the error and continue with creation or destruction.
fail: (Default Behavior) Raise an error and stop applying (the default behavior). If this is a creation provisioner, taint the resource.

Try copying a file to Apache static content folder "/var/www/html" using file-provisioner
This will fail because, the user you are using to copy these files is "azureuser" for Azure linux vm. This user don't have access to folder "/var/www/html/" top copy files.
We need to use sudo to do that.
All we know is we cannot copy it directly, but we know we have already copied this file in "/tmp" using file provisioner
Try two scenarios

No on_failure attribute (Same as on_failure = fail) - default what happens It will Raise an error and stop applying. If this is a creation provisioner, it will taint the resource.
When on_failure = continue, will continue creating resources
Verify: Verify terraform.tfstate for "status": "tainted"

/*
# Enable this during Step-05-01 Test-1
 # File Provisioner-5: Copies the file-copy.html file to /var/www/html/file-copy.html where "azureuser" don't have permission to copy
 # This provisioner will fail but we don't want to taint the resource, we want to continue on_failure
  provisioner "file" {
    source      = "apps/file-copy.html"
    destination = "/var/www/html/file-copy.html"
    #on_failure  = continue  # Enable this during Step-05-01 Test-2
   } 
*/

Step-05-01: Fail Case

# Test-1: Without on_failure attribute which will fail terraform apply
 # Copies the file-copy.html file to /var/www/html/file-copy.html
  provisioner "file" {
    source      = "apps/file-copy.html"
    destination = "/var/www/html/file-copy.html"
   }
# Terraform Validate
terraform validate

# Terraform Plan
terraform plan

# Terraform Apply
terraform apply -auto-approve   

# Verify:  
Verify terraform.tfstate for  "status": "tainted"

## Sample Failure Log
azurerm_linux_virtual_machine.mylinuxvm: Provisioning with 'file'...
azurerm_linux_virtual_machine.mylinuxvm: Still creating... [3m0s elapsed]
╷
│ Error: file provisioner error
│ 
│   with azurerm_linux_virtual_machine.mylinuxvm,
│   on c6-linux-virtual-machine.tf line 71, in resource "azurerm_linux_virtual_machine" "mylinuxvm":
│   71:   provisioner "file" {
│ 
│ Upload failed: scp: /var/www/html/file-copy.html: Permission denied
╵

Step-05-02: Continue Case

Uncomment on_failure = continue

# Test-2: With on_failure = continue
 # Copies the file-copy.html file to /var/www/html/file-copy.html
  provisioner "file" {
    source      = "apps/file-copy.html"
    destination = "/var/www/html/file-copy.html"
    on_failure  = continue 
   }
# Terraform Validate
terraform validate

# Terraform Plan
terraform plan

# Terraform Apply
terraform apply -auto-approve

# Verify
1. Login to Azure VM Instance
ssh -i ssh-keys/terraform-azure.pem azureuser@<VM-PUBLIC-IP>
ssh -i ssh-keys/terraform-azure.pem azureuser@20.102.55.82


2. Verify /tmp - for all files copied
3. Verify /var/www/html - file-copy.html should not be copied
4. File Provisioner didn't do job of file copy but still it didn't get fail due to the fact that we used "on_failure  = continue"

Step-06: Clean-Up Resources & local working directory

# Terraform Destroy
terraform destroy -auto-approve

# Delete Terraform files 
rm -rf .terraform*
rm -rf terraform.tfstate*

Step-07: Roll back change for Student seamless demo

# c6-linux-virtual-machine.tf
Comment last File Provisioner so that it will be enabled when required by students during the step by step process.

Step-07: Destroy Time Provisioners

Discuss about this concept
Destroy Time Provisioners
Inside a provisioner when you add this statement when = destroy it will provision this during the resource destroy time

resource "azurerm_linux_virtual_machine" "mylinuxvm" {
  # ...

  provisioner "local-exec" {
    when    = destroy 
    command = "echo 'Destroy-time provisioner'"
  }
}
```---
title: Terraform remote-exec Provisioner
description: Learn Terraform remote-exec Provisioner
---
## Step-01: Introduction
- Understand about [remote-exec Provisioner](https://www.terraform.io/docs/language/resources/provisioners/remote-exec.html)
- The `remote-exec` provisioner invokes a script on a remote resource after it is created. 
- This can be used to run a configuration management tool, bootstrap into a cluster, etc. 

## Step-02: Create / Review Provisioner configuration
- **Usecase:** 
1. We will copy a file named `file-copy.html` using `File Provisioner` to "/tmp" directory
2. Using `remote-exec provisioner`, using linux commands we will in-turn copy the file to Apache Webserver static content directory `/var/www/html` and access it via browser once it is provisioned
```t
 # Copies the file-copy.html file to /tmp/file-copy.html
  provisioner "file" {
    source      = "apps/file-copy.html"
    destination = "/tmp/file-copy.html"
  }

# Copies the file to Apache Webserver /var/www/html directory
  provisioner "remote-exec" {
    inline = [
      "sleep 120",  # Will sleep for 120 seconds to ensure Apache webserver is provisioned using custom_data
      "sudo cp /tmp/file-copy.html /var/www/html"
    ]
  }

Step-03: Review Terraform manifests & Execute Terraform Commands

# Terraform Initialize
terraform init

# Terraform Validate
terraform validate

# Terraform Format
terraform fmt

# Terraform Plan
terraform plan

# Terraform Apply
terraform apply -auto-approve

# Verify
1) Login to Azure VM Instance
ssh -i ssh-keys/terraform-azure.pem azureuser@PUBLIC_IP_ADDRESSS_OF_YOUR_VM
ssh -i ssh-keys/terraform-azure.pem azureuser@54.197.54.126

2) Verify /tmp for file named file-copy.html all files copied (ls -lrt /tmp/file-copy.html)
3) Verify /var/www/html for a file named file-copy.html (ls -lrt /var/www/html/file-copy.html)
4) Access via browser http://<Public-IP>/file-copy.html

Step-04: Clean-Up Resources & local working directory

# Terraform Destroy
terraform destroy -auto-approve

# Delete Terraform files 
rm -rf .terraform*
rm -rf terraform.tfstate*

title: Terraform local-exec Provisioner description: Learn Terraform local-exec Provisioner

Step-01: Introduction

Understand about local-exec Provisioner
The local-exec provisioner invokes a local executable after a resource is created.
This invokes a process on the machine running Terraform, not on the resource.

Step-02: Review local-exec provisioner code

We will create one provisioner during creation-time. It will output private ip of the instance in to a file named creation-time.txt
We will create one more provisioner during destroy time. It will output destroy time with date in to a file named destroy-time.txt
c6-linux-virtual-machine.tf

  # local-exec provisioner (Creation-Time Provisioner - Triggered during Create Resource)
  provisioner "local-exec" {
    command = "echo ${azurerm_linux_virtual_machine.mylinuxvm.public_ip_address} >> creation-time.txt"
    working_dir = "local-exec-output-files/"
    #on_failure = continue
  }

  # local-exec provisioner - (Destroy-Time Provisioner - Triggered during Destroy Resource)
  provisioner "local-exec" {
    when    = destroy
    command = "echo Destroy-time provisioner Instanace Destroyed at `date` >> destroy-time.txt"
    working_dir = "local-exec-output-files/"
  }

Step-03: Review Terraform manifests & Execute Terraform Commands

# Terraform Initialize
terraform init

# Terraform Validate
terraform validate

# Terraform Format
terraform fmt

# Terraform Plan
terraform plan

# Terraform Apply
terraform apply -auto-approve

# Verify
Verify the file in folder "local-exe-output-files/creation-time.txt"

Step-04: Clean-Up Resources & local working directory

# Terraform Destroy
terraform destroy -auto-approve

# Verify
Verify the file in folder "local-exec-output-files/destroy-time.txt"

# Delete Terraform files 
rm -rf .terraform*
rm -rf terraform.tfstate*

title: Terraform Null Resource description: Learn Terraform Null Resource

Step-01: Introduction

Understand about Null Provider
Understand about Null Resource
Understand about Time Provider
Usecase: Force a resource to update based on a changed null_resource
Create time_sleep resource to wait for 90 seconds after Azure Linux VM Instance creation
Create Null resource with required provisioners

File Provisioner: Copy apps/app1 folder to /tmp
Remote Exec Provisioner: Copy app1 folder from /tmp to /var/www/htnl

Over the process we will learn about

null_resource
time_sleep resource
We will also learn how to Force a resource to update based on a changed null_resource using timestamp function and triggers in null_resource

Step-02: Define null provider in Terraform Settings Block

Update null provider info listed below in c1-versions.tf

    null = {
      source = "hashicorp/null"
      version = ">= 3.0.0"
    }

Step-03: Define Time Provider in Terraform Settings Block

Update time provider info listed below in c1-versions.tf

    time = {
      source = "hashicorp/time"
      version = ">= 0.6.0"
    }

Step-04: Create / Review the c8-null-resource.tf terraform configuration

Step-04-01: Create Time Sleep Resource

This resource will wait for 90 seconds after VM Instance creation.
This wait time will give VM Instance to provision the Apache Webserver and create all its relevant folders
Primarily if we want to copy static content we need Apache webserver static folder /var/www/html

# Wait for 90 seconds after creating the above Azure Virtual Machine Instance 
resource "time_sleep" "wait_90_seconds" {
  depends_on = [azurerm_linux_virtual_machine.mylinuxvm]
  create_duration = "90s"
}

Step-04-02: Create Null Resource

Create Null resource with triggers with timestamp() function which will trigger for every terraform apply
This Null Resource will help us to sync the static content from our local folder to VM Instnace as and when required.
Also only changes will applied using only null_resource when terraform apply is run. In other words, when static content changes, how will we sync those changes to VM Instance using terraform - This is one simple solution.
Primarily the focus here is to learn the following
- null_resource
- null_resource trigger
- How trigger works based on timestamp() function ?
- Provisioners in Null Resource

# Terraform NULL RESOURCE
# Sync App1 Static Content to Webserver using Provisioners
resource "null_resource" "sync_app1_static" {
  depends_on = [ time_sleep.wait_90_seconds ]
  triggers = {
    always-update =  timestamp()
  }

  # Connection Block for Provisioners to connect to Azure VM Instance
  connection {
    type = "ssh"
    host = azurerm_linux_virtual_machine.mylinuxvm.public_ip_address 
    user = azurerm_linux_virtual_machine.mylinuxvm.admin_username
    private_key = file("${path.module}/ssh-keys/terraform-azure.pem")
  }  

 # Copies the app1 folder to /tmp
  provisioner "file" {
    source      = "apps/app1"
    destination = "/tmp"
  }

# Copies the /tmp/app1 folder to Apache Webserver /var/www/html directory
  provisioner "remote-exec" {
    inline = [
      "sudo cp -r /tmp/app1 /var/www/html"
    ]
  }
}

Step-05: Execute Terraform Commands

# Terraform Initialize
terraform init

# Terraform Validate
terraform validate

# Terraform Format
terraform fmt

# Terraform Plan
terraform plan

# Terraform Apply
terraform apply -auto-approve

# Verify
ssh -i ssh-keys/terraform-azure.pem azureuser@<PUBLIC-IP>
ls -lrt /tmp
ls -lrt /tmp/app1
ls -lrt /var/www/html
ls -lrt /var/www/html/app1
http://<public-ip>/app1/app1-file1.html
http://<public-ip>/app1/app1-file2.html

Step-06: Create new file locally in app1 folder

Create a new file named app1-file3.html
Also updated app1-file1.html with some additional info
file3.html

<h1>>App1 File3</h1

file1.html

<h1>>App1 File1 - Updated</h1

Sample terraform plan Output

# Terraform Plan Output
Terraform used the selected providers to generate the following execution plan. Resource actions
are indicated with the following symbols:
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # null_resource.sync_app1_static must be replaced
-/+ resource "null_resource" "sync_app1_static" {
      ~ id       = "256904776759333943" -> (known after apply)
      ~ triggers = {
          - "always-update" = "2021-06-14T05:44:33Z"
        } -> (known after apply) # forces replacement
    }

Plan: 1 to add, 0 to change, 1 to destroy.

───────────────────────────────────────────────────────────────

Step-07: Execute Terraform plan and apply commands

# Terraform Plan
terraform plan
Observation: You should see changes for "null_resource.sync_app1_static" because trigger will have new timestamp when you fired the terraform plan command

# Terraform Apply
terraform apply -auto-approve

# Verify
ssh -i ssh-keys/terraform-azure.pem azureuser@<PUBLIC-IP>
ls -lrt /tmp
ls -lrt /tmp/app1
ls -lrt /var/www/html
ls -lrt /var/www/html/app1
http://<public-ip>/app1/app1-file1.html
http://<public-ip>/app1/app1-file3.html

Step-08: Clean-Up Resources & local working directory

# Terraform Destroy
terraform destroy -auto-approve

# Delete Terraform files 
rm -rf .terraform*
rm -rf terraform.tfstate*

Step-09: Roll back to Demo State

# Change-1: Delete app1-file3.html in apps/app1 folder
# Change-2: app1-file1.html - Remove updated text

References

title: Terraform State Import description: Learn Terraform State Import

Step-01: Introduction

Terraform is able to import existing infrastructure.
This allows you take resources you've created by some other means and bring it under Terraform management.
This is a great way to slowly transition infrastructure to Terraform, or to be able to be confident that you can use Terraform in the future if it potentially doesn't support every feature you need today.
Full Reference
Azure Resource Group Terraform Import

Step-02: Create Azure Resource Group using Azure Mgmt Console

Login to Azure Portal Management Console
Go to -> Resource Groups -> Create
Resource Group: myrg1
Region: East US
Click on Review + create
Click on Create

Step-03: Create Basic Terraform Configuration

c1-versions.tf
c2-resource-group.tf
Create a base Azure Resource Group resource

# Create Azure Resource Group Resource - Basic Version to get Terraform Resource Type and Resource Local Name we are going to use in Terraform
# Resource Group
resource "azurerm_resource_group" "myrg" {
}

Step-04: Run Terraform Import to import Azure Resource Group to Terraform State

# Terraform Initialize
terraform init

# Terraform Import Command for Azure Resource Group
terraform import azurerm_resource_group.example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example
terraform import azurerm_resource_group.example /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP_NAME>
terraform import azurerm_resource_group.myrg /subscriptions/82808767-144c-4c66-a320-b30791668b0a/resourceGroups/myrg1

Observation:
1) terraform.tfstate file will be created locally in Terraform working directory
2) Review information about imported instance configuration in terraform.tfstate

# List Resources from Terraform State
terraform state list

Step-05: Start Building local c2-resource-group.tf

By referring terraform.tfstate file and parallely running terraform plan command make changes to your terraform configuration c2-resource-group.tf till you get the message No changes. Infrastructure is up-to-date for terraform plan output

# Resource Group
resource "azurerm_resource_group" "myrg" {
  name = "myrg1"
  location = "eastus"
}

Step-06: Modify Resource Group from Terraform

You have created this Azure Resource Group manually and now you made it as terraform managed
Modify this resource group by adding new tags

# Resource Group
resource "azurerm_resource_group" "myrg" {
  name = "myrg1"
  location = "eastus"
  tags = {
    "Tag1" = "My-tag-1"
  }
}

Step-07: Execute Terraform Commands

# Terraform Plan
terraform plan

# Terraform Apply
terraform apply -auto-approve
Observation:
1) Azure Resource Group on Azure Cloud should have the recently added tags.

Step-08: Destroy all resources

Destroy that using terraform

# Destroy Resource
terraform destroy  -auto-approve

# Clean-Up files
rm -rf .terraform*
rm -rf terraform.tfstate*

# Comment Resource Arguments
Change-1: c2-resource-group.tf
- Comment all resources and uncomment them when learning

title: Terraform Modules use Public Modules description: Learn to use Terraform Public Modules

Step-01: Introduction

Introduction - Module Basics

Root Module
Child Module
Published Modules (Terraform Registry)

Module Basics

Defining a Child Module
- Source (Mandatory)
- Version
- Meta-arguments (count, for_each, providers, depends_on, )
- Accessing Module Output Values
- Tainting resources within a module

Module Sources

Step-02: Defining a Child Module

We need to understand about the following

Module Source (Mandatory): To start with we will use Terraform Registry
Module Version (Optional): Recommended to use module version

Azure VNET Terraform Module
We are going to use the previous example and in that we will remove Virtual Network and Subnet Terraform Resources and use a Virtual Network Public Registry module.
c5-virrtual-network.tf

# Create Virtual Network and Subnets using Terraform Public Registry Module
module "vnet" {
  source              = "Azure/vnet/azurerm"
  version = "2.5.0"
  vnet_name = local.vnet_name
  resource_group_name = azurerm_resource_group.myrg.name
  address_space       = ["10.0.0.0/16"]
  subnet_prefixes     = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  subnet_names        = ["subnet1", "subnet2", "subnet3"]

  subnet_service_endpoints = {
    subnet2 = ["Microsoft.Storage", "Microsoft.Sql"],
    subnet3 = ["Microsoft.AzureActiveDirectory"]
  }
  tags = {
    environment = "dev"
    costcenter  = "it"
  }
  depends_on = [azurerm_resource_group.myrg]
}

Step-03: Changes to Network Interface

c5-virtual-network.tf

# Create Network Interface
resource "azurerm_network_interface" "myvmnic" {
  name                = local.nic_name
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name

  ip_configuration {
    name                          = "internal"
    #subnet_id                     = azurerm_subnet.mysubnet.id    
    subnet_id                     = module.vnet.vnet_subnets[0]
    private_ip_address_allocation = "Dynamic"
    public_ip_address_id = azurerm_public_ip.mypublicip.id 
  }
  tags = local.common_tags
}

Step-04: c6-linux-virtual-machine.tf

No changes to Linux Virtual Machine.
We reference the Network Interface only in VM Resource, so due to VNET change, no changes required in VM Resource.

Step-05: c7-outputs.tf

Define Virtual Network Module Outputs

# Output Values - Virtual Network
output "virtual_network_name" {
  description = "Virutal Network Name"
  #value = azurerm_virtual_network.myvnet.name 
  value = module.vnet.vnet_name
}
output "virtual_network_id" {
  description = "Virutal Network ID"
  value = module.vnet.vnet_id
}
output "virtual_network_subnets" {
  description = "Virutal Network Subnets"
  value = module.vnet.vnet_subnets
}
output "virtual_network_location" {
  description = "Virutal Network Location"
  value = module.vnet.vnet_location
}
output "virtual_network_address_space" {
  description = "Virutal Network Address Space"
  value = module.vnet.vnet_address_space
}

Step-06: Execute Terraform Commands

# Terraform Init
terraform init

# Terraform Validate
terraform validate

# Terraform Format
terraform fmt

# Terraform Plan
terraform plan

# Terraform Apply
terraform apply -auto-apporve

# Verify 
1) Verify in Azure Portal console , all the resources should be created.
http://<Public-IP-VM>
http://<Public-IP-VM>/app1
http://<Public-IP-VM>/app1/metadata.html

Step-07: Tainting Resources in a Module

The taint command can be used to taint specific resources within a module
Very Very Important Note: It is not possible to taint an entire module. Instead, each resource within the module must be tainted separately.

# List Resources from State
terraform state list

# Taint a Resource
terraform taint <RESOURCE-NAME>
terraform taint module.vnet.azurerm_subnet.subnet[2]

# Terraform Plan
terraform plan
Observation: 
1. Subnet2 will be destroyed and re-created

# Terraform Apply
terraform apply -auto-approve

Step-08: Clean-Up Resources & local working directory

# Terraform Destroy
terraform destroy -auto-approve

# Delete Terraform files 
rm -rf .terraform*
rm -rf terraform.tfstate*

Step-09: Meta-Arguments for Modules

Meta-Argument concepts are going to be same as how we learned during Resources section.

count
for_each
providers
depends_on
lifecycle

Meta-Arguments for Modules

Step-10: Discuss about Module Sources

Module Sources --- title: Build a Static Website on Azure with Terraform description: Learn to automate Static Website creation on Azure with Terraform

Step-00: Introduction

End Goal: Build a Terraform Local Module

Create a Terraform module
Use local Terraform modules in your configuration
Configure modules with variables
Use module outputs
We are going to write a local re-usable module for the following usecase.

Usecase: Hosting a static website using Azure Storage Account

Create a Azure Storage Account
Enable Static webstite option
Upload Static Content and test
For steps, 1 and 2 we are going to create a re-usable module in Terraform

How are we going to do this?
We are going to do this in 3 sections
Section-1 - Full Manual: Create Static Website on Azure Storage Account using Azure Portal Management Console and host static content and test
Section-2 - Terraform Resources: Automate section-1 using Terraform Resources
Section-3 - Terraform Modules: Create a re-usable module for hosting static website by referencing section-2 terraform configuration files.

Module-1: Manual: Hosting a Static Website with Azure Storage Account

Step-01: Create Azure Storage Account

Login to Azure Portal Console
Go to Storage Accounts -> Create
Resource Group: myrg-sw-1
Storage account name: staticwebsitek123 (Should be unique across Azure)
Region: East US
Performance: Standard
Redundancy: LRS
Rest all leave to defaults
Click on Review + Create
Click on Create

Step-02: Enable Static Website

Goto Storage Account -> staticwebsitek123 -> Data Management -> Static Website
Click on Enabled
Index document name: index.html
Error document path: error.html

Step-03: Upload Static Content

Goto Storage Account -> staticwebsitek123 -> Data Storage -> Containers -> $web
Upload Static files from static-content folder

index.html
error.html

Step-05: Access Static Website

Goto Storage Account -> staticwebsitek123 -> Data Management -> Static Website
Get the endpoint name Primary endpoint

# Primary Endpoint
https://staticwebsitek123.z13.web.core.windows.net/

Step-06: Conclusion

We have used multiple manual steps to host a static website on Azure Storage Account
Now all the above manual steps automate using Terraform in next step

Module-2: Create Terraform Configuration to Host a Static Website on Azure

We are going to host a static website on Azure Storage Account using general terraform configuration files
Below will be the naming convention for Terraform Configs

versions.tf
main.tf
variables.tf
outputs.tf
terraform.tfvars

Step-01: versions.tf

# Terraform Block
terraform {
  required_version = ">= 1.0.0"
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = ">= 2.0" 
    }  
    random = {
      source = "hashicorp/random"
      version = ">= 3.0"
    }  
    null = {
      source = "hashicorp/null"
      version = ">= 3.0"
    }             
  }
}

Step-02: variables.tf

# Input variable definitions
variable "location" {
  description = "The Azure Region in which all resources groups should be created."
  type = string 
}
variable "resource_group_name" {
  description = "The name of the resource group"
  type = string     
}
variable "storage_account_name" {
  description = "The name of the storage account"
  type = string   
}
variable "storage_account_tier" {
  description = "Storage Account Tier"
  type = string   
}
variable "storage_account_replication_type" {
  description = "Storage Account Replication Type"
  type = string   
}
variable "storage_account_kind" {
  description = "Storage Account Kind"
  type = string   
}
variable "static_website_index_document" {
  description = "static website index document"
  type = string   
}
variable "static_website_error_404_document" {
  description = "static website error 404 document"
  type = string   
}
variable "static_website_source_folder" {
  description = "static website source folder"
  type = string  
}

Step-03: main.tf

# Provider Block
provider "azurerm" {
 features {}          
}

# Random String Resource
resource "random_string" "myrandom" {
  length = 6
  upper = false 
  special = false
  number = false   
}

# Create Resource Group
resource "azurerm_resource_group" "resource_group" {
  name     = var.resource_group_name
  location = var.location
}

# Create Azure Storage account
resource "azurerm_storage_account" "storage_account" {
  name                = "${var.storage_account_name}${random_string.myrandom.id}"
  resource_group_name = azurerm_resource_group.resource_group.name
 
  location                 = var.location
  account_tier             = var.storage_account_tier
  account_replication_type = var.storage_account_replication_type
  account_kind             = var.storage_account_kind
 
  static_website {
    index_document = var.static_website_index_document
    error_404_document = var.static_website_error_404_document  
  }
}

Step-04: terraform.tfvars

location = "eastus"
resource_group_name = "myrg1"
storage_account_name = "staticwebsite"
storage_account_tier = "Standard"
storage_account_replication_type = "LRS"
storage_account_kind = "StorageV2"
static_website_index_document = "index.html"
static_website_error_404_document = "error.html"
static_website_source_folder = "../static-content"

Step-05: outputs.tf

# Output variable definitions
output "resource_group_id" {
  description = "resource group id"
  value       = azurerm_resource_group.resource_group.id 
}
output "resource_group_name" {
  description = "The name of the resource group"
  value       = azurerm_resource_group.resource_group.name
}
output "resource_group_location" {
  description = "resource group location"
  value       = azurerm_resource_group.resource_group.location
}
output "storage_account_id" {
  description = "storage account id"
  value       = azurerm_storage_account.storage_account.id
}
output "storage_account_name" {
  description = "storage account name"
  value       = azurerm_storage_account.storage_account.name 
}

Step-06: Execute Terraform Commands

# Terraform Initialize
terraform init

# Terraform Validate
terraform validate

# Terraform Format
terraform fmt

# Terraform Plan
terraform plan

# Terraform Apply
terraform apply -auto-approve

# Upload Static Content
1. Go to Storage Accounts -> staticwebsitexxxxxx -> Containers -> $web
2. Upload files from folder "static-content"

# Verify 
1. Azure Storage Account created
2. Static Website Setting enabled
3. Verify the Static Content Upload Successful
4. Access Static Website: Goto Storage Account -> staticwebsitek123 -> Data Management -> Static Website
5. Get the endpoint name `Primary endpoint`
https://staticwebsitek123.z13.web.core.windows.net/

Step-07: Destroy and Clean-Up

# Terraform Destroy
terraform destroy -auto-approve

# Delete Terraform files 
rm -rf .terraform*
rm -rf terraform.tfstate*

Step-08: Conclusion

Using above terraform configurations we have hosted a static website in Azure Storage Account in seconds.
In next step, we will convert these terraform configuration files to a Module which will be re-usable just by calling it.

title: Build a Local Terraform Module description: Learn to build local terraform modules.

Step-01: Introduction

We will build a Terraform local module to host a static website on Azure Storage Account.
We will understand how to call a Local Re-usable module in to a Root Module.
We will understand how the local module variables becomes the arguments inside a module block when it is called in Root Module c3-static-webiste.tf
We will understand how we define the output values for a local module in a Root module c4-outputs.tf
Terraform Comamnd terraform get
Understand the differences between terraform init and terraform get

Step-02: Create Module Folder Structure

We are going to create modules folder and in that we are going to create a module named azure-static-website
We will copy required files from previous section for this respective module 50-Terraform-Azure-Static-Website\terraform-manifests.
Terraform Working Directory: 51-Terraform-Modules-Build-Local-Module\terraform-manifests
modules
Module-1: azure-static-website

main.tf
variables.tf
outputs.tf
README.md
LICENSE

Inside modules/azure-static-website, copy below listed three files from 50-Terraform-Azure-Static-Website\terraform-manifests

main.tf
variables.tf
outputs.tf
versions.tf

Step-03: Root Module: c1-versions.tf

Call Module from Terraform Work Directory
Create Terraform Configuration in Root Module by calling the newly created module
c1-versions.tf
c2-variables.tf
c3-static-website.tf
c4-outputs.tf

# Terraform Block
terraform {
  required_version = ">= 1.0.0"
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = ">= 2.0" 
    }    
  }
}

# Provider Block
provider "azurerm" {
 features {}          
}

Step-04: c2-variables.tf

Place holder file, if you want you can define variables.
For now focus is on Calling the Local Terraform Module in to Root Module so we are not going to complicate the stuff here.
We will leave this placeholder file

Step-05: c3-static-website.tf

Arguments for this module are going to be the variables defined in variables.tf of local module

# Call our Custom Terraform Module which we built earlier
module "azure_static_website" {
  source = "./modules/azure-static-website"  # Mandatory

  # Resource Group
  location = "eastus"
  resource_group_name = "myrg1"

  # Storage Account
  storage_account_name = "staticwebsite"
  storage_account_tier = "Standard"
  storage_account_replication_type = "LRS"
  storage_account_kind = "StorageV2"
  static_website_index_document = "index.html"
  static_website_error_404_document = "error.html"
}

Step-06: c4-outputs.tf

Understand how we are going to reference the output values from a local module
The output names defined in local module outputs.tf will be the values in this c4-outputs.tf

# Output variable definitions
output "root_resource_group_id" {
  description = "resource group id"
  value       = module.azure_static_website.resource_group_id
}
output "root_resource_group_name" {
  description = "The name of the resource group"
  value       = module.azure_static_website.resource_group_name
}
output "root_resource_group_location" {
  description = "resource group location"
  value       = module.azure_static_website.resource_group_location
}
output "root_storage_account_id" {
  description = "storage account id"
  value       = module.azure_static_website.storage_account_id
}
output "root_storage_account_name" {
  description = "storage account name"
  value       = module.azure_static_website.storage_account_name
}

Step-07: Execute Terraform Commands

# Terraform Initialize
terraform init
Observation: 
1. Verify ".terraform", you will find "modules" folder in addition to "providers" folder
2. Verify inside ".terraform/modules" folder too.

# Terraform Validate
terraform validate

# Terraform Format
terraform fmt

# Terraform Plan
terraform plan

# Terraform Apply
terraform apply -auto-approve

# Upload Static Content
1. Go to Storage Accounts -> staticwebsitexxxxxx -> Containers -> $web
2. Upload files from folder "static-content"

# Verify 
1. Azure Storage Account created
2. Static Website Setting enabled
3. Verify the Static Content Upload Successful
4. Access Static Website: Goto Storage Account -> staticwebsitek123 -> Data Management -> Static Website
5. Get the endpoint name `Primary endpoint`
https://staticwebsitek123.z13.web.core.windows.net/

Step-08: Destroy and Clean-Up

# Terraform Destroy
terraform destroy -auto-approve

# Delete Terraform files 
rm -rf .terraform*
rm -rf terraform.tfstate*

Step-09: Understand terraform get command

We have used terraform init to download providers from terraform registry and at the same time to download modules present in local modules folder in terraform working directory.
Assuming we already have initialized using terraform init and later we have created module configs, we can terraform get to download the same.
Whenever you add a new module to a configuration, Terraform must install the module before it can be used.
Both the terraform get and terraform init commands will install and update modules.
The terraform init command will also initialize backends and install plugins.

# Delete modules in .terraform folder
ls -lrt .terraform/modules
rm -rf .terraform/modules
ls -lrt .terraform/modules

# Terraform Get
terraform get
ls -lrt .terraform/modules

Step10: Major difference between Local and Remote Module

When installing a remote module, Terraform will download it into the .terraform directory in your configuration's root directory.
When installing a local module, Terraform will instead refer directly to the source directory.
Because of this, Terraform will automatically notice changes to local modules without having to re-run terraform init or terraform get.

Azure Static Website using Storage Account

This module provisions Azure Storage Account for static website hosting.
This is just for Terraform Demo's

title: Terraform Module Publish to Terraform Public Registry description: Learn Terraform Module Publish to Terraform Public Registry

Step-01: Introduction

Create and version a GitHub repository for Terraform Modules
Publish Module to Terraform Public Registry
Construct a root module to consume modules from the Terraform Public Registry.
Understand about Terraform Module Versioning.

Step-02: Create new github Repository for azure-static-website terraform module

URL: github.com
Click on Create a new repository
Follow Naming Conventions for modules
- terraform-PROVIDER-MODULE_NAME
- Sample: terraform-azurerm-staticwebsitepublic
Repository Name: terraform-azurerm-staticwebsitepublic
Description: Terraform Modules to be shared in Terraform Public Registry
Repo Type: Public
Initialize this repository with:
UN-CHECK - Add a README file
CHECK - Add .gitignore
Select .gitignore Template: Terraform
CHECK - Choose a license
Select License: Apache 2.0 License (Optional)
Click on Create repository

Step-03: Clone Github Repository to Local Desktop

# Clone Github Repo
git clone https://github.com/<YOUR_GITHUB_ID>/<YOUR_REPO>.git
git clone https://github.com/stacksimplify/terraform-azurerm-staticwebsitepublic.git

Step-04: Copy files from terraform-manifests to local repo & Check-In Code

Source Location from this section: terraform-azure-static-website-module-manifests
Destination Location: Newly cloned github repository folder in your local desktop terraform-azurerm-staticwebsitepublic
Check-In code to Remote Repository

# GIT Status
git status

# Git Local Commit
git add .
git commit -am "TF Module Files First Commit"

# Push to Remote Repository
git push

# Verify the same on Remote Repository
https://github.com/stacksimplify/terraform-azurerm-staticwebsitepublic.git

Step-05: Create New Release Tag 1.0.0 in Repo

Go to Right Navigation on github Repo -> Releases -> Create a new release
Tag Version: 1.0.0
Release Title: Release-1 terraform-azurerm-staticwebsitepublic
Write: Terraform Module for Public Registry - terraform-azurerm-staticwebsitepublic
Click on Publish Release

Step-06: Publish Module to Public Terraform Registry

Access URL: https://registry.terraform.io/
Sign-In using your Github Account.
Authorize the Terraform Registry when prompted.
Goto -> Publish -> Modules
Select Repository on GitHub: terraform-azurerm-staticwebsitepublic
Check I agree to the Terms of Use
Click on Publish Module

Step-07: Review the newly Published Module

URL: https://registry.terraform.io/modules/stacksimplify/staticwebsitepublic/azurerm/latest
Review the Module Tabs on Terraform Cloud

Readme
Inputs
Outputs
Dependencies
Resources

Also review the following

Versions
Provision Instructions

Step-08: Review Root Module Terraform Configs

We have copied terraform-manifests from previous section 51-Terraform-Modules-Build-Local-Module
Here instead of using local re-usable module, we are going to use the Module source from Terraform Public Registry for the module which we recently published.
c3-static-website.tf
Commented source local module reference
Added source and version from Terraform Public Registry

# Call our Custom Terraform Module which we built earlier
module "azure_static_website" {
  #source = "./modules/azure-static-website"  
  source  = "stacksimplify/staticwebsitepublic/azurerm"
  version = "1.0.0"

  # Resource Group
  location = "eastus"
  resource_group_name = "myrg1"

  # Storage Account
  storage_account_name = "staticwebsite"
  storage_account_tier = "Standard"
  storage_account_replication_type = "LRS"
  storage_account_kind = "StorageV2"
  static_website_index_document = "index.html"
  static_website_error_404_document = "error.html"
}

Step-09: Execute Terraform Commands

# Terraform Initialize
terraform init
Observation: 
1. Should pass and download modules and providers

# Sample Output for reference
Initializing modules...
Downloading stacksimplify/staticwebsitepublic/azurerm 1.0.0 for azure_static_website...
- azure_static_website in .terraform/modules/azure_static_website

# Terraform Validate
terraform validate

# Terraform Format
terraform fmt

# Terraform Plan
terraform plan

# Terraform Apply
terraform apply -auto-approve

# Upload Static Content
1. Go to Storage Accounts -> staticwebsitexxxxxx -> Containers -> $web
2. Upload files from folder "static-content"


# Verify 
1. Azure Storage Account created
2. Static Website Setting enabled
3. Verify the Static Content Upload Successful
4. Access Static Website
https://staticwebsitek123.z13.web.core.windows.net/

Step-10: Destroy and Clean-Up

# Terraform Destroy
terraform destroy -auto-approve

# Delete Terraform files 
rm -rf .terraform*
rm -rf terraform.tfstate*

Step-11: Module Management on Terraform Public Registry

URL: https://registry.terraform.io/modules/stacksimplify/staticwebsitepublic/azurerm/latest
You should be logged in to Terraform Public Registry with your github account with which you published this module.

Resync Module
Delete Module Version
Delete Module Provider
Delete Module

Step-12: Module Versioning

Make changes to your module code and push changes to Git Repo
On Git Repo, create a new release tag example: 2.0.0
Verify the same in Terraform Registry

# Local Git Repo
Just change Readme.md file
Add text `- Version 2.0.0`

# Git Commands
git status
git commit -am "2.0.0 Commit"
git push

# Draft New Release
1. Go to Right Navigation on github Repo -> Releases -> Draft a new release
2. Tag Version: 2.0.0
3. Release Title: Release-2 terraform-azurerm-staticwebsitepublic
4. Write: Terraform Module for Public Registry - terraform-azurerm-staticwebsitepublic Release-2
5. Click on "Publish Release"

# Verify
https://registry.terraform.io/modules/stacksimplify/staticwebsitepublic/azurerm/latest
In Versions drop-down, you should notice 1.0.0 and 2.0.0(latest) tags

# Update your Module Version tag to use new version of Module
c3-static-website.tf
Old: version = "1.0.0"
New:   version = "2.0.0"

Azure Static Website using Storage Account

This module provisions Azure Storage Account for static website hosting.
This is just for Terraform Demo's
Version: 1.0.0

title: Terraform Module Sources description: Learn more about Terraform Module Sources

Step-01: Introduction

Terraform Module Sources
Understand various Terraform Module Sources

Step-02: c3-static-website.tf

# Call our Custom Terraform Module which we built earlier
module "azure_static_website" {
  
  # Terraform Local Module
  #source = "./modules/azure-static-website"  
  
  # Terraform Public Registry
  #source  = "stacksimplify/staticwebsitepb/azurerm"
  #version = "1.0.0"

  # Terraform Local Module
  #source = "./modules/azure-static-website"  
  
  # Terraform Public Registry
  #source  = "stacksimplify/staticwebsitepb/azurerm"
  #version = "1.0.0"

  # Github Clone over HTTPS 
  source = "github.com/stacksimplify/terraform-azurerm-staticwebsitepublic"

  # Github Clone over SSH (if git SSH configured with your repo - https://docs.github.com/en/github/authenticating-to-github/connecting-to-github-with-ssh)
  #source = "git@github.com:stacksimplify/terraform-azurerm-staticwebsitepublic.git"

  # Github HTTPS with selecting a Specific Release Tag
  #source = "git::https://github.com/stacksimplify/terraform-azurerm-staticwebsitepublic.git?ref=1.0.0"

  # Resource Group
  location = "eastus"
  resource_group_name = "myrg1"

  # Storage Account
  storage_account_name = "staticwebsite"
  storage_account_tier = "Standard"
  storage_account_replication_type = "LRS"
  storage_account_kind = "StorageV2"
  static_website_index_document = "index.html"
  static_website_error_404_document = "error.html"
}

Step-03: Execute Terraform Init and Verify Module download directly via Github

# Terraform Initialize
terraform init

# Verify
cd .terraform
ls
cd modules
ls
cd azure_static_website
ls
cd ../../../

# Clean-Up
rm -rf .terraform*

Step-04: Discuss about various other Terraform Sources

Github clone over ssh

module "azure_static_website" {
  source = "git@github.com:stacksimplify/terraform-azurerm-staticwebsitepb.git"
  ... 
  ...  other code
}

Bitbucket

module "azure_static_website" {
  source = "bitbucket.org/stacksimplify/terraform-azurerm-staticwebsitepb"
  ... 
  ...  other code
}

Like this many more options we have. Refer Terraform Modules Sources for detailed documentation

Step-05: Exam Question

One question will come from this section for sure.
Asking us to select the right Terraform Module Source syntax. --- title: Terraform Cloud & Github Integration description: Learn more about Terraform Cloud & Github Integration

Step-01: Introduction

Create Github Repository on github.com
Clone Github Repository to local desktop
Copy & Check-In Terraform Configurations in to Github Repository
Create Terraform Cloud Account
Create Organization
Create Workspace by integrating with Github.com Git Repo we recently created
Learn about Workspace related Queue Plan, Runs, States, Variables and Settings

Step-02: Create new github Repository

URL: github.com
Click on Create a new repository
Repository Name: terraform-cloud-azure-demo1
Description: Terraform Cloud Azure Demo1
Repo Type: Public / Private
Initialize this repository with:
CHECK - Add a README file
CHECK - Add .gitignore
Select .gitignore Template: Terraform
CHECK - Choose a license
Select License: Apache 2.0 License
Click on Create repository

Step-03: Review .gitignore created for Terraform

Review .gitignore created for Terraform projects

Step-04: Clone Github Repository to Local Desktop

# Clone Github Repo
git clone https://github.com/<YOUR_GITHUB_ID>/<YOUR_REPO>.git
git clone https://github.com/stacksimplify/terraform-cloud-azure-demo1.git

Step-05: Copy files from terraform-manifests to local repo & Check-In Code

List of files to be copied

c1-versions.tf
c2-variables.tf
c3-locals.tf
c4-resource-group.tf
c5-virtual-network.tf
c6-linux-virtual-machine.tf
c7-outputs.tf
dev.auto.tfvars
ssh-keys folder
app-scripts folder

Verify locally before commiting to GIT Repository

# Terraform Init
terraform init

# Terraform Validate
terraform validate

# Terraform Plan
terraform plan

# Clean-Up files
rm -rf .terraform

Check-In code to Remote Repository

# GIT Status
git status

# Git Local Commit
git add .
git commit -am "TF Files First Commit"

# Push to Remote Repository
git push

# Verify the same on Remote Repository
https://github.com/stacksimplify/terraform-cloud-azure-demo1.git

Step-06: Sign-Up for Terraform Cloud - Free Account & Login

SignUp URL: https://app.terraform.io/signup/account
Username:
Email:
Password:
Login URL: https://app.terraform.io

Step-07: Create Organization and Enable Free Trial

Step-07-01: Create Organization

Organization Name: hcta-azure-demo1
Email Address: stacksimplify@gmail.com
Click on Create Organization

Step-07-02: Enable Free Trial for this Organization

Go to Organization -> hcta-azure-demo1 -> Settings -> Plan & Billing
Click on Start your free trial This organization is eligible for a 30 day free trial of Terraform Cloud's paid features. Click here to get started
Select Trial Plan
Click on Start your Free Trial

Step-08: Create New Workspace

Get in to newly created Organization
Click on New Workspace
Choose your workflow: V
- Version Control Workflow
Connect to VCS
- Connect to a version control provider: github.com
- NEW WINDOW: Authorize Terraform Cloud: Click on Authorize Terraform Cloud Button
- NEW WINDOW: Install Terraform Cloud
- Select radio button: Only select repositories
- Selected 1 Repository: stacksimplify/terraform-cloud-azure-demo1
- Click on Install
Choose a Repository
- stacksimplify/terraform-cloud-azure-demo1
Configure Settings
- Workspace Name: terraform-cloud-azure-demo1 (Whatever populated automically leave to defaults)
- Workspace Description: Terraform Cloud Azure Demo1
- Advanced Settings:
  - Terraform Working Directory: terraform-manifests
  - REST ALL LEAVE TO DEFAULTS
Click on Create Workspace
You should see this message Configuration uploaded successfully

Step-09: Terraform Cloud to Authenticate to Azure using Service Principal with a Client Secret

Azure Provider: Authenticating using a Service Principal with a Client Secret

# Azure CLI Login
az login

# Azure Account List
az account list
Observation:
1. Make a note of the value whose key is "id" which is nothing but your "subscription_id"

# Set Subscription ID
az account set --subscription="SUBSCRIPTION_ID"
az account set --subscription="82808767-144c-4c66-a320-b30791668b0a"

# Create Service Principal & Client Secret
az ad sp create-for-rbac --role="Contributor" --scopes="/subscriptions/SUBSCRIPTION_ID"
az ad sp create-for-rbac --role="Contributor" --scopes="/subscriptions/82808767-144c-4c66-a320-b30791668b0a"

# Sample Output
{
  "appId": "99a2bb50-e5a1-4d72-acd3-e4697ecb5308",
  "displayName": "azure-cli-2021-06-15-15-41-54",
  "name": "http://azure-cli-2021-06-15-15-41-54",
  "password": "0ed3ZeK0DijKvhat~a5NnaQ_bpG_uv_-Xh",
  "tenant": "c81f465b-99f9-42d3-a169-8082d61c677a"
}

# Observation
"appId" is the "client_id" defined above.
"password" is the "client_secret" defined above.
"tenant" is the "tenant_id" defined above.

# Verify
az login --service-principal -u CLIENT_ID -p CLIENT_SECRET --tenant TENANT_ID
az login --service-principal -u 99a2bb50-e5a1-4d72-acd3-e4697ecb5308 -p 0ed3ZeK0DijKvhat~a5NnaQ_bpG_uv_-Xh --tenant c81f465b-99f9-42d3-a169-8082d61c677a
az account list-locations -o table
az logout

Step-10: Configure Environment Variables in Terraform Cloud

Go to Organization -> hcta-azure-demo1 -> Workspace -> hcta-azure-demo1 -> Variables
Add Environment Variables listed below

ARM_CLIENT_ID="00000000-0000-0000-0000-000000000000"
ARM_CLIENT_SECRET="00000000-0000-0000-0000-000000000000"
ARM_SUBSCRIPTION_ID="00000000-0000-0000-0000-000000000000"
ARM_TENANT_ID="00000000-0000-0000-0000-000000000000"

Step-11: Click on Queue Plan

Go to Workspace -> Runs -> Queue Plan
Review the plan generated in Full Screen
Review Cost Estimation Report
Click on Confirm & Apply
Add Comment: First Run Approved

Step-12: Review Terraform State

Go to Workspace -> States
Review the state file

Step-13: Make changes in local Git Repo - Add New Tags

Go to Local Desktop -> Local Repo -> c3-locals.tf -> Add new tag for all Resources

# Change c3-locals.tf
Uncomment tag named `Tag1 = "Terraform-Cloud-Demo1"`

# GIT Status
git status

# Git Local Commit
git add .
git commit -am "Tag Added"

# Push to Remote Repository
git push

# Verify Terraform Cloud
Go to Workspace -> Runs 
Observation: 
1) New plan should be queued ->  Click on Current Plan and review logs in Full Screen
2) Click on **Confirm and Apply**
3) Add Comment: Approved new tag changes
4) Verify Apply Logs in Full Screen
5) Review the update state in  Workspace -> States
6) Verify if new tags got created in Azure Portal.

# Access Application
http://<PUBLIC-IP>

Step-14: Make changes in local Git Repo - When Workspace in Lock State

Go to Local Desktop -> Local Repo -> c3-locals.tf -> Add new tag for all Resources

# Change c3-locals.tf
Uncomment tag named `Tag2 = "Terraform-Cloud-Demo1-Workspace-Locked"`

# GIT Status
git status

# Git Local Commit
git add .
git commit -am "Tag Added - Workspace Locked"

# Push to Remote Repository
git push

# Verify Terraform Cloud
Go to Workspace -> Runs 
Message: Workspace locked by user stacksimplify. It must be unlocked before Terraform can execute.

# Unlock Workspace 
Unlock the workspace.

Observation: 
1) New plan should be queued ->  Click on Current Plan and review logs in Full Screen
2) Click on **Confirm and Apply**
3) Add Comment: Approved new tag changes
4) Verify Apply Logs in Full Screen
5) Review the update state in  Workspace -> States
6) Verify if new tags got created in Azure Portal.

Step-15: Review Workpace Settings

Goto -> Workspace -> Settings

General Settings
Locking
Notifications
Run Triggers
SSH Key
Version Control

Step-15: Destruction and Deletion

Goto -> Workspace -> Settings -> Destruction and Deletion
click on Queue Destroy Plan to delete the resources on cloud
Goto -> Workspace -> Runs -> Click on Confirm & Apply
Add Comment: Approved for Deletion

Step-16: Comment c3-locals.tf

Comment both tags (Tag1, Tag2) in c3-locals.tf for student seamless demo

  common_tags = {
    Service = local.service_name
    Owner   = local.owner
    #Tag1 = "Terraform-Cloud-Demo1"
    #Tag2 = "Terraform-Cloud-Demo1-Workspace-Locked"
  }

Terraform Cloud with Azure Usecase Demo

Azure Demo on Terraform Cloud

We are going to create the following Azure Resources

Azure Resource Group
Azure Virtual Network
Azure Subnet
Azure Public IP
Azure Network Interface
Azure Linux Virtual Machine

title: Share Terraform Modules in Private Modules Registry description: Learn about sharing Modules in Private Modules Registry

Step-01: Introduction

Create and version a GitHub repository for use in the private module registry
Import a module into your organization's private module registry.
Construct a root module to consume modules from the private registry.
Over the process also learn about terraform login command

Step-02: Create new private github Repository for Azure Static Website terraform module

URL: github.com
Click on Create a new repository
Follow Naming Conventions for modules
- terraform-PROVIDER-MODULE_NAME
- Sample: terraform-azurerm-staticwebsiteprivate
Repository Name: terraform-azurerm-staticwebsiteprivate
Description: Terraform Modules to be shared in Private Registry
Repo Type: Private (I will make this repo public for students to access it after the demo)
Initialize this repository with:
UN-CHECK - Add a README file
CHECK - Add .gitignore
Select .gitignore Template: Terraform
CHECK - Choose a license
Select License: Apache 2.0 License (Optional)
Click on Create repository

Step-03: Clone Github Repository to Local Desktop

# Clone Github Repo
git clone https://github.com/<YOUR_GITHUB_ID>/<YOUR_REPO>.git
git clone https://github.com/stacksimplify/terraform-azurerm-staticwebsiteprivate.git

Step-04: Copy files from terraform-manifests to local repo & Check-In Code

Source Location from this section: terraform-azure-static-website-module-manifests
Destination Location: Newly cloned github repository folder in your local desktop terraform-azurerm-staticwebsiteprivate
Check-In code to Remote Repository

# GIT Status
git status

# Git Local Commit
git add .
git commit -am "TF Module Files First Commit"

# Push to Remote Repository
git push

# Verify the same on Remote Repository
https://github.com/stacksimplify/terraform-azurerm-staticwebsiteprivate.git

Step-05: Create New Release Tag 1.0.0 in Repo

Go to Right Navigation on github Repo -> Releases -> Create a new release
Tag Version: 1.0.0
Release Title: Release-1 terraform-azure-staticwebsiteprivate
Write: Terraform Module for Private Registry on Terraform Cloud - terraform-azure-staticwebsiteprivate
Click on Publish Release

Step-06: Add VCS Provider as Github using OAuth App in Terraform Cloud

Step-06-01: Add VCS Provider as Github using OAuth App in Terraform Cloud

Login to Terraform Cloud
Go to -> Organization hcta-azure-demo1 -> Registry Tab
Click on Publish Private Module -> Select Github(Custom)
Option-1: Should redirect to URL: https://github.com/settings/applications/new in new browser tab (None Configured)
Option-2: If already one or more OAuth Apps configured with that Github Account Click on register a new OAuth Application and it should redirect to URL: https://github.com/settings/applications/new
Application Name: Terraform Cloud (hctaazuredemo1)
Homepage URL: https://app.terraform.io
Application description: Terraform Cloud Integration with Github using OAuth
Authorization callback URL: https://app.terraform.io/auth/358abc4a-c3c9-4c49-9ddd-354d75d6fe85/callback
Click on Register Application
Make a note of Client ID: ad55bce90463ff34bb56 (Sample for reference)
Generate new Client Secret: ff3e6a4343cad08694ddfa3bfd0bd50c429f941a

Step-06-02: Add the below in Terraform Cloud

Name: github-terraform-modules-for-azure
Client ID: ad55bce90463ff34bb56
Client Secret: ff3e6a4343cad08694ddfa3bfd0bd50c429f941a
Click on Connect and Continue
Authorize Terraform Cloud (hctaazuredemo1) - Click on Authorize StackSimplify
SSH Keypair (Optional): click on Skip and Finish

Step-06: Import the Terraform Module from Github

In above step, we have completed the VCS Setup with github
Now lets go ahead and import the Terraform module from Github
Login to Terraform Cloud
Go to -> Organization hcta-azure-demo1 -> Registry Tab
Click on Publish Private Module -> Select Github (github-terraform-modules-for-azure) (PRE-POPULATED) -> Select it
Choose a Repository: terraform-azurerm-staticwebsiteprivate
Click on Publish Module

Step-07: Review newly imported Module

Login to Terraform Cloud -> Click on Modules Tab
Review the Module Tabs on Terraform Cloud

Readme
Inputs
Outputs
Dependencies
Resources

Also review the following

Versions
Provision Instructions

Step-08: Create a configuration that uses the Private Registry module using Terraform CLI

CreateTerraform Configuration in Root Module by calling the newly published module in Terraform Private Registry
c3-static-website.tf

# Call our Custom Terraform Module which we built earlier
module "azure_static_website" {
  #source = "./modules/azure-static-website"  
  #source  = "stacksimplify/staticwebsitepb/azurerm"
  source  = "app.terraform.io/hcta-azure-demo1-internal/staticwebsiteprivate/azurerm"
  version = "1.0.0"

  # Resource Group
  location = "eastus"
  resource_group_name = "myrg1"

  # Storage Account
  storage_account_name = "staticwebsite"
  storage_account_tier = "Standard"
  storage_account_replication_type = "LRS"
  storage_account_kind = "StorageV2"
  static_website_index_document = "index.html"
  static_website_error_404_document = "error.html"
}

Step-09: Execute Terraform Commands

# Change Directory 
cd 55-Share-Modules-in-Private-Module-Registry/terraform-manifests

# Terraform Initialize
terraform init
Observation: 
1. Should fail with error due to cli not having access to Private module registry in Terraform Cloud

## Sample Output
Kalyans-Mac-mini:terraform-manifests kalyanreddy$ terraform init
Initializing modules...
╷
│ Error: Error accessing remote module registry
│ 
│ Failed to retrieve available versions for module "azure_static_website" (c3-static-website.tf:2)
│ from app.terraform.io: error looking up module versions: 401 Unauthorized.


# Terraform Login
terraform login
Token Name: terraformlogincli3
Token value: 3nr7c3o24tOMfw.atlasv1.ruqdwL6iOkd49Bv0yCfIdC0V3h21vWKil4tby3DyhjurSByRF27cMSDhi6rEboVRiY8
Observation: 
1) Should see message |Retrieved token for user stacksimplify
2) Verify Terraform credentials file
cat /Users/<YOUR_USER>/.terraform.d/credentials.tfrc.json
cat /Users/kdaida/.terraform.d/credentials.tfrc.json
Additional Reference:
https://www.terraform.io/docs/cli/config/config-file.html#credentials-1
https://www.terraform.io/docs/cloud/registry/using.html#configuration

## Sample Output
Kalyans-Mac-mini:terraform-manifests kalyanreddy$ cat /Users/kalyanreddy/.terraform.d/credentials.tfrc.json 
{
  "credentials": {
    "app.terraform.io": {
      "token": "3nr7c3o24tOMfw.atlasv1.ruqdwL6iOkd49Bv0yCfIdC0V3h21vWKil4tby3DyhjurSByRF27cMSDhi6rEboVRiY8"
    }
  }
}Kalyans-Mac-mini:terraform-manifests kalyanreddy$ 


# Terraform Initialize
terraform init
Observation: 
1. Should pass and download modules and providers
2. Verify the private registry module got downloaded

# Terraform Validate
terraform validate

# Terraform Format
terraform fmt

# Terraform Plan
terraform plan

# Terraform Apply
terraform apply -auto-approve

# Upload Static Content
1. Go to Storage Accounts -> staticwebsitexxxxxx -> Containers -> $web
2. Upload files from folder "static-content"

# Verify 
1. Azure Storage Account created
2. Static Website Setting enabled
3. Verify the Static Content Upload Successful
4. Access Static Website
https://staticwebsitek123.z13.web.core.windows.net/

Step-10: Destroy and Clean-Up

# Terraform Destroy
terraform destroy -auto-approve

# Delete Terraform files 
rm -rf .terraform*
rm -rf terraform.tfstate*

Step-09: Create a configuration that uses the Private Registry module using Terraform Cloud & Github

Assignment

Create Github Repository
Check-In files from terraform-manifests folder in 55-Share-Modules-in-Private-Module-Registry section
Create a new Workspace with VCS workflow in Terraform Cloud to connect with Github Repository
Execute Queue Plan to apply the changes and test

Step-10: VCS Providers & Terraform Cloud

Azure Static Website using Storage Account

This module provisions Azure Storage Account for static website hosting.
This is just for Terraform Demo's
Private Module - 1.0.0

title: Terraform Cloud - CLI-Driven Workflow description: Learn about Terraform Cloud - CLI-Driven Workflow

Step-01: Introduction

Learn and practically implement CLI-Driven Workflow in Terraform Cloud

Step-02: Review Terraform Configuration Files

c1-versions.tf
c2-variables.tf
c3-static-website.tf
c4-outputs.tf

Step-03: Create Workspace with CLI Driven Workflow

Login to Terraform Cloud
Select Organization -> hcta-azure-demo1
Click on New Workspace
Choose your workflow: CLI-Driven Workflow
Workspace Name: cli-driven-azure-demo
Workspace Description: Terraform Cloud CLI Driven Workflow Azure Demo
Click on Create Workspace

Step-04: Add backend block in Terraform Settings c1-versions.tf

terraform {
  backend "remote" {
    organization = "hcta-azure-demo1"

    workspaces {
      name = "cli-driven-azure-demo"
    }
  }
}

Step-05: Verify c3-static-website.tf

# Before
  source  = "app.terraform.io/hcta-azure-demo1/staticwebsiteprivate/azurerm"
# After
  source  = "app.terraform.io/<YOUR_ORGANIZATION>/<YOUR_MODULE_NAME_IF_DIFFERENT>/azurerm"
  source  = "app.terraform.io/<YOUR_ORGANIZATION>/staticwebsitepr/azurerm"

Step-06: Execute Terraform Commands

# Terraform Login
terraform login
Token Name: clidemoapitoken1
Token value: wtMhS66BJORvLg.atlasv1.GzmOyLo8ih9RDP3j6zXMLjBB0lyIYKiLo8Mu7aSYvfwCmu1X6pIBWh0y1ZJziYgQU2c
Observation: 
1) Should see message |Retrieved token for user stacksimplify
2) Verify Terraform credentials file
cat /Users/<YOUR_USER>/.terraform.d/credentials.tfrc.json
cat /Users/kdaida/.terraform.d/credentials.tfrc.json
Additional Reference:
https://www.terraform.io/docs/cli/config/config-file.html#credentials-1
https://www.terraform.io/docs/cloud/registry/using.html#configuration

# Terraform Initialize
terraform init
Observation: 
1. Should pass and download Private Registry modules from Terraform Cloud and providers
2. Verify Private Registry module downloaded. 

# Terraform Validate
terraform validate

# Terraform Format
terraform fmt

# Terraform Plan
terraform plan
Observation: 
1. Should fail with error due to Azure Provider credential configuration not done on Terraform Cloud for this respective workspace

# Sample Output
Initializing Terraform configuration...
╷
│ Error: Error building AzureRM Client: obtain subscription() from Azure CLI: Error parsing json result from the Azure CLI: Error waiting for the Azure CLI: exit status 1: ERROR: Please run 'az login' to setup account.
│ 
│   with module.azure_static_website.provider["registry.terraform.io/hashicorp/azurerm"],
│   on .terraform/modules/azure_static_website/main.tf line 2, in provider "azurerm":
│    2: provider "azurerm" {

Step-08: Terraform Cloud to Authenticate to Azure using Service Principal with a Client Secret

Azure Provider: Authenticating using a Service Principal with a Client Secret

# Azure CLI Login
az login

# Azure Account List
az account list
Observation:
1. Make a note of the value whose key is "id" which is nothing but your "subscription_id"

# Set Subscription ID
az account set --subscription="SUBSCRIPTION_ID"
az account set --subscription="82808767-144c-4c66-a320-b30791668b0a"

# Create Service Principal & Client Secret
az ad sp create-for-rbac --role="Contributor" --scopes="/subscriptions/SUBSCRIPTION_ID"
az ad sp create-for-rbac --role="Contributor" --scopes="/subscriptions/82808767-144c-4c66-a320-b30791668b0a"

# Sample Output
{
  "appId": "99a2bb50-e5a1-4d72-acd3-e4697ecb5308",
  "displayName": "azure-cli-2021-06-15-15-41-54",
  "name": "http://azure-cli-2021-06-15-15-41-54",
  "password": "0ed3ZeK0DijKvhat~a5NnaQ_bpG_uv_-Xh",
  "tenant": "c81f465b-99f9-42d3-a169-8082d61c677a"
}

# Observation
"appId" is the "client_id" defined above.
"password" is the "client_secret" defined above.
"tenant" is the "tenant_id" defined above.

# Verify
az login --service-principal -u CLIENT_ID -p CLIENT_SECRET --tenant TENANT_ID
az login --service-principal -u 99a2bb50-e5a1-4d72-acd3-e4697ecb5308 -p 0ed3ZeK0DijKvhat~a5NnaQ_bpG_uv_-Xh --tenant c81f465b-99f9-42d3-a169-8082d61c677a
az account list-locations -o table
az logout

Step-09: Configure Environment Variables in Terraform Cloud

Go to Organization -> hcta-azure-demo1 -> Workspace -> cli-driven-azure-demo -> Variables
Add Environment Variables listed below

ARM_CLIENT_ID="00000000-0000-0000-0000-000000000000"
ARM_CLIENT_SECRET="00000000-0000-0000-0000-000000000000"
ARM_SUBSCRIPTION_ID="00000000-0000-0000-0000-000000000000"
ARM_TENANT_ID="00000000-0000-0000-0000-000000000000"

Step-10: Execute Terraform Commands

# Terraform Plan
terraform plan
Observation: 
1. Open Plan using link specified in CLI output
Example: https://app.terraform.io/app/hcta-azure-demo1-internal/cli-driven-azure-demo/runs/run-XNpEAoCPCQQSaqb3
2. Terraform plan should pass now. 


# Terraform Apply
terraform apply 
Observation:
1. Go to Terraform Cloud -> Organization: hcta-azure-demo1 -> Workspace: cli-driven-azure-demo -> Runs Tab
2. Review the plan
3. Provide confirmation "yes" in Terraform CLI (Terminal)
4. Observe TF Cloud Runs tab

# Upload Static Content
1. Go to Storage Accounts -> staticwebsitexxxxxx -> Containers -> $web
2. Upload files from folder "static-content"

# Verify 
1. Azure Storage Account created
2. Static Website Setting enabled
3. Verify the Static Content Upload Successful
4. Access Static Website
https://staticwebsitek123.z13.web.core.windows.net/

Step-11: Verify the following

Select Organization -> hcta-azure-demo1
Workspace Name: cli-driven-azure-demo
Runs
States

# Key Observation
1. Running the Terraform Commands on your local desktop but they are running on Terraform Cloud and you can see the same in Runs
2. State is also maintained in Terraform Cloud.

Step-12: Destroy and Clean-Up

# Terraform Destroy
terraform destroy 

# Delete Terraform files 
rm -rf .terraform*

Additional References

CLI Configuration File--- title: Migrate State to Terraform Cloud description: Learn about migrating State to Terraform Cloud

Step-01: Introduction

We are going to migrate State to Terraform Cloud

Step-02: Review Terraform Manifests

c1-versions.tf
c2-variables.tf
c3-static-website.tf
c4-outputs.tf

Step-03: Execute Terraform Commands (First provision using local backend)

First provision infra using local backend
terraform.tfstate file will be created in local working directory
In next steps, migrate it to Terraform Cloud

# Terraform Initialize
terraform init

# Terraform Validate
terraform validate

# Terraform Plan
terraform plan

# Terraform Apply
terraform apply -auto-approve


# Upload Static Content
1. Go to Storage Accounts -> staticwebsitexxxxxx -> Containers -> $web
2. Upload files from folder "static-content"

# Verify 
1. Azure Storage Account created
2. Static Website Setting enabled
3. Verify the Static Content Upload Successful
4. Access Static Website
https://staticwebsitek123.z13.web.core.windows.net/

Step-04: Review your local state file

Review your local terraform.tfstate file once

Step-05: Update remote backend in c1-versions.tf Terraform Block

# Template
  backend "remote" {
    hostname      = "app.terraform.io"
    organization  = "<YOUR-ORG-NAME>"

    workspaces {
      name = "<SOME-NAME>"
    }
  }

# Replace Values
  backend "remote" {
    hostname      = "app.terraform.io"
    organization  = "hcta-azure-demo1"  # Organization should already exists in Terraform Cloud

    workspaces {
      name = "state-migration-demo1" 
      # Two cases: 
      # Case-1: If workspace already exists, should not have any state files in states tab
      # Case-2: If workspace not exists, during migration it will get created
    }
  }

Step-06: Migrate State file to Terraform Cloud and Verify

# Terraform Login
terraform login
Observation: 
1) Should see message |Success! Terraform has obtained and saved an API token.|
2) Verify Terraform credentials file
cat /Users/<YOUR_USER>/.terraform.d/credentials.tfrc.json
cat /Users/kdaida/.terraform.d/credentials.tfrc.json
Additional Reference:
https://www.terraform.io/docs/cli/config/config-file.html#credentials-1
https://www.terraform.io/docs/cloud/registry/using.html#configuration

# Terraform Initialize
terraform init
Observation: 
1) During reinitialization, Terraform presents a prompt saying that it will copy the state file to the new backend. 
2) Enter yes and Terraform will migrate the state from your local machine to Terraform Cloud.

## Sample Output
Kalyans-Mac-mini:terraform-manifests kalyanreddy$ terraform init

Initializing the backend...
Acquiring state lock. This may take a few moments...
Do you want to copy existing state to the new backend?
  Pre-existing state was found while migrating the previous "local" backend to the
  newly configured "remote" backend. No existing state was found in the newly
  configured "remote" backend. Do you want to copy this state to the new "remote"
  backend? Enter "yes" to copy and "no" to start with an empty state.

  Enter a value: yes
Successfully configured the backend "remote"! Terraform will automatically
use this backend unless the backend configuration changes.

Initializing provider plugins...
- Reusing previous version of hashicorp/null from the dependency lock file
- Reusing previous version of hashicorp/azurerm from the dependency lock file
- Reusing previous version of hashicorp/random from the dependency lock file
- Using previously-installed hashicorp/azurerm v2.63.0
- Using previously-installed hashicorp/random v3.1.0
- Using previously-installed hashicorp/null v3.1.0

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.
Kalyans-Mac-mini:terraform-manifests kalyanreddy$ 


# Verify in Terraform Cloud
1) New workspace should be created with name "state-migration-demo1"
2) Verify "states" tab in workspace, we should find the state file

Step-07: Terraform Cloud to Authenticate to Azure using Service Principal with a Client Secret

Azure Provider: Authenticating using a Service Principal with a Client Secret

# Azure CLI Login
az login

# Azure Account List
az account list
Observation:
1. Make a note of the value whose key is "id" which is nothing but your "subscription_id"

# Set Subscription ID
az account set --subscription="SUBSCRIPTION_ID"
az account set --subscription="82808767-144c-4c66-a320-b30791668b0a"

# Create Service Principal & Client Secret
az ad sp create-for-rbac --role="Contributor" --scopes="/subscriptions/SUBSCRIPTION_ID"
az ad sp create-for-rbac --role="Contributor" --scopes="/subscriptions/82808767-144c-4c66-a320-b30791668b0a"

# Sample Output
{
  "appId": "99a2bb50-e5a1-4d72-acd3-e4697ecb5308",
  "displayName": "azure-cli-2021-06-15-15-41-54",
  "name": "http://azure-cli-2021-06-15-15-41-54",
  "password": "0ed3ZeK0DijKvhat~a5NnaQ_bpG_uv_-Xh",
  "tenant": "c81f465b-99f9-42d3-a169-8082d61c677a"
}

# Observation
"appId" is the "client_id" defined above.
"password" is the "client_secret" defined above.
"tenant" is the "tenant_id" defined above.

# Verify
az login --service-principal -u CLIENT_ID -p CLIENT_SECRET --tenant TENANT_ID
az login --service-principal -u 99a2bb50-e5a1-4d72-acd3-e4697ecb5308 -p 0ed3ZeK0DijKvhat~a5NnaQ_bpG_uv_-Xh --tenant c81f465b-99f9-42d3-a169-8082d61c677a
az account list-locations -o table
az logout

Step-08: Configure Environment Variables in Terraform Cloud

Go to Organization -> hcta-azure-demo1 -> Workspace -> state-migration-demo1 -> Variables
Add Environment Variables listed below

ARM_CLIENT_ID="00000000-0000-0000-0000-000000000000"
ARM_CLIENT_SECRET="00000000-0000-0000-0000-000000000000"
ARM_SUBSCRIPTION_ID="00000000-0000-0000-0000-000000000000"
ARM_TENANT_ID="00000000-0000-0000-0000-000000000000"

Step-08: Delete local terraform.tfstate

First take backup and put it safe and delete it

# Take backup
cp terraform.tfstate terraform.tfstate_local

# Delete
rm terraform.tfstate

Step-09: Apply a new run from Terraform CLI

Make a change and do terraform apply

# Add new resource (c3-static-website.tf)
# Create New Resource Group
resource "azurerm_resource_group" "resource_group2" {
  name     = "myrg2021"
  location = "eastus"
}

# Terraform Plan
terraform plan

# Terraform Apply
terraform apply 

# Verify in Terraform Cloud
1) Verify in Runs Tab in TF Cloud
2) Verify States Tab in TF Cloud

Step-10: Destroy & Clean-Up

Destroy Resources from cloud this time instead of terraform destroy command
Go to Organization (hcta-azure-demo1) -> Workspace(state-migration-demo1) -> Settings -> Destruction and Deletion
Click on Queue Destroy Plan

# Clean-Up files
rm -rf .terraform*
rm -rf terraform.tfstate*

Step-11: Rollback changes for Students seamless demo

# Change-1: c1-versions.tf
- Comment "backend" block which will be enabled during step-05
# Change-2: c3-static-website.tf
- Comment "new Resource Group Resource" block which will be enabled during step-09

title: Terraform Cloud and Sentinel Policies description: Learn about Terraform Cloud and Sentinel Policies

Step-01: Introduction

We are going to learn the following in this section
Verify if Trial plan for 30 days on hcta-azure-demo1 organization which will enable Team & Governance features of Terraform Cloud
Implement CLI-Driven workflow using Terraform Cloud for multiple Azure Resources

azurerm_resource_group
azurerm_linux_virtual_machine
azurerm_virtual_network
azurerm_public_ip
azurerm_network_interface

Understand about following 5 sentinel policies

allowed-providers.sentinel
enforce-mandatory-tags.sentinel
limit-proposed-monthly-cost.sentinel
restrict-vm-publisher.sentinel
restrict-vm-size.sentinel

Understand about defining sentinel.hcl
Create Github repository for Sentinel Policies to use them as Policy Sets in Terraform Cloud
Create Policy Sets in Terraform Cloud and Apply to demo workspace
Test if sentinel policies applied and worked successfully.
Understand about Terraform Sentinel policy Enforcement Levels

advisory
soft-mandatory
hard-mandatory

Step-02: Review Terraform manifests

c1-versions.tf
c2-variables.tf
c3-locals.tf
c4-resource-group.tf
c5-virtual-network.tf
c6-linux-virtual-machine.tf
c7-outputs.tf
dev.auto.tfvars

Step-03: Review the Git-Repo-Files-Sentinel

First Review the Terraform Governance guides - Third Generation (As on today)
Terraform Governance Guides

common-functions folder
azure-functions folder
terraform-generic-sentinel-policies

Step-04: Review 5 Sentinel Policies and sentinel.hcl

allowed-providers.sentinel
enforce-mandatory-tags.sentinel
limit-proposed-monthly-cost.sentinel
restrict-vm-publisher.sentinel
restrict-vm-size.sentinel
sentinel.hcl

Step-03: Create CLI-Driven Workspace on Terraform Cloud

Step-03-01: Verify Trial plan in hcta-azure-demo1 organization

Login to Terraform Cloud
Goto -> Organizations (hcta-azure-demo1) -> Settings -> Plan & Billing
Verify Current Plan

Free Trial
You are currently trialing Terraform Cloud's premium features, including improved team management , Sentinel policies , and cost estimation .
Your plan will change to Free on July 15th 2021 . Click here to select your next plan.

Step-03-02: Create CLI-Driven Workspace in organization hcta-azure-demo1

Login to Terraform Cloud
Select Organization -> hcta-azure-demo1
Click on New Workspace
Choose your workflow: CLI-Driven Workflow
Workspace Name: sentinel-azure-demo1
Click on Create Workspace

Step-03-03: Update c1-versions.tf with Terraform Backend in Terraform Block

  # Terraform Backend pointed to TF Cloud
  backend "remote" {
    organization = "hcta-azure-demo1-internal"

    workspaces {
      name = "sentinel-azure-demo1"
    }
  }

Step-04: Terraform Cloud to Authenticate to Azure using Service Principal with a Client Secret

Azure Provider: Authenticating using a Service Principal with a Client Secret

# Azure CLI Login
az login

# Azure Account List
az account list
Observation:
1. Make a note of the value whose key is "id" which is nothing but your "subscription_id"

# Set Subscription ID
az account set --subscription="SUBSCRIPTION_ID"
az account set --subscription="82808767-144c-4c66-a320-b30791668b0a"

# Create Service Principal & Client Secret
az ad sp create-for-rbac --role="Contributor" --scopes="/subscriptions/SUBSCRIPTION_ID"
az ad sp create-for-rbac --role="Contributor" --scopes="/subscriptions/82808767-144c-4c66-a320-b30791668b0a"

# Sample Output
{
  "appId": "99a2bb50-e5a1-4d72-acd3-e4697ecb5308",
  "displayName": "azure-cli-2021-06-15-15-41-54",
  "name": "http://azure-cli-2021-06-15-15-41-54",
  "password": "0ed3ZeK0DijKvhat~a5NnaQ_bpG_uv_-Xh",
  "tenant": "c81f465b-99f9-42d3-a169-8082d61c677a"
}

# Observation
"appId" is the "client_id" defined above.
"password" is the "client_secret" defined above.
"tenant" is the "tenant_id" defined above.

# Verify
az login --service-principal -u CLIENT_ID -p CLIENT_SECRET --tenant TENANT_ID
az login --service-principal -u 99a2bb50-e5a1-4d72-acd3-e4697ecb5308 -p 0ed3ZeK0DijKvhat~a5NnaQ_bpG_uv_-Xh --tenant c81f465b-99f9-42d3-a169-8082d61c677a
az account list-locations -o table
az logout

Step-05: Configure Environment Variables in Terraform Cloud

Go to Organization -> hcta-azure-demo1 -> Workspace -> cli-driven-azure-demo -> Variables
Add Environment Variables listed below

ARM_CLIENT_ID="00000000-0000-0000-0000-000000000000"
ARM_CLIENT_SECRET="00000000-0000-0000-0000-000000000000"
ARM_SUBSCRIPTION_ID="00000000-0000-0000-0000-000000000000"
ARM_TENANT_ID="00000000-0000-0000-0000-000000000000"

Step-06: Create Github Repository for Sentinel Policies (Policy Sets)

Step-06-01: Create new github Repository

URL: github.com
Click on Create a new repository
Repository Name: terraform-sentinel-policies-azure
Description: Terraform Cloud and Sentinel Policies Demo on Azure
Repo Type: Public / Private
Initialize this repository with:
CHECK - Add a README file
CHECK - Add .gitignore
Select .gitignore Template: Terraform
CHECK - Choose a license (Optional)
Select License: Apache 2.0 License
Click on Create repository

Step-06-02: Clone Github Repository to Local Desktop

# Clone Github Repo
git clone https://github.com/<YOUR_GITHUB_ID>/<YOUR_REPO>.git
git clone https://github.com/stacksimplify/terraform-sentinel-policies.git

Step-06-03: Copy files from terraform-sentinel-policies folder to local repo & Check-In Code

Source Location: Git-Repo-Files-Sentinel
Destination Location: Copy all folders and files from Git-Repo-Files-Sentinel newly cloned github repository folder in your local desktop terraform-sentinel-policies-azure
Check-In code to Remote Repository

# GIT Status
git status

# Git Local Commit
git add .
git commit -am "Sentinel Policies First Commit"

# Push to Remote Repository
git push

# Verify the same on Remote Repository
https://github.com/stacksimplify/terraform-sentinel-policies-azure.git

Step-07: Create Policy Sets in Terraform Cloud

Go to Terraform Cloud -> Organization (hcta-azure-demo1) -> Settings -> Policy Sets
Click on Connect a new Policy Set
Use existing VCS connection from previous section github-terraform-modules which we created using OAuth App concept
Choose Repository: terraform-sentinel-policies-azure.git
Description: Demo Sentinel Policies
Additional Options - Policies Path: terraform-generic-sentinel-policies
Scope of Policies: Policies enforced on selected workspaces
Workspaces: sentinel-azure-demo1
Click on Connect Policy Set

Step-08: Execute Terraform Commands

# Terraform Login
terraform login
Observation: 
1) Should see message |Success! Terraform has obtained and saved an API token.|
2) Verify Terraform credentials file
cat /Users/<YOUR_USER>/.terraform.d/credentials.tfrc.json
cat /Users/kdaida/.terraform.d/credentials.tfrc.json
Additional Reference:
https://www.terraform.io/docs/cli/config/config-file.html#credentials-1
https://www.terraform.io/docs/cloud/registry/using.html#configuration


# Terrafrom Initialize
terraform init

# Terraform Apply
terraform apply 

# Observation
1) Primarily verify Sentinel Policies in Terraform Cloud
2) Verify Sentinel Enforcement Mode `advisory` for `limit-proposed-monthly-cost`
3) Everything should pass and we should go to next level to confirm changes

Step-09: Verify Sentinel Enforcement Mode soft-mandatory

# Change "limit-proposed-monthly-cost" sentinel policy to soft-mandatory in sentinel.hcl
policy "limit-proposed-monthly-cost" {
    source = "./limit-proposed-monthly-cost.sentinel"
    enforcement_level = "soft-mandatory"
}

# GIT Status
git status

# Git Local Commit
git add .
git commit -am "soft-mandatory Commit"

# Push to Remote Repository
git push



# Terraform Apply
terraform apply 

# Observation
1) Primarily verify Sentinel Policies in Terraform Cloud
2) "limit-proposed-monthly-cost.sentinel" policy check should fail and tell us we have option to "override" and continue

Step-10: Verify Sentinel Enforcement Mode hard-mandatory

# Change "limit-proposed-monthly-cost" sentinel policy to hard-mandatory in sentinel.hcl
policy "limit-proposed-monthly-cost" {
    source = "./limit-proposed-monthly-cost.sentinel"
    enforcement_level = "hard-mandatory"
}

# GIT Status
git status

# Git Local Commit
git add .
git commit -am "hard-mandatory Commit"

# Push to Remote Repository
git push

# Terraform Apply
terraform apply 

# Observation
1) Primarily verify Sentinel Policies in Terraform Cloud
2) "limit-proposed-monthly-cost.sentinel" policy check should fail and Terraform Execution should stop there.
3) We don't have an option to continue or override and go to next step.

Step-11: Clean-Up & Destroy

# Terraform Destroy
terraform destroy -auto-approve

# Clean-Up files
rm -rf .terraform*


# Rollback in Repo
policy "limit-proposed-monthly-cost" {
    source = "./limit-proposed-monthly-cost.sentinel"
    enforcement_level = "advisory"
}

# GIT Status
git status

# Git Local Commit
git add .
git commit -am "hard-mandatory Commit"

# Push to Remote Repository
git push

Step-12: Roll back changes to have seamless demo to Students

# Change "limit-proposed-monthly-cost" sentinel policy to advisory in sentinel.hcl
policy "limit-proposed-monthly-cost" {
    source = "./limit-proposed-monthly-cost.sentinel"
    enforcement_level = "advisory"
}

References

)--- title: Terraform Foundational Policies using Sentinel description: Learn about Terraform Foundational Policies using Sentinel

Step-01: Introduction

Terraform Foundational Policies Library
This repository contains a library of policies that can be used within Terraform Cloud to accelerate your adoption of policy as code.
This is pre-built sentinel policies provided by Terraform

Step-02: Review sentinel.hcl

Terraform Foundational Policies using Sentinel
Terraform Sentinel Azure CIS Networking Policies
Folder Name: terraform-sentinel-cis-policies

policy "azure-cis-6.1-networking-deny-public-rdp-nsg-rules" {
  source = "https://raw.githubusercontent.com/hashicorp/terraform-foundational-policies-library/master/cis/azure/networking/azure-cis-6.1-networking-deny-public-rdp-nsg-rules/azure-cis-6.1-networking-deny-public-rdp-nsg-rules.sentinel"
  enforcement_level = "advisory"
}

policy "azure-cis-6.2-networking-deny-public-ssh-nsg-rules" {
  source = "https://raw.githubusercontent.com/hashicorp/terraform-foundational-policies-library/master/cis/azure/networking/azure-cis-6.2-networking-deny-public-ssh-nsg-rules/azure-cis-6.2-networking-deny-public-ssh-nsg-rules.sentinel"
  enforcement_level = "advisory"
}

policy "azure-cis-6.3-networking-deny-any-sql-database-ingress" {
  source = "https://raw.githubusercontent.com/hashicorp/terraform-foundational-policies-library/master/cis/azure/networking/azure-cis-6.3-networking-deny-any-sql-database-ingress/azure-cis-6.3-networking-deny-any-sql-database-ingress.sentinel"
  enforcement_level = "advisory"
}

policy "azure-cis-6.4-networking-enforce-network-watcher-flow-log-retention-period" {
  source = "https://raw.githubusercontent.com/hashicorp/terraform-foundational-policies-library/master/cis/azure/networking/azure-cis-6.4-networking-enforce-network-watcher-flow-log-retention-period/azure-cis-6.4-networking-enforce-network-watcher-flow-log-retention-period.sentinel"
  enforcement_level = "advisory"
}

Step-03: Copy Sentinel CIS Policies to terraform-sentinel-policies git repo

Copy folder terraform-sentinel-cis-policies to Local git repository terraform-sentinel-policies-azure
Check-In code to Remote Repository

# GIT Status
git status

# Git Local Commit
git add .
git commit -am "Sentinel CIS Policies Added in new folder"

# Push to Remote Repository
git push

# Verify the same on Remote Repository
https://github.com/stacksimplify/terraform-sentinel-policies-azure.git

Step-04: Add new Sentinel Policy Set in Terraform Cloud

Go to Terraform Cloud -> Organization (hcta-azure-demo1) -> Settings -> Policy Sets
Click on Connect a new Policy Set
Use existing VCS connection from previous section github-terraform-modules which we created using OAuth App concept
Choose Repository: terraform-sentinel-policies-azure.git
Name: terraform-sentinel-cis-policies
Description: terraform sentinel cis-policies
Policies Path: terraform-sentinel-cis-policies
Scope of Policies: Policies enforced on selected workspaces
Workspaces: terraform-cloud-azure-demo1
Click on Connect Policy Set

Step-05: Review our first Terraform Cloud Workspace

Go to Terraform Cloud -> Organization (hcta-azure-demo1) -> workspace (terraform-cloud-azure-demo1)
Queue Plan -> CIS-Policy-Test-1
Verify the following
- Plan
- Cost Estimate
- Policy Check: Verify what all passed and failed
Finally, Disacrd the Run

References

Terraform CIS Policies for Azure Networking

title: Terraform Dynamic Blocks description: Learn about Terraform Dynamic Blocks

Step-01: Introduction

Understand about Dynamic Block
Some resource types include repeatable nested blocks in their arguments, which do not accept expressions
You can dynamically construct repeatable nested blocks like setting using a special dynamic block type, which is supported inside resource, data, provider, and provisioner blocks
Understand and use sum function using Terraform Console
Azure Network Resource Group

Step-02: Review c1-versions.tf

Standard file without any changes

# Terraform Block
terraform {
  required_version = ">= 1.0.0"
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = ">= 2.0" 
    }
  }
}
# Provider Block
provider "azurerm" {
 features {}          
}

Step-03: Review c2-resource-group.tf

# Resource-1: Azure Resource Group
resource "azurerm_resource_group" "myrg" {
  name = "myrg-1"
  location = "East US"
}

Step-04: Review c3-network-security-group-regular.tf

# Resource-2: Create Network Security Group
resource "azurerm_network_security_group" "mynsg" {
  name                = "mynsg-1"
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name

  security_rule {
    name                       = "inbound-rule-1"
    description                = "Inbound SSH Rule"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "22"
    destination_port_range     = "22"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }
  security_rule {
    name                       = "inbound-rule-2"
    description                = "Inbound HTTP Rule"    
    priority                   = 101
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "80"
    destination_port_range     = "80"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }
  security_rule {
    name                       = "inbound-rule-3"
    description                = "Inbound Tomcat Rule"    
    priority                   = 102
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "8080"
    destination_port_range     = "8080"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }
  security_rule {
    name                       = "outbound-rule-1"
    priority                   = 100
    direction                  = "Outbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "*"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  } 
  tags = {
    environment = "Dev"
  }
}

Step-05: Terraform Sum Function using Terraform Console

# Terraform Console
sum([100,1])
sum([100,2])

Step-06: c4-network-security-group-dynamic-block.tf

security_rule.key = 0 and security_rule.value = 22
security_rule.key = 1 and security_rule.value = 80
security_rule.key = 2 and security_rule.value = 8080 ....

# Define Ports as a list in locals block
locals {
  ports = [22, 80, 8080, 8081, 7080, 7081] 
}
# Resource-2: Create Network Security Group
# Define Ports as a list in locals block
locals {
  ports = [22, 80, 8080, 8081, 7080, 7081]
}

# Resource-2: Create Network Security Group
resource "azurerm_network_security_group" "mynsg2" {
  name                = "mynsg-2"
  location            = azurerm_resource_group.myrg.location
  resource_group_name = azurerm_resource_group.myrg.name

  dynamic "security_rule" {
    for_each = local.ports 
    content {
      name                       = "inbound-rule-${security_rule.key}"
      #name                       = "inbound-rule-${security_rule.value}"
      description                = "Inbound Rule ${security_rule.key}"    
      priority                   = sum([100, security_rule.key])
      direction                  = "Inbound"
      access                     = "Allow"
      protocol                   = "Tcp"
      source_port_range          = security_rule.value
      destination_port_range     = security_rule.value
      source_address_prefix      = "*"
      destination_address_prefix = "*"      
    }
  }
 
  security_rule {
    name                       = "Outbound-rule-1"
    description                = "Outbound Rule"    
    priority                   = 102
    direction                  = "Outbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "*"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }    
  tags = {
    environment = "Dev"
  }  
}

Step-07: Execute Terraform Commands

# Terraform Initialize
terraform init

# Terraform Validate
terraform validate

# Terraform Plan
terraform plan

# Terraform Apply
terraform apply -auto-approve

Step-08: Clean-Up

# Terraform Destroy
terraform destroy -auto-approve

# Delete Files
rm -rf .terraform*
rm -rf terraform.tfstate*
```---
title: Terraform Debug
description: Learn about Terraform Debug
---

## Step-01: Introduction
- Learn about Terraform Debug
- TF_LOG & TF_LOG_PATH
- TF_LOG - Allowed Values or Desired Log Levels
- **TRACE:** Very detailed verbosity, shows every step taken by Terraform and produces enormous outputs with internal logs.
- **DEBUG:** describes what happens internally in a more concise way compared to TRACE.
- **ERROR:** shows errors that prevent Terraform from continuing.
- **WARN:** logs warnings, which may indicate misconfiguration or mistakes, but are not critical to execution
- **INFO:** shows general, high-level messages about the execution process.
- **Important Note:** 


## Step-02: Setup Trace logging in Terraform
```t
# Terrafrom Trace Log Settings
export TF_LOG=TRACE
export TF_LOG_PATH="terraform-trace.log"
echo $TF_LOG
echo $TF_LOG_PATH

# Terraform Initialize
terraform init

# Terraform Validate
terraform validate

# Terraform Plan
terraform plan

# Terraform Apply
terraform apply -auto-approve

# Terraform Destroy
terraform destroy -auto-approve

# Clean-Up
rm -rf .terraform*
rm -rf terraform.tfstate*
rm terraform-trace.log

Step-03: Setup these Environment Variables permanently in your desktops

Linux Bash

Open your .bashrc which is located in your $home directory

# Linux Bash
cd $HOME
vi .bashrc

# Terraform log settings
export TF_LOG=TRACE
export TF_LOG_PATH="terraform-trace.log"

# Verify after saving the file in new terminal 
$ echo $TF_LOG
TRACE
$ echo $TF_LOG_PATH
terraform-trace.log

Windows Powershell

Setup using Powershell profile
Open $profile command in a PowerShell
Once that file is opened add the following lines.
Now close and reopen the console and type the following to verify that it worked.

# Windows Powershell - Terraform log settings
$env:TF_LOG="TRACE"
$env:TF_LOG_PATH="terraform.txt"

# Open new powershell window & Verify
echo $env:TF_LOG
echo $env:TF_LOG_PATH

MAC OS

Update the values in .bash_profile at the end of file

# MAC OS
cd $HOME
vi .bash_profile

# Terraform log settings
export TF_LOG=TRACE
export TF_LOG_PATH="terraform-trace.log"

# Verify after saving the file in new terminal 
$ echo $TF_LOG
TRACE
$ echo $TF_LOG_PATH
terraform-trace.log

Step-04: Terraform Crash Log

If Terraform ever crashes (a "panic" in the Go runtime), it saves a log file with the debug logs from the session as well as the panic message and backtrace to crash.log.
Generally speaking, this log file is meant to be passed along to the developers via a GitHub Issue.
As a user, you're not required to dig into this file.
How to read a crash log?--- title: Terraform Override Files description: Learn about Terraform Override Files

Step-01: Introduction

Terraform Override Files
Understand and Implement about Override File Formats

override.tf
somefilename_override.tf

Step-02: Review Terraform Configs in terraform-manifests-v1

c1-versions.tf
c2-variables.tf
c3-resource-group.tf
c4-virtual-network.tf
terraform.tfvars

Step-03: terraform-manifests-v1 - override.tf

Define the same Resource Group resource with different location

# Resource-1: Azure Resource Group
resource "azurerm_resource_group" "myrg" {
  #name = var.resource_group_name
  name = "${var.business_unit}-${var.environment}-${var.resoure_group_name}"
  location = "westus"
}

Step-04: terraform-manifests-v1 - Execute Terraform Commands

# Change Directory
cd terraform-manifests-v1/

# Terraform Initialize
terraform init

# Terraform Validate
terraform validate

# Terraform Plan
terraform plan

# Observation
1. Review the location for all resources.
2. Location of all resources should be "westus" because it has picked the information from "override.tf"

# Clean-Up
rm -rf .terraform*

Step-05: terraform-manifests-v2 - c3-resource-group_override.tf

# Resource-1: Azure Resource Group
resource "azurerm_resource_group" "myrg" {
  #name = var.resource_group_name
  name = "${var.business_unit}-${var.environment}-${var.resoure_group_name}"
  location = "westus"
}

Step-06: terraform-manifests-v2 - Execute Terraform Commands

# Change Directory
cd terraform-manifests-v2/

# Terraform Initialize
terraform init

# Terraform Validate
terraform validate

# Terraform Plan
terraform plan

# Observation
1. Review the location for all resources.
2. Location of all resources should be "westus" because it has picked the information from "c3-resource-group_override.tf"

# Clean-Up
rm -rf .terraform*

Step-07: Discuss about .gitignore Terraform - Default behavior

By default if we use .gitignore of Terraform from github it will have override files ignored.
Based on need, you need to comment them in .gitignore if those are required and our .tf files are checked-in to github.

# Ignore override files as they are usually used to override resources locally and so
# are not checked in
#override.tf
#override.tf.json
#*_override.tf
#*_override.tf.json

```---
title: Terraform External Provider and Datasource
description: Learn about Terraform External Provider and Datasource
---

## Step-01: Introduction
- [Terraform External Provider and Datasource](https://registry.terraform.io/providers/hashicorp/external/latest)

## Step-02: Pre-requisite Installs
- ssh-keygen
- jq
```t
# ssh-keygen
which ssh-keygen

# jq
which jq
brew install jq

Step-03: ssh_key_generator.sh

File Location: terraform-manifests/shell-scripts

function error_exit() {
  echo "$1" 1>&2
  exit 1
}

function check_deps() {
  test -f $(which ssh-keygen) || error_exit "ssh-keygen command not found in path, please install it"
  test -f $(which jq) || error_exit "jq command not found in path, please install it"
}

function parse_input() {
  # jq reads from stdin so we don't have to set up any inputs, but let's validate the outputs
  eval "$(jq -r '@sh "export KEY_NAME=\(.key_name) KEY_ENVIRONMENT=\(.key_environment)"')"
  if [[ -z "${KEY_NAME}" ]]; then export KEY_NAME=none; fi
  if [[ -z "${KEY_ENVIRONMENT}" ]]; then export KEY_ENVIRONMENT=none; fi
}

function create_ssh_key() {
  script_dir=$(dirname $0)
  export ssh_key_file="${script_dir}/${KEY_NAME}-${KEY_ENVIRONMENT}"
  # echo "DEBUG: ssh_key_file = ${ssh_key_file}" 1>&2
  if [[ ! -f "${ssh_key_file}" ]]; then
    #ssh-keygen -m PEM -t rsa -b 4096 -N '' -f $ssh_key_file
    ssh-keygen -q -m PEM -t rsa -b 4096 -N '' -f $ssh_key_file
  fi
}

function produce_output() {
  public_key_contents=$(cat ${ssh_key_file}.pub)
  # echo "DEBUG: public_key_contents ${public_key_contents}" 1>&2
  private_key_contents=$(cat ${ssh_key_file} | awk '$1=$1' ORS='  \n')
  # echo "DEBUG: private_key_contents ${private_key_contents}" 1>&2
  # echo "DEBUG: private_key_file ${ssh_key_file}" 1>&2
  jq -n \
    --arg public_key "$public_key_contents" \
    --arg private_key "$private_key_contents" \
    --arg private_key_file "$ssh_key_file" \
    '{"public_key":$public_key,"private_key":$private_key,"private_key_file":$private_key_file}'
}

# main()
check_deps
# echo "DEBUG: received: $INPUT" 1>&2
parse_input
create_ssh_key
produce_output

Step-04: Test Shell Script

# Test Shell Script
echo '{"key_name": "terraformdemo", "key_environment": "dev"}' | ./ssh_key_generator.sh

# Verify the files created
File Location: terraform-manifests/shell-scripts/
1. terraformdemodev: Private key file created
2. terraformdemodev.pub: Public Key file created

Step-05: c1-versions.tf

# Terraform Block
terraform {
  required_version = ">= 1.0.0"
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = ">= 2.0" 
    }
    external = {
      source = "hashicorp/external"
      version = ">= 2.0"
    }       
  }
}

# Provider Block
provider "azurerm" {
 features {}          
}

Step-06: c2-external-datasource.tf

# External Datasource
data "external" "ssh_key_generator" {
  program = ["bash", "${path.module}/shell-scripts/ssh_key_generator.sh"]
  
  query = {
    key_name = "terraformdemo"
    key_environment = "dev"
  }
}

Step-07: c2-external-datasource.tf - Outputs

Terraform Outputs for the External Datasource.

# Outputs
output "public_key" {
  description = "public_key"
  value = data.external.ssh_key_generator.result.public_key
}

output "private_key" {
  description = "private_key"
  value = data.external.ssh_key_generator.result.private_key
}

output "private_key_file" {
  description = "private_key_file"
  value = data.external.ssh_key_generator.result.private_key_file 
}

Step-08: Execute Terraform Commands

# Terraform Initialize
terraform init

# Terraform Validate
terraform validate

# Terraform Plan
terraform plan

# Observation
1. Its just datasource, so either we execute terraform plan or apply, shell script "ssh_key_generator.sh" will be triggered  and Public and Private Keys are generated

# Terraform Apply (Optional)
terraform apply

Step-09: Clean-Up

# Destroy Resources (Optional if terraform apply not executed)
terraform destroy -auto-approve 

# Delete Files
rm -rf .terraform* 
rm -rf terraform.tfstate*
```---
title: Terraform External Provider and Datasource
description: Learn about Terraform External Provider and Datasource
---

## Step-01: Introduction
- [Terraform External Provider and Datasource](https://registry.terraform.io/providers/hashicorp/external/latest)
- We understoon about external provider and datasource in previous demo.
- Here we will integrate it with Azure Virtual machine Terraform Resource

## Step-02: Review Terraform Configs
- Files were copied from `11-01-Terraform-Azure-Linux-Virtual-Machine`
1. c1-versions.tf
2. c2-resource-group.tf
3. c3-virtual-network.tf
4. c4-linux-virtual-machine.tf
5. c5-external-datasource.tf
6. app-scripts/app1-cloud-init.txt
7. shell-scripts/ssh_key_generator.sh

## Step-03: c4-linux-virtual-machine.tf
- `public_key` argument will be changed with External Datasource Value. 
```t
# Before
  admin_ssh_key {
    username = "azureuser"
    public_key = file("${path.module}/ssh-keys/terraform-azure.pub")
  }
# After
  admin_ssh_key {
    username = "azureuser"
    public_key = data.external.ssh_key_generator.result.public_key
  }

Step-04: Execute Terraform Commands

# Terraform Initialize
terraform init

# Terraform Validate
terraform validate

# Terraform Plan
terraform plan

# Observation
1. Its just datasource, so either we execute terraform plan or apply, shell script "ssh_key_generator.sh" will be triggered  and Public and Private Keys are generated

# Terraform Apply 
terraform apply -auto-approve

# Connect to VM (should be successful)
chmod 400 shell-scripts/terraformdemo-dev 
ssh -i shell-scripts/terraformdemo-dev azureuser@<PUBLIC-IP-OF-VM>

# Access Sample App
http://<PUBLIC-IP-OF-VM>

Step-05: Clean-Up

# Destroy Resources 
terraform destroy -auto-approve 

# Delete Files
rm -rf .terraform* 
rm -rf terraform.tfstate*
```---
title: Terraform CLI Config File MacOS and LinuxOS
description: Learn about Terraform CLI Config File MacOS and LinuxOS
---

## Step-01: Introduction
- [Terraform CLI Config File](https://www.terraform.io/docs/cli/config/config-file.html)
- Understand about `Terraform CLI Config File` 
1. Windows: terraform.rc
2. Linux, MacOS: .terraformrc
- Understand about `plugin_cache_dir`

## Step-02: Create .terraformrc in User Home Directory
```t
# Change Directory
cd $HOME

# Create Terraform CLI Config File
touch .terraformrc

Step-03: Update .terraformrc with Plugin Cache Folder

# Update File
vi $HOME/.terraformrc

plugin_cache_dir = "$HOME/.terraform.d/plugin-cache"
disable_checkpoint = true

# Create Directory
mkdir -p $HOME/.terraform.d/plugin-cache

Step-04: Execute Terraform Commands

# Change Directory 
cd 65-Terraform-CLI-Config-File-MacOS-and-Linux/terraform-manifests

# Terraform Initialize
terraform init

# Verify the contents in Plugin Cache Directory
ls -lrta $HOME/.terraform.d/plugin-cache
cd $HOME/.terraform.d/plugin-cache
ls
cd $HOME/.terraform.d/plugin-cache/registry.terraform.io/hashicorp/
ls

Step-05: Verify if plugins loaded from Cache

# Change Directory 
cd 65-Terraform-CLI-Config-File-MacOS-and-Linux/terraform-manifests

# Remove .terraform Folder which contains plugins
rm -rf .terraform*

# Terraform Initialize
terraform init

# Sample Output for Reference
Kalyans-Mac-mini:terraform-manifests kalyanreddy$ terraform init
Initializing the backend...
Initializing provider plugins...
- Finding hashicorp/azurerm versions matching ">= 2.0.0"...
- Finding hashicorp/random versions matching ">= 3.0.0"...
- Finding hashicorp/external versions matching ">= 2.0.0"...
- Using hashicorp/random v3.1.0 from the shared cache directory
- Using hashicorp/external v2.1.0 from the shared cache directory
- Using hashicorp/azurerm v2.65.0 from the shared cache directory

# Observation
1. You can see provider plugins downloaded from "shared cache directory"

Step-07: Clean-Up

# Remove .terraform Folder which contains plugins
rm -rf .terraform*

Step-08: Terraform Cloud Credentials

You can define Terraform Cloud Credentials globally using .terraformrc file in your $HOME directroy with a token
Terraform Cloud Credentials

credentials "app.terraform.io" {
  token = "xxxxxx.atlasv1.zzzzzzzzzzzzz"
}
```---
title: Terraform CLI Config File Windows OS
description: Learn about Terraform CLI Config File Windows OS 
---


## Step-01: Introduction
- [Terraform CLI Config File](https://www.terraform.io/docs/cli/config/config-file.html)
- Understand about `Terraform CLI Config File` 
1. Windows: terraform.rc

## Step-02: Create terraform.rc in User Home Directory
- On Windows, the file must be named terraform.rc and placed in the relevant user's `%APPDATA%` directory. 
- The physical location of this directory depends on your Windows version and system configuration; use `$env:APPDATA` in PowerShell to find its location on your system.
- On Windows, beware of Windows Explorer's default behavior of hiding filename extensions. 
- Terraform will not recognize a file named `terraform.rc.txt` as a CLI configuration file, even though Windows Explorer may display its name as just `terraform.rc`. 
- Use `dir` from `PowerShell` or `Command Prompt` to confirm the filename.
```t
# Find location where we need to put terraform.rc using Powershell
$env:APPDATA

# Create a Folder in C:\ Drive (C:\Users\Administrator\Documents\)
Folder Name: plugin_cache

Step-03: Update terraform.rc with Plugin Cache Folder

plugin_cache_dir = "C:/Users/Administrator/Documents/plugin_cache"
disable_checkpoint = true

Step-04: Execute Terraform Commands

# Change Directory 
cd 66-Terraform-CLI-Config-File-WindowsOS/terraform-manifests

# Terraform Initialize
terraform init

# Verify the contents in Plugin Cache Directory
C:\Users\Administrator\Documents\plugin_cache
C:\Users\Administrator\Documents\plugin_cache\registry.terraform.io\hashicorp

Step-05: Verify if plugins loaded from Cache

# Change Directory 
cd 66-Terraform-CLI-Config-File-WindowsOS/terraform-manifests

# Remove .terraform Folder which contains plugins
Delete folder .terraform

# Terraform Initialize
terraform init

# Sample Output for Reference
PS C:\Users\Administrator\Downloads\hashicorp-certified-terraform-associate-on-azure-main\hashicorp-certified-terraform-associate-on-azure-main\66-Terraform-CLI-Config-File-WindowsOS\terraform-manifests> terraform init

Initializing the backend...

Initializing provider plugins...
- Finding hashicorp/external versions matching ">= 2.0.0"...
- Finding hashicorp/azurerm versions matching ">= 2.0.0"...
- Finding hashicorp/random versions matching ">= 3.0.0"...
- Using hashicorp/random v3.1.0 from the shared cache directory
- Using hashicorp/external v2.1.0 from the shared cache directory
- Using hashicorp/azurerm v2.65.0 from the shared cache directory

Step-07: Clean-Up

# Remove .terraform Folder which contains plugins
Delete folder .terraform and file: .terraform.lock.hcl

title: Terraform Manage Providers description: Learn to Manage Terraform Providers

Step-01: Introduction

Manage Terraform Providers

terraform providers
terraform version
terraform providers lock
terraform providers mirror
terraform providers schema -json

Step-02: Command: terraform providers

The terraform providers command shows information about the provider requirements of the configuration in the current working directory.

# Change Directory
cd terraform-manifests/

# Terraform Providers
terraform providers

# Sample Output
Kalyans-Mac-mini:terraform-manifests kalyanreddy$ terraform providers

Providers required by configuration:
.
├── provider[registry.terraform.io/hashicorp/external] >= 2.0.0
├── provider[registry.terraform.io/hashicorp/azurerm] >= 2.0.0
└── provider[registry.terraform.io/hashicorp/random] >= 3.0.0

Kalyans-Mac-mini:terraform-manifests kalyanreddy$

Step-03: Command: terraform version

The terraform version displays the current version of Terraform and all installed plugins.

# Change Directory
cd terraform-manifests/

# Terraform Version
terraform version

# Sample Output - Before terraform init
Kalyans-Mac-mini:terraform-manifests kalyanreddy$ terraform version
Terraform v1.0.0
Kalyans-Mac-mini:terraform-manifests kalyanreddy$ 

# Terraform Initialize
terraform init

# Terraform Version
terraform version

# Sample Output - After terraform init
Kalyans-Mac-mini:terraform-manifests kalyanreddy$ terraform version
Terraform v1.0.0
on darwin_amd64
+ provider registry.terraform.io/hashicorp/azurerm v2.65.0
+ provider registry.terraform.io/hashicorp/external v2.1.0
+ provider registry.terraform.io/hashicorp/random v3.1.0
Kalyans-Mac-mini:terraform-manifests kalyanreddy$

Step-04: Command: terraform providers lock

The terraform providers lock consults upstream registries (by default) in order to write provider dependency information into the dependency lock file.
⚠️ The terraform providers lock command prints information about what it has fetched and whether each package was signed using a cryptographic signature, but it cannot automatically verify that the providers are trustworthy and that they comply with your local system policies or relevant regulations. Review the signing key information in the output to confirm that you trust all of the signers before committing the updated lock file to your version control system.

# Change Directory
cd terraform-manifests/

# Terraform Providers lock
terraform providers lock
Observation: 
1. This command will fetch the providers information and create the file named ".terraform.lock.hcl", if we run it for first time in Terraform Working Directory

# Terraform Initialize
terraform init
Observation:
1. This command will reference the ".terraform.lock.hcl" file and download the equivalent providers as per that file.

Step-05: Command: terraform providers lock for all supported platforms

Windows: General use will be developers using Terraform CLI on Desktop
MacOS: General use will be developers using Terraform CLI on Desktop
Linux: General use will be automated pipelines like Azure DevOps (Ubuntu Agents)

What are we doing here?

As we are going to check-in our Dependency Lock file .terraform.lock.hcl to git to lock our provider versions we are ensuring we are generating that file for all platforms so that we don't face any issues when we run our configuration in different OS.
Using multiple platform support providers lock command below, it creates the .terraform.lock.hcl which supports in all 3 environments.
When we run the same Terraform config files in different OS (Linux) with file .terraform.lock.hcl, system will not fail and download that respective provider plugins.

# Backup existing ".terraform.lock.hcl"  file
cp .terraform.lock.hcl .terraform.lock.hcl_macosonly

# Terraform Providers lock for multiple platforms
terraform providers lock -platform=windows_amd64 -platform=darwin_amd64 -platform=linux_amd64

# Diff Dependency lock files
diff .terraform.lock.hcl_macosonly .terraform.lock.hcl

Step-06: Command: terraform providers mirror

The terraform providers mirror command downloads the providers required for the current configuration and copies them into a directory in the local filesystem.

# Change Directory
cd terraform-manifests/

# Create a Mirror Directory (Assuming we are in terraform-manifests folder)
mkdir ../mirror1

# Terraform Providers Mirror
terraform providers mirror ../mirror1

# Verify
ls -lrt ../mirror1/
ls -lrt ../mirror1/registry.terraform.io/hashicorp/

Step-07: Command: terraform providers mirror for multiple platforms

# Change Directory
cd terraform-manifests/

# Create a Mirror Directory (Assuming we are in terraform-manifests folder)
mkdir ../mirror2-multiplatforms

# Terraform Providers Mirror
terraform providers mirror -platform=windows_amd64 -platform=darwin_amd64 -platform=linux_amd64 ../mirror2-multiplatforms/

# Verify
ls -lrt ../mirror2-multiplatforms/
ls -lrt ../mirror2-multiplatforms/registry.terraform.io/hashicorp/
ls -lrt ../mirror2-multiplatforms/registry.terraform.io/hashicorp/azurerm

# Clean-Up
rm -rf ../mirror1
rm -rf ../mirror2-multiplatforms

Step-08: Command: terraform providers schema

The terraform providers schema command is used to print detailed schemas for the providers used in the current configuration.

# Change Directory
cd terraform-manifests/

# Terraform Initialize (Ensure terraform working directory is initialized before schema command)
terraform init

# Terraform Providers Schema
terraform providers schema -json

# Terraform Providers Schema (Format JSON in readable format)
terraform providers schema -json | jq

# Terraform Providers Schema (Format JSON in readable format and store in a file)
terraform providers schema -json | jq > all-providers-schema.json

Step-09: Review the all-providers-schema.json in VS Code

Review the all-providers-schema.json file in VS Code
Review each provider plugin entire schema on a high level.

Step-10: Clean-Up

# Delete .terraform and .terraform.lock.hcl files
rm -rf .terraform*

# Leave this file as is
Will leave this file "all-providers-schema.json" in working directory for reference as is.
```# Exam Preparation

## Step-00: Don't Stop Get Certified
- If you have completed all the sections from 01 to 16, go ahead and get certified. 
- You will definitely pass the exam with 70 to 85% score with above knowledge.
- If you expect to score more and more, then you also need to go through below listed Terraform materials once

## Step-01: Core Topics
1. Understand infrastructure as code (IaC) concepts
2. Understand Terraform's purpose (vs other IaC)
3. Understand Terraform basics
4. Use the Terraform CLI (outside of core workflow)
5. Interact with Terraform modules
6. Navigate Terraform workflow
7. Implement and maintain state
8. Read, generate, and modify configuration
9. Understand Terraform Cloud and Enterprise capabilities

## Step-02: Questions Break down in real exam
- Total: 57 Questions
- 40 to 45 questions mostly will be straight forward, concept oriented questions which we can answer if we implemented above 50 practicals
  - Above all the sections in this course will mostly cover you. 
- 12 questions will be absolute practical oriented about asking some basic commands, asking about how to solve this error message etc. 
  - Practicals above will be hands-on which gives the ability to solve such questions
  - Out of these 12, 4 to 5 might be super tricky but don't worry about them. 


## Step-03: Review Terraform Guides
- [Study Guide](https://learn.hashicorp.com/tutorials/terraform/associate-study)
- [Review Guide](https://learn.hashicorp.com/tutorials/terraform/associate-review)


## Step-04: Review Terraform Language Documentation
- [Terraform Language Guide](https://www.terraform.io/docs/language/index.html)
- Go through this on high-level. Quick walk-through will suffice# Exam Registration

## Step-01: Exam Registration
- Exam is conducted on PSI Exam platform
- **Pre-requisite-1:** You should already have a account on `github.com` so you can use it. The email you have used for github, you should have access to that same email id to check emails. Hashicorp via PSI Exams will communicate on that email id. 
- **Pre-requisite-2:** Create your account on  [youracclaim](https://www.youracclaim.com/) with same email id so when you have completed your exam and certified, your badge will be posted to **youracclaim** so you can share the same in social media platforms like linkedin, and also have a record of your badge online. 
- [Register for Exam](https://hashicorp-certifications.zendesk.com/hc/en-us/articles/360049382552)
- Once registered, email confirmation will be sent to you. 

## Step-02: Review Exam Taker Handbook
- [Exam Taker Handbook](https://hashicorp-certifications.zendesk.com/hc/en-us/articles/360048211571)

## Step-03: System Requirements
- Very very important. 
- Do all the things a day before
- [System Requirements](https://hashicorp-certifications.zendesk.com/hc/en-us/articles/360048446631)
- [Click here to test your system's compatibility](https://syscheck.bridge.psiexams.com/)
- If you are on MAC, you need to provide additional permissions when it asks to run system check like
- Connect Webcam or your laptop inbuilt cam
- Connect Microphone (No Head-Phones)
- Connect wired ehternet line to your laptop or dekstop for good internet speed
- As a fail back internet, enable mobile hotspot on your mobile and put that outside your room to avoid distractions
- Install PSI Secure Browser

## Step-04: Exam Day
- Login 45 mins before to PSI Exam platform
- Exam Launch URL will get enabled 30 mins before scheduled Time
- Complete the checks 
### Step-04-01: First Time checks
- System will ask you for these checks
1. Identity Card Verification
2. 360 Degree Room View
3. Hand Sleeves and Ears check

### Step-04-02: Second Time Checks
- Online Proctor will communicate with you chat and perform these checks
1. Identity Card Verification
2. 360 Degree Room View
3. Hand Sleeves and Ears check

### Step-04-03: Proctor will Release the Exam for you to Start
1. Don't tense.
2. Be cool and start answering questions
3. If you have any doubt about any question, Click on **Flag Button** so we can come back later
4. Don't Flag many questions later difficult to check all of them. 
5. Exam Time: 60 Minutes Questions: 57
6. I took 35 minutes to complete all the questions due to the fact most of the questions (40 to 45) will be straight forward. 
7. Review the questions which you flagged and answer them. 
8. Complete the exam
9. Complete the Survey questions
10. You will get the status of your exam (pass / fail)
11. Email will be sent to you by **youracclaim** with your badge information
12. Email will be sent to you by **HashiCorp** about your score report

radhikari-arch/hashicorp-certified-terraform-associate-on-azure

About

Resources

Stars

Watchers

Forks

Releases

Packages 0

Languages

Packages