Terraform Skill

# backend.tf
terraform {
  backend "s3" {
    bucket       = "my-terraform-state"
    key          = "prod/vpc/terraform.tfstate"
    region       = "us-east-1"
    encrypt      = true
    use_lockfile = true  # Native S3 locking (Terraform 1.10+)
    
    # Optional but recommended
    kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
  }
}

# backend.tf
terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "prod/vpc/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    dynamodb_table = "terraform-state-lock"
    
    # Optional but recommended
    kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
  }
}

# bootstrap/main.tf - Run this ONCE to create state backend
resource "aws_s3_bucket" "terraform_state" {
  bucket = "my-terraform-state"

  lifecycle {
    prevent_destroy = true
  }
}

resource "aws_s3_bucket_versioning" "terraform_state" {
  bucket = aws_s3_bucket.terraform_state.id

  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "terraform_state" {
  bucket = aws_s3_bucket.terraform_state.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.terraform_state.arn
    }
  }
}

resource "aws_s3_bucket_public_access_block" "terraform_state" {
  bucket = aws_s3_bucket.terraform_state.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# MFA Delete for production
# Note: Terraform cannot enable S3 MFA Delete. This must be configured
# outside of Terraform using the AWS CLI or an SDK with the root account.
#
# Example (run once, after bucket creation and versioning are enabled):
#
# aws s3api put-bucket-versioning \
#   --bucket my-terraform-state \
#   --versioning-configuration Status=Enabled,MFADelete=Enabled \
#   --mfa "arn-of-mfa-device mfa-code"

# KMS key for encryption
resource "aws_kms_key" "terraform_state" {
  description             = "KMS key for Terraform state encryption"
  deletion_window_in_days = 30
  enable_key_rotation     = true

  tags = {
    Name = "terraform-state-encryption"
  }
}

resource "aws_kms_alias" "terraform_state" {
  name          = "alias/terraform-state"
  target_key_id = aws_kms_key.terraform_state.key_id
}

# If using DynamoDB locking, add this resource to the above configuration:

# DynamoDB table for state locking
resource "aws_dynamodb_table" "terraform_state_lock" {
  name         = "terraform-state-lock"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "LockID"

  attribute {
    name = "LockID"
    type = "S"
  }

  lifecycle {
    prevent_destroy = true
  }

  tags = {
    Name        = "Terraform State Lock Table"
    Environment = "shared"
  }
}

s3://my-terraform-state/
├── prod/
│   ├── vpc/terraform.tfstate
│   ├── eks/terraform.tfstate
│   └── rds/terraform.tfstate
├── staging/
│   ├── vpc/terraform.tfstate
│   └── eks/terraform.tfstate
└── dev/
    └── vpc/terraform.tfstate

# backend.tf
terraform {
  backend "azurerm" {
    resource_group_name  = "terraform-state-rg"
    storage_account_name = "tfstatestorage"
    container_name       = "tfstate"
    key                  = "prod.terraform.tfstate"
    
    # Optional: Use service principal or managed identity
    use_azuread_auth = true
  }
}

# bootstrap/main.tf
resource "azurerm_resource_group" "terraform_state" {
  name     = "terraform-state-rg"
  location = "East US"
}

resource "azurerm_storage_account" "terraform_state" {
  name                     = "tfstatestorage"
  resource_group_name      = azurerm_resource_group.terraform_state.name
  location                 = azurerm_resource_group.terraform_state.location
  account_tier             = "Standard"
  account_replication_type = "GRS"  # Geo-redundant
  
  # Security settings
  min_tls_version                 = "TLS1_2"
  allow_nested_items_to_be_public = false
  
  blob_properties {
    versioning_enabled = true
  }
}

resource "azurerm_storage_container" "terraform_state" {
  name                  = "tfstate"
  storage_account_name  = azurerm_storage_account.terraform_state.name
  container_access_type = "private"
}

# backend.tf
terraform {
  backend "gcs" {
    bucket = "my-terraform-state"
    prefix = "prod/vpc"

    # For customer-managed encryption, configure the bucket itself with
    # `default_kms_key_name` (see bootstrap below) rather than the backend.
    # The backend's `encryption_key` attribute is for CSEK (a base64-encoded
    # 32-byte AES-256 key), NOT a Cloud KMS resource name.
  }
}

# bootstrap/main.tf
resource "google_storage_bucket" "terraform_state" {
  name          = "my-terraform-state"
  location      = "US"
  force_destroy = false

  versioning {
    enabled = true
  }

  encryption {
    default_kms_key_name = google_kms_crypto_key.terraform_state.id
  }

  uniform_bucket_level_access = true

  lifecycle_rule {
    condition {
      num_newer_versions = 10
    }
    action {
      type = "Delete"
    }
  }
}

resource "google_kms_key_ring" "terraform_state" {
  name     = "terraform-state"
  location = "us-central1"
}

resource "google_kms_crypto_key" "terraform_state" {
  name     = "terraform-state-key"
  key_ring = google_kms_key_ring.terraform_state.id

  rotation_period = "7776000s"  # 90 days
}

# backend.tf
terraform {
  cloud {
    organization = "my-org"
    
    workspaces {
      name = "prod-infrastructure"
      # Or use tags for dynamic workspace selection
      # tags = ["prod", "networking"]
    }
  }
}

# Alternative: Terraform Enterprise with custom hostname
terraform {
  cloud {
    hostname     = "terraform.company.com"
    organization = "my-org"
    
    workspaces {
      name = "prod-infrastructure"
    }
  }
}

# backend.tf - No sensitive values
terraform {
  backend "s3" {
    bucket = "my-terraform-state"
    region = "us-east-1"
    # key, dynamodb_table specified via -backend-config
  }
}

# Pass sensitive config at init time
terraform init \
  -backend-config="key=prod/vpc/terraform.tfstate" \
  -backend-config="dynamodb_table=terraform-state-lock"

# Or use a file
terraform init -backend-config=backend-prod.hcl

User A: terraform apply  (starts)
User B: terraform apply  (starts at same time)
Result: Both read same state, make conflicting changes
        → State corruption
        → Infrastructure drift
        → Potential outages

User A: terraform apply  (acquires lock)
User B: terraform apply  (waits for lock)
Result: Operations are serialized
        → State consistency maintained

terraform {
  backend "s3" {
    bucket       = "my-terraform-state"
    key          = "prod/terraform.tfstate"
    region       = "us-east-1"
    encrypt      = true
    use_lockfile = true  # Enable native S3 locking
  }
}

# Terraform acquires lock
terraform plan
# Creates lock: LockID = "bucket/path/to/state"

# Another user attempts operation
terraform apply
# Sees: Error acquiring the state lock
# Default: `-lock-timeout=0s` — fail immediately on lock contention.
# Set `-lock-timeout=<duration>` (e.g. `5m`) to retry with backoff for the specified window.
#   terraform apply -lock-timeout=5m

# Check DynamoDB for active locks
aws dynamodb scan \
  --table-name terraform-state-lock \
  --projection-expression "LockID,Info"

Error: Error acquiring the state lock

Lock Info:
  ID:        a1b2c3d4-e5f6-7890-abcd-ef1234567890
  Path:      bucket/prod/terraform.tfstate
  Operation: OperationTypeApply
  Who:       user@host
  Created:   2026-01-20 12:00:00.123456789 +0000 UTC

# 1. Verify lock exists
terraform plan
# Note the Lock ID from error message

# 2. Check if operation is actually running
# - SSH to the host if accessible
# - Check CI/CD job status
# - Ask team members

# 3. Only if confirmed stale, force unlock
terraform force-unlock LOCK_ID

# 4. Document why you force-unlocked
git commit -m "Force-unlocked state after CI job termination"

#!/bin/bash
# wrapper-script.sh
LOCK_TIMEOUT=300  # 5 minutes

timeout $LOCK_TIMEOUT terraform apply -auto-approve

if [ $? -eq 124 ]; then
  echo "Terraform timed out - likely lock held"
  exit 1
fi

# GitHub Actions - Use concurrency control
concurrency:
  group: terraform-${{ github.ref }}
  cancel-in-progress: false  # Don't cancel, wait instead

jobs:
  terraform:
    runs-on: ubuntu-latest
    steps:
      - name: Terraform Apply
        run: terraform apply -auto-approve

# .gitlab-ci.yml
terraform-apply:
  script:
    - terraform apply -auto-approve
  resource_group: terraform-prod  # Only one job at a time

terraform {
  backend "s3" {
    bucket     = "my-terraform-state"
    key        = "prod/terraform.tfstate"
    region     = "us-east-1"
    encrypt    = true  # ✅ Always enable
    kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/..."  # Optional: Use customer-managed key
  }
}

// S3 bucket policy
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyInsecureTransport",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::my-terraform-state",
        "arn:aws:s3:::my-terraform-state/*"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::my-terraform-state"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::my-terraform-state/prod/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:DescribeTable",
        "dynamodb:GetItem",
        "dynamodb:PutItem",
        "dynamodb:DeleteItem"
      ],
      "Resource": "arn:aws:dynamodb:us-east-1:*:table/terraform-state-lock"
    },
    {
      "Effect": "Allow",
      "Action": [
        "kms:DescribeKey",
        "kms:Decrypt",
        "kms:Encrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "arn:aws:kms:us-east-1:*:key/*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetObject"
      ],
      "Resource": [
        "arn:aws:s3:::my-terraform-state",
        "arn:aws:s3:::my-terraform-state/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "arn:aws:kms:us-east-1:*:key/*"
    }
  ]
}

# prod-role can only access prod state
resource "aws_iam_role" "terraform_prod" {
  name = "terraform-prod"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          AWS = "arn:aws:iam::123456789012:root"
        }
        Action = "sts:AssumeRole"
      }
    ]
  })
}

resource "aws_iam_role_policy" "terraform_prod_state" {
  role = aws_iam_role.terraform_prod.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "s3:ListBucket",
          "s3:GetObject",
          "s3:PutObject"
        ]
        Resource = [
          "arn:aws:s3:::my-terraform-state",
          "arn:aws:s3:::my-terraform-state/prod/*"  # Only prod path
        ]
      }
    ]
  })
}

# BAD: Secret visible in state
variable "database_password" {
  type      = string
  sensitive = true
  default   = "SuperSecret123!"  # ❌ Still stored in state
}

# Good: Password never stored in state
resource "aws_db_instance" "this" {
  # ... other config ...
  
  manage_master_user_password = true  # AWS generates and stores password
  
  lifecycle {
    ignore_changes = [master_user_secret]
  }
}

# Access password via Secrets Manager
data "aws_secretsmanager_secret_version" "db_password" {
  secret_id = aws_db_instance.this.master_user_secret[0].secret_arn
}

# Good: Fetch secret at runtime, not stored in state
data "aws_secretsmanager_secret_version" "db_password" {
  secret_id = "prod/database/master-password"
}

resource "aws_db_instance" "this" {
  password = data.aws_secretsmanager_secret_version.db_password.secret_string
  # Password still in state, but not hardcoded
}

# After rotation (handled outside Terraform), refresh state so it reflects
# the new value. This does not rotate the secret itself.
terraform apply -refresh-only

resource "aws_s3_bucket_logging" "terraform_state" {
  bucket = aws_s3_bucket.terraform_state.id

  target_bucket = aws_s3_bucket.logs.id
  target_prefix = "terraform-state-access/"
}

# CloudTrail for API-level logging
resource "aws_cloudtrail" "terraform_state" {
  name           = "terraform-state-trail"
  s3_bucket_name = aws_s3_bucket.cloudtrail_logs.id

  event_selector {
    read_write_type           = "All"
    include_management_events = true

    data_resource {
      type   = "AWS::S3::Object"
      values = ["arn:aws:s3:::my-terraform-state/*"]
    }
  }
}

# In bootstrap directory
terraform init
terraform apply

# backend.tf - Add this file
terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "prod/vpc/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    dynamodb_table = "terraform-state-lock"
  }
}

# Backup local state first
cp terraform.tfstate terraform.tfstate.backup

# Migrate to S3
terraform init -migrate-state

# Terraform will ask: "Do you want to copy existing state to the new backend?"
# Answer: yes

# Verify migration
terraform plan  # Should show no changes

# Verify state in S3
aws s3 ls s3://my-terraform-state/prod/vpc/

# Remove local state files
rm terraform.tfstate*

# Commit backend config
git add backend.tf
git commit -m "Migrate state to S3 backend"

# Authenticate the CLI
terraform login

# backend.tf - Change from S3 to cloud
terraform {
  cloud {
    organization = "my-org"
    
    workspaces {
      name = "prod-infrastructure"
    }
  }
}

# Remove old S3 backend config

# Initialize with migration
terraform init -migrate-state

# Confirm migration
# State will be uploaded to Terraform Cloud

# Verify in Terraform Cloud UI or CLI
terraform state list

# Old S3 state remains as backup - don't delete immediately
# Keep for 30-90 days, then remove

# Change backend config in backend.tf

# Re-initialize (will create new empty state)
terraform init -reconfigure

# Import existing resources
terraform import aws_vpc.this vpc-12345678
terraform import aws_subnet.private subnet-abcd1234
# ... import all resources ...

# Or destroy and recreate
terraform destroy  # In old backend
terraform apply    # In new backend

# Before: aws_instance.server
# After:  aws_instance.web_server

terraform state mv aws_instance.server aws_instance.web_server

# Update code to match
# In main.tf: resource "aws_instance" "web_server" { ... }

# Verify
terraform plan  # Should show no changes

# Before: aws_s3_bucket.logs (in root module)
# After:  module.logging.aws_s3_bucket.logs

# Step 1: Create module with resource
# Step 2: Move state
terraform state mv aws_s3_bucket.logs module.logging.aws_s3_bucket.logs

# Step 3: Remove old resource from root module
# Step 4: Add module call
# Step 5: Verify
terraform plan  # Should show no changes

# Move from module.old to module.new
terraform state mv \
  module.old.aws_instance.app \
  module.new.aws_instance.app

# In source state - remove resource
terraform state rm aws_rds_cluster.main

# In destination state - import resource
terraform import aws_rds_cluster.main cluster-identifier

# View current state
terraform state pull

# Save to file
terraform state pull > terraform.tfstate.backup

# View specific resource
terraform state show aws_instance.web

# Restore from backup
terraform state push terraform.tfstate.backup

# DANGEROUS: Overwrites remote state
# Only use for disaster recovery

# List all versions
aws s3api list-object-versions \
  --bucket my-terraform-state \
  --prefix prod/vpc/terraform.tfstate

# Restore specific version
aws s3api get-object \
  --bucket my-terraform-state \
  --key prod/vpc/terraform.tfstate \
  --version-id VERSION_ID \
  terraform.tfstate.restored

# Manual backup before major changes
terraform state pull > backup-$(date +%Y%m%d-%H%M%S).tfstate

# Or in automation
#!/bin/bash
BACKUP_DIR="./state-backups"
mkdir -p $BACKUP_DIR

terraform state pull > "$BACKUP_DIR/terraform.tfstate.$(date +%Y%m%d-%H%M%S)"

# Keep last 30 backups
ls -t $BACKUP_DIR/terraform.tfstate.* | tail -n +31 | xargs rm -f

# If state corrupted
# Step 1: Download last known good version
aws s3api get-object \
  --bucket my-terraform-state \
  --key prod/vpc/terraform.tfstate \
  --version-id PREVIOUS_VERSION_ID \
  terraform.tfstate.recovered

# Step 2: Push recovered state
terraform state push terraform.tfstate.recovered

# Step 3: Verify
terraform plan

# Step 4: If resources drifted, reconcile
terraform apply -refresh-only

removed {
  from = vault_policy.ops

  lifecycle {
    destroy = false
  }
}

my-company-tf-state/
├── dev/
│   ├── networking/terraform.tfstate
│   ├── compute/terraform.tfstate
│   └── data/terraform.tfstate
├── staging/
│   ├── networking/terraform.tfstate
│   └── compute/terraform.tfstate
└── prod/
    ├── networking/terraform.tfstate
    ├── compute/terraform.tfstate
    └── data/terraform.tfstate

my-company-tf-state/
├── networking-team/
│   ├── prod-vpc/terraform.tfstate
│   ├── staging-vpc/terraform.tfstate
│   └── vpn/terraform.tfstate
├── platform-team/
│   ├── prod-eks/terraform.tfstate
│   └── staging-eks/terraform.tfstate
└── data-team/
    ├── prod-rds/terraform.tfstate
    └── prod-redshift/terraform.tfstate

my-company-tf-state/
├── prod/
│   ├── 01-networking/terraform.tfstate  # VPC, subnets
│   ├── 02-platform/terraform.tfstate    # EKS, ALB
│   ├── 03-data/terraform.tfstate        # RDS, Redis
│   └── 04-applications/terraform.tfstate
├── staging/
│   ├── 01-networking/terraform.tfstate
│   └── 02-platform/terraform.tfstate

# outputs.tf in networking module
output "vpc_id" {
  description = "VPC ID for other modules"
  value       = aws_vpc.main.id
}

output "private_subnet_ids" {
  description = "Private subnet IDs"
  value       = aws_subnet.private[*].id
}

output "database_security_group_id" {
  description = "Security group for databases"
  value       = aws_security_group.database.id
}

# data.tf in compute module
data "terraform_remote_state" "networking" {
  backend = "s3"
  
  config = {
    bucket = "my-terraform-state"
    key    = "prod/networking/terraform.tfstate"
    region = "us-east-1"
  }
}

# Use networking outputs
resource "aws_instance" "app" {
  subnet_id              = data.terraform_remote_state.networking.outputs.private_subnet_ids[0]
  vpc_security_group_ids = [data.terraform_remote_state.networking.outputs.database_security_group_id]
}

# Store values in SSM
resource "aws_ssm_parameter" "vpc_id" {
  name  = "/terraform/prod/networking/vpc_id"
  type  = "String"
  value = aws_vpc.main.id
}

# Read from SSM
data "aws_ssm_parameter" "vpc_id" {
  name = "/terraform/prod/networking/vpc_id"
}

resource "aws_instance" "app" {
  subnet_id = data.aws_ssm_parameter.vpc_id.value
}

Error: state snapshot was created by Terraform v1.8.0,
       which is newer than current v1.6.0

# S3 versioning
aws s3api list-object-versions \
  --bucket my-terraform-state \
  --prefix prod/terraform.tfstate

aws s3api get-object \
  --bucket my-terraform-state \
  --key prod/terraform.tfstate \
  --version-id PREVIOUS_VERSION \
  terraform.tfstate.restored

terraform state push terraform.tfstate.restored

# Download newer version
tfenv install 1.8.0
tfenv use 1.8.0

# Verify
terraform version

# List all resources to import
# (You'll need to know what was managed)

# Import resources one by one
terraform import aws_vpc.main vpc-12345678
terraform import aws_subnet.private[0] subnet-abcd1234
terraform import aws_subnet.private[1] subnet-efgh5678
# ... continue for all resources ...

# Verify
terraform plan  # Should eventually show no changes

# import.tf
import {
  to = aws_vpc.main
  id = "vpc-12345678"
}

import {
  to = aws_subnet.private[0]
  id = "subnet-abcd1234"
}

terraform plan -generate-config-out=generated.tf
# Review generated.tf and merge with existing config
terraform apply

# DynamoDB (S3 backend)
aws dynamodb get-item \
  --table-name terraform-state-lock \
  --key '{"LockID":{"S":"my-terraform-state/prod/terraform.tfstate"}}'

# If item exists, lock is held

# Get Lock ID from error message or DynamoDB
terraform force-unlock LOCK_ID

# Confirm when prompted

# GitHub Actions
concurrency:
  group: terraform-${{ matrix.environment }}
  cancel-in-progress: false

jobs:
  terraform:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        environment: [dev, staging, prod]

# backend.tf (partial configuration - key provided dynamically)
terraform {
  backend "s3" {
    bucket = "my-terraform-state"
    region = "us-east-1"
    # Note: Backend configuration does not support interpolation or env vars.
    # Set the key dynamically during init in CI/CD:
  }
}

# In CI/CD workflow (e.g., GitHub Actions):
# terraform init -backend-config="key=pr-${GITHUB_PR_NUMBER}/terraform.tfstate"

# Terraform 0.15.4+
terraform plan -refresh-only

# Shows what's changed in infrastructure vs state

# Update state to match reality (no infrastructure changes)
terraform apply -refresh-only

# Or during regular plan/apply
terraform plan   # Includes refresh
terraform apply  # Updates state

# main.tf
resource "aws_instance" "web" {
  ami           = "ami-12345678"
  instance_type = "t3.micro"
  # ... other attributes ...
}

# Find resource ID
aws ec2 describe-instances --filters "Name=tag:Name,Values=web-server"

# Import
terraform import aws_instance.web i-1234567890abcdef0

# Plan will show attributes that don't match
terraform plan

# Update main.tf to match actual resource
# Or update resource to match main.tf

terraform plan  # Should show no changes

#!/bin/bash
# import-instances.sh

# Get all instance IDs
INSTANCE_IDS=$(aws ec2 describe-instances \
  --query 'Reservations[].Instances[].InstanceId' \
  --output text)

# Import each
for instance_id in $INSTANCE_IDS; do
  terraform import "aws_instance.imported[\"$instance_id\"]" "$instance_id"
done

# Generate configuration from imports
import {
  to = aws_instance.web
  id = "i-1234567890abcdef0"
}

import {
  to = aws_security_group.web
  id = "sg-0123456789abcdef"
}

# Generate configuration
terraform plan -generate-config-out=imported.tf

# Review and merge
terraform apply

# DON'T manually edit state files
vim terraform.tfstate  # ❌ Likely to corrupt

terraform state mv
terraform state rm
terraform import

git add terraform.tfstate  # ❌ No locking, merge conflicts

rm .terraform/terraform.tfstate.lock.info  # ❌ Dangerous