Terraform on AWS: From First Resource to Production Modules

This is for you if

• You can write basic Terraform but want to design and own a production codebase
• You inherited messy state and need to refactor or split it without destroying anything
• You want an AWS pipeline with no stored access keys
• You are preparing for DevOps, SRE or platform interviews where Terraform comes up

What's inside

• The mental model: configuration, state and reality, and how to read a plan like a reviewer
• S3 backend with native locking (use_lockfile), a hardened state bucket and migration off DynamoDB
• Workspaces versus separate roots, and splitting state by layer to limit blast radius
• Variables, validation, for_each versus count, data sources and guardrails like preconditions and checks
• A full VPC network module lab: multi-AZ subnets, NAT cost toggle, S3 endpoint, EKS-ready tags
• Config-driven refactoring with import, moved and removed blocks, including moving resources between states
• Testing with terraform test and mock providers, tflint, checkov and pre-commit
• GitHub Actions plan and apply with OIDC, separate plan and apply roles, and scheduled drift detection
• Troubleshooting playbook, production checklist, OpenTofu notes, cheat sheet and a 30-day plan

After this guide you can

• Set up remote state on S3 with locking and recover from stuck locks or deleted state
• Design, test and version a reusable module that other teams can consume safely
• Refactor live infrastructure with clean plans: no surprise destroys
• Build a keyless CI/CD pipeline for Terraform on AWS with GitHub OIDC
• Detect and resolve drift, and explain every design decision in an interview

Contents

1. The mental model: how Terraform really worksp. 4
2. Providers, authentication and versionsp. 9
3. State: S3 backend, locking and environmentsp. 16
4. The language: variables, locals, outputs, loops and datap. 27
5. Module design and the VPC network labp. 36
6. Refactoring safely: import, moved and removedp. 49
7. Testing: validate, tflint, checkov and terraform testp. 57
8. CI/CD with GitHub OIDC, and driftp. 66
9. Troubleshooting playbookp. 79
10. Production checklist and design decisionsp. 82
11. Interview questionsp. 85
12. Cheat sheetp. 92
13. 30-day practice planp. 95