Terraform with AWS

 

🔐 Getting Started: AWS Setup and Authentication

To manage AWS resources with Terraform, you first need to set up secure authentication. The recommended approach is using IAM roles , especially in CI/CD pipelines, as they provide short-term, rotating credentials.

1. Create an IAM User

You can create a dedicated IAM user for Terraform in the AWS Management Console :

1. Navigate to IAM > Users > Create user.

2. Give the user a descriptive name, such as terraform-user .

3. Select the Access key - Programmatic access option.

4. Attach a policy with the necessary permissions. Adhere to the principle of least privilege; avoid using AdministratorAccess unless strictly necessary .

5. Note the Access Key ID and Secret Access Key after creation, as they are only shown once.

2. Configure Credentials

You can configure the credentials using one of the following common methods:

Option 1: AWS CLI (Recommended)

The cleanest and most secure method is to use the AWS CLI tool, which stores credentials in a secure file .

bash

aws configure
# Then follow the prompts to enter your Access Key ID, Secret Access Key, and default region [citation:9][citation:11].

Option 2: Environment Variables

For temporary sessions or scripts, you can set environment variables .

bash

export AWS_ACCESS_KEY_ID="your-access-key-id"
export AWS_SECRET_ACCESS_KEY="your-secret-access-key"
export AWS_DEFAULT_REGION="us-east-1"

3. Verify Setup

Once configured, you can define a simple Terraform configuration to test the authentication .

hcl

# main.tf
provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "test_vpc" {
  cidr_block = "10.0.0.0/16"
}

Run the following commands to initialize Terraform and see the execution plan:

bash

terraform init   # Sets up the working directory [citation:1][citation:5][citation:11]
terraform plan   # Shows what changes Terraform will apply [citation:7][citation:11]

📁 Best Practices for Production Deployments

1. Project Structure and Modules

For larger projects, a well-structured file system is crucial. Separating configurations by environment and creating reusable modules is a key best practice .

text

terraform-aws-project/
├── modules/            # Reusable infrastructure components [citation:10]
│   ├── vpc/
│   └── ec2/
├── environments/       # Separate environments [citation:8][citation:10]
│   ├── dev/
│   └── prod/
└── global/             # Resources shared across environments

A practical example of this structure is using a VPC module to create a network :

hcl

# modules/vpc/main.tf
module "vpc" {
  source = "../../modules/vpc"
  name   = "my-vpc"
  cidr   = "10.0.0.0/16"
  azs    = ["eu-west-1a", "eu-west-1b"]
  public_subnets  = ["10.0.1.0/24", "10.0.2.0/24"]
  private_subnets = ["10.0.10.0/24", "10.0.20.0/24"]
}

2. Remote State Management

Never store state files locally in production. Using a remote backend, such as Amazon S3 with DynamoDB for state locking, is essential for team collaboration and security .

hcl

# backend.tf
terraform {
  backend "s3" {
    bucket         = "your-terraform-state-bucket" # Must be unique
    key            = "prod/network/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "terraform-locks" # Table for state locking [citation:8]
    encrypt        = true               # Enable server-side encryption [citation:8]
  }
}

Note: You must create the S3 bucket and DynamoDB table manually before initializing Terraform with this backend .

3. Resource Tagging

Always tag your resources for cost allocation, ownership, and operational management. Use the AWS provider's default_tags to automatically apply them to all resources .

hcl

# provider.tf
provider "aws" {
  region = "us-east-1"
  default_tags {
    tags = {
      Environment = var.environment
      ManagedBy   = "Terraform"
      Project     = var.project_name
    }
  }
}

4. Security (Secrets and Permissions)

• Never hardcode secrets: Avoid storing sensitive data like passwords directly in variables or the code .

• Use AWS Secrets Manager: For sensitive information like database passwords, retrieve them using a data source .

• Use AWS IAM Roles: Instead of long-lived access keys, use IAM roles for authentication, especially in CI/CD pipelines .

🔧 Key AWS Services and Community Modules

The Terraform Registry provides a vast library of community modules. You can also build your own to encapsulate and standardize common components like EC2 instances, S3 buckets, and IAM roles .

For example, a module to launch an EC2 instance can be structured as follows :

hcl

# modules/ec2/main.tf
module "ec2" {
  source = "../../modules/ec2"
  name              = "web-server"
  instance_type     = "t3.micro"
  ami               = "ami-0c02fb55956c7d316" # Check for latest AMI
  subnet_id         = module.vpc.public_subnet_ids[0]
  security_group_id = [aws_security_group.web_sg.id]
}

📋 Terraform on AWS Command Cheat Sheet

bash

# Basic Workflow
terraform init      # Initialize the working directory [citation:7][citation:11]
terraform plan      # Preview the changes [citation:7]
terraform apply     # Apply the changes [citation:7]
terraform destroy   # Destroy the infrastructure [citation:7]

# State Management
terraform state list        # List resources in the state [citation:1]
terraform state mv          # Move a resource within the state [citation:1]
terraform import <address> <id> # Import an existing resource into state [citation:1]

# Formatting and Validation
terraform fmt         # Format code to a canonical style
terraform validate    # Validate the configuration syntax

✅ Summary of Best Practices

• Authentication: Use IAM roles and avoid hardcoding long-lived credentials .

• State: Always use a remote backend like S3 with DynamoDB locking for team safety .

• Structure: Organize your code using modules and environment-specific directories .

• Security: Never commit secrets to Git and use services like AWS Secrets Manager .

• Tagging: Apply default tags to all resources for better cost and resource management .

🔗 Learn More

• Practice AWS & Terraform: Interactive labs and exercises https://devops.trainwithsky.com