Terraform · Self-assessment
Knowledge checks
Every knowledge check in this course, in curriculum order. Each link opens the page at its quiz. The questions are auto-graded in the browser and nothing is recorded — a wrong answer costs you only the explanation, which is the part worth reading.
- Knowledge checks
- 179
- Parts covered
- 29
- Of all lessons
- 100%
Part I
Infrastructure as Code Foundations
6 checks
- Why Infrastructure as Code ExistsThe operational pain that motivated IaC, the four provisioning approaches, why IaC won, and the production defaults that follow from disciplined adoption.→
- Declarative versus Imperative ProvisioningThe declarative model Terraform implements, the imperative escapes it exposes, and the cost of imperative thinking inside a declarative tool.→
- Terraform in the Infrastructure EcosystemWhere Terraform sits among OpenTofu, Pulumi, Crossplane, Ansible, and vendor-managed IaC, and how to pick the right tool for a given constraint.→
- Reproducibility and the BlueprintThe first principle of IaC reproducibility — same code, same state backend, same provider versions produce the same plan — and the constraints that protect it.→
- Drift: The Tax of Manual InfrastructureConfiguration drift at the IaC level, why it is dangerous, why it is normal, and the three dispositions that keep drift from becoming an outage.→
- Infrastructure Ownership and the Configuration RepositoryWho owns IaC, the boundary between the platform team and the application team, how CODEOWNERS encodes ownership, and the cost of ambiguous ownership.→
Part II
Terraform Architecture
6 checks
- The CLI and Core: What Each DoesThe responsibility boundary between the terraform binary, the embedded core engine, and provider plugins, plus exit codes, JSON output, and CI-relevant CLI flags.→
- Provider Plugins: The Bridge to the Real WorldWhat a Terraform provider is, how providers are sourced and versioned, how plugin discovery and caching work, and the security boundary a provider defines.→
- State and the Resource ModelThe state file as a record of resource IDs and last-known attributes, the conceptual resource model Terraform uses, and how Core decides which provider API calls to make from the diff between configuration and state.→
- The Dependency Graph and ParallelismHow Terraform builds a resource DAG from HCL, how it uses the DAG to order operations and run independent resources in parallel, and what destroy-time graph reversal means for production.→
- Refresh and Plan: How They InteractWhat refresh does, when it runs by default in 1.9.x, the difference between refresh and re-plan, and how -refresh-only and -replace interact with the plan.→
- How Apply Executes a PlanHow terraform apply walks the resource graph, executes per-resource provider operations, manages the state lock, and recovers from partial failure.→
Part III
Installing and Versioning Terraform
6 checks
- Choosing an Installation MethodPart III-Installation - Choosing an Installation Method - Terraform for Production Sysadmins→
- Verifying the InstallationPart III-Installation - Verifying the Installation - Terraform for Production Sysadmins→
- Team-Wide Version RolloutPart III-Installation - Team-Wide Version Rollout - Terraform for Production Sysadmins→
- required_version: The FloorPart III-Installation - required_version: The Floor - Terraform for Production Sysadmins→
- The Dependency Lock FilePart III-Installation - The Dependency Lock File - Terraform for Production Sysadmins→
- Terraform Server and Execution EnvironmentsPart III-Installation - Terraform Server and Execution Environments - Terraform for Production Sysadmins→
Part IV
HCL: The Terraform Configuration Language
7 checks
- HCL Blocks, Arguments, and the Configuration FilePart IV-HCL - HCL Blocks, Arguments, and the Configuration File - Terraform for Production Sysadmins→
- HCL Types and ValuesPart IV-HCL - HCL Types and Values - Terraform for Production Sysadmins→
- Expressions and ReferencesPart IV-HCL - Expressions and References - Terraform for Production Sysadmins→
- Functions for Production CodePart IV-HCL - Functions for Production Code - Terraform for Production Sysadmins→
- Conditional Expressions and For LoopsPart IV-HCL - Conditional Expressions and For Loops - Terraform for Production Sysadmins→
- Writing Readable HCLPart IV-HCL - Writing Readable HCL - Terraform for Production Sysadmins→
- HCL Style and PatternsPart IV-HCL - HCL Style and Patterns - Terraform for Production Sysadmins→
Part V
The Terraform Workflow
7 checks
- fmt and validate: The Cheap GatesPart V-Workflow - fmt and validate: The Cheap Gates - Terraform for Production Sysadmins→
- terraform init: The BootstrapPart V-Workflow - terraform init: The Bootstrap - Terraform for Production Sysadmins→
- terraform plan in DepthPart V-Workflow - terraform plan in Depth - Terraform for Production Sysadmins→
- terraform apply in DepthPart V-Workflow - terraform apply in Depth - Terraform for Production Sysadmins→
- terraform destroy: A Production-Dangerous OperationPart V-Workflow - terraform destroy: A Production-Dangerous Operation - Terraform for Production Sysadmins→
- terraform output and terraform showPart V-Workflow - terraform output and terraform show - Terraform for Production Sysadmins→
- terraform console: Interactive ExplorationPart V-Workflow - terraform console: Interactive Exploration - Terraform for Production Sysadmins→
Part VI
Providers and the Provider Ecosystem
6 checks
- The Provider Plugin ModelHow Terraform Core invokes providers as separate processes over the plugin protocol, where the binaries live, and what that means for production.→
- Provider Sources and RegistriesThe provider source address, the public registry, private registries, and filesystem mirrors — and how to choose between them in production.→
- Provider Versioning and the Dependency LockHow to pin provider versions with `required_providers`, what the `.terraform.lock.hcl` file does, and how to upgrade providers safely.→
- Provider Aliases for Multi-Region and Multi-AccountHow to configure multiple instances of the same provider with `alias`, and the right way to bind a resource to a specific instance.→
- Provider Authentication in ProductionHow the AWS provider discovers credentials, why workload identity and OIDC are the production default, and the operational cost of a leaked credential.→
- Provider Failures and RecoveryHow to recognise, diagnose, and recover from rate limits, API 5xx errors, credential rotation races, and silent provider schema drift.→
Part VII
Resources, Data Sources, and count/for_each
7 checks
- CRUD and the Resource LifecyclePart VII-Resources - CRUD and the Resource Lifecycle - Terraform for Production Sysadmins→
- Resource Attributes and Computed ValuesPart VII-Resources - Resource Attributes and Computed Values - Terraform for Production Sysadmins→
- Resource Replacement and In-Place UpdatesPart VII-Resources - Resource Replacement and In-Place Updates - Terraform for Production Sysadmins→
- Data Sources: Reading Without ManagingPart VII-Resources - Data Sources: Reading Without Managing - Terraform for Production Sysadmins→
- count: Index-Based Resource InstancesPart VII-Resources - count: Index-Based Resource Instances - Terraform for Production Sysadmins→
- for_each: Stable Key-Based Resource InstancesPart VII-Resources - for_each: Stable Key-Based Resource Instances - Terraform for Production Sysadmins→
- Dynamic Blocks for Conditional ConfigurationPart VII-Resources - Dynamic Blocks for Conditional Configuration - Terraform for Production Sysadmins→
Part VIII
Dependencies and the Resource Graph
6 checks
- Implicit Dependencies Through ReferencesHow Terraform infers dependencies from attribute references in expressions, and the silent-misconfig risk when a reference is incidental.→
- Explicit Dependencies with depends_onThe depends_on meta-argument, when to use it, where to place it, and how it interacts with lifecycle and the resource graph.→
- The Dependency GraphHow Terraform builds the resource DAG, the difference between the graph and the execution order, and how to inspect it with terraform graph.→
- Dependency Cycles: Detection and ResolutionHow Terraform detects dependency cycles in the configuration graph, the common shapes that produce them, and how to break them.→
- Parallelism and -parallelismThe -parallelism flag, the per-resource apply thread pool, how to tune it safely, and what happens when one resource in a batch fails.→
- Resource Ordering and Implicit ChainsThe order Terraform plans and applies resources, why ordering matters for IAM, DNS, and state lock, and what destroy order looks like.→
Part IX
State: The Core Production Concept
6 checks
- Why State ExistsPart IX-State-Fundamentals - Why State Exists - Terraform for Production Sysadmins→
- State File StructurePart IX-State-Fundamentals - State File Structure - Terraform for Production Sysadmins→
- Resource Addresses and Real-World MappingPart IX-State-Fundamentals - Resource Addresses and Real-World Mapping - Terraform for Production Sysadmins→
- Configuration, State, and Reality: The ThreePart IX-State-Fundamentals - Configuration, State, and Reality: The Three - Terraform for Production Sysadmins→
- Common State MistakesPart IX-State-Fundamentals - Common State Mistakes - Terraform for Production Sysadmins→
- Exploring the State SafelyPart IX-State-Fundamentals - Exploring the State Safely - Terraform for Production Sysadmins→
Part X
State Operations: Read, Move, Remove, Import
6 checks
- Read-Only Operations: list, show, pullPart X-State-Operations - Read-Only Operations: list, show, pull - Terraform for Production Sysadmins→
- state mv: Renaming Without RecreationPart X-State-Operations - state mv: Renaming Without Recreation - Terraform for Production Sysadmins→
- state rm: Removing From State, Not From RealityPart X-State-Operations - state rm: Removing From State, Not From Reality - Terraform for Production Sysadmins→
- Import: Adopting Existing InfrastructurePart X-State-Operations - Import: Adopting Existing Infrastructure - Terraform for Production Sysadmins→
- replace-provider: Switching Provider NamespacesPart X-State-Operations - replace-provider: Switching Provider Namespaces - Terraform for Production Sysadmins→
- moved Blocks: Declarative RefactoringPart X-State-Operations - moved Blocks: Declarative Refactoring - Terraform for Production Sysadmins→
Part XI
State Security and Lifecycle
6 checks
- State Security ThreatsPart XI-State-Security - State Security Threats - Terraform for Production Sysadmins→
- Sensitive Values in State and VariablesPart XI-State-Security - Sensitive Values in State and Variables - Terraform for Production Sysadmins→
- Encryption at Rest for StatePart XI-State-Security - Encryption at Rest for State - Terraform for Production Sysadmins→
- Backend Access ControlPart XI-State-Security - Backend Access Control - Terraform for Production Sysadmins→
- State Security in the Production PipelinePart XI-State-Security - State Security in the Production Pipeline - Terraform for Production Sysadmins→
- A State Security IncidentPart XI-State-Security - A State Security Incident - Terraform for Production Sysadmins→
Part XII
State Recovery and Backup
6 checks
- State Backups: The Production ControlPart XII-State-Recovery - State Backups: The Production Control - Terraform for Production Sysadmins→
- State Versioning and RetentionPart XII-State-Recovery - State Versioning and Retention - Terraform for Production Sysadmins→
- Restoring State from BackupPart XII-State-Recovery - Restoring State from Backup - Terraform for Production Sysadmins→
- Defence in Depth: Multiple Backup LayersPart XII-State-Recovery - Defence in Depth: Multiple Backup Layers - Terraform for Production Sysadmins→
- RPO and RTO for Terraform StatePart XII-State-Recovery - RPO and RTO for Terraform State - Terraform for Production Sysadmins→
- Testing the Recovery ProcedurePart XII-State-Recovery - Testing the Recovery Procedure - Terraform for Production Sysadmins→
Part XIII
Variables, Outputs, and Locals
6 checks
- Variable Types and ValidationPart XIII-Variables - Variable Types and Validation - Terraform for Production Sysadmins→
- Variable Input PrecedencePart XIII-Variables - Variable Input Precedence - Terraform for Production Sysadmins→
- Sensitive Values and the Production InterfacePart XIII-Variables - Sensitive Values and the Production Interface - Terraform for Production Sysadmins→
- Outputs: The Configuration InterfacePart XIII-Variables - Outputs: The Configuration Interface - Terraform for Production Sysadmins→
- Locals: Internal VariablesPart XIII-Variables - Locals: Internal Variables - Terraform for Production Sysadmins→
- Expressions for Production ConfigurationsPart XIII-Variables - Expressions for Production Configurations - Terraform for Production Sysadmins→
Part XIV
Modules: Reusable Building Blocks
7 checks
- Why ModulesWhy modules exist, the cost of copy-pasted configuration, and the right time to extract a module.→
- Module Structure and ConventionsThe directory layout of a Terraform module, the role of each file, and the conventions that make a module readable.→
- Designing a Module InterfaceThe module's contract: variables, outputs, defaults, input validation, and the discipline that keeps the interface small.→
- Module Sources and VersioningWhere a module lives, how the source is referenced, and the discipline of pinning the version.→
- Testing Modules with terraform testThe native Terraform test framework, the .tftest.hcl files, and the discipline of test coverage.→
- Module Abstraction: Avoiding the God ModuleThe right level of abstraction, the cost of over-abstraction, and the cost of under-abstraction.→
- Module Releases and UpgradesThe release process for a Terraform module: semver, CHANGELOG, breaking-change discipline, and the rollback procedure.→
Part XV
Environment Architecture and State Boundaries
7 checks
- Why Multiple EnvironmentsWhy production Terraform estates use dev, staging, and production - and what each environment is for.→
- Patterns for Multi-Environment EstatesDirectory-per-env, workspace-per-env, and branch-per-env - the three patterns, their trade-offs, and when each is right.→
- Environment Directories with Separate BackendsThe directory-per-environment layout in detail: one root per env, separate state backends, separate tfvars, and the tfvars discipline.→
- Multi-Account and Multi-Project ProductionWhy production estates use one AWS account per environment, per region, or per business unit - and how AWS Organizations and Control Tower fit.→
- State Boundaries as the Unit of FailureHow to draw state boundaries in a production Terraform estate - the discipline that turns state from a liability into a control.→
- Blast Radius in Multi-Environment EstatesHow the state boundary, account boundary, permission boundary, and lifecycle boundary combine to bound the cost of a bad apply.→
- Terraform Workspaces: When and When NotThe OSS workspaces feature - what it does, what it does not do, when it helps, and when it actively hurts production isolation.→
Part XVI
Plan Review and Saved Plans
6 checks
- Plan Symbols: Create, Update, Destroy, ReplacePart XVI-Plan-Review - Plan Symbols: Create, Update, Destroy, Replace - Terraform for Production Sysadmins→
- Reading the Plan: A Disciplined WalkPart XVI-Plan-Review - Reading the Plan: A Disciplined Walk - Terraform for Production Sysadmins→
- Saved Plans and the ContractPart XVI-Plan-Review - Saved Plans and the Contract - Terraform for Production Sysadmins→
- The Production Plan ReviewPart XVI-Plan-Review - The Production Plan Review - Terraform for Production Sysadmins→
- Spotting Risky Network ChangesPart XVI-Plan-Review - Spotting Risky Network Changes - Terraform for Production Sysadmins→
- Spotting State and Identity ChangesPart XVI-Plan-Review - Spotting State and Identity Changes - Terraform for Production Sysadmins→
Part XVII
Drift Detection and Reconciliation
6 checks
- Drift: Configuration, State, and RealityWhat drift is in a Terraform estate, where it comes from in production, and why the gap between declared, recorded, and actual state becomes a liability.→
- Detecting Drift with Refresh-Only PlansHow to detect drift using `terraform plan -refresh-only`, what the -detailed-exitcode values mean, what cadence to run at, and how to alert without auto-remediating.→
- Intentional Drift: When the Real World Is RightIdentifying drift that should stay, codifying it with `lifecycle { ignore_changes }` or by adopting the change into HCL, and the operational cost of each approach.→
- Emergency Manual Changes and ReconciliationMaking an emergency console change to a Terraform-managed resource without orphaning it, absorbing the change with `terraform apply -refresh-only`, and leaving the audit trail a future responder can read.→
- Continuous Drift Detection in ProductionTreating drift detection as a continuous CI discipline: scheduled refresh-only plans, exit-code routing, alert shape, and the cost-versus-frequency trade-off.→
- Investigating Drift: The Production ControlThe triage procedure for a drift finding: read the plan diff, identify the resource, check the provider audit log, and choose the right reconciliation path.→
Part XVIII
Troubleshooting and Recovery
6 checks
- The Troubleshooting MethodologyPart XVIII-Troubleshooting - The Troubleshooting Methodology - Terraform for Production Sysadmins→
- Troubleshooting State IssuesPart XVIII-Troubleshooting - Troubleshooting State Issues - Terraform for Production Sysadmins→
- Troubleshooting Configuration ErrorsPart XVIII-Troubleshooting - Troubleshooting Configuration Errors - Terraform for Production Sysadmins→
- Troubleshooting Apply FailuresPart XVIII-Troubleshooting - Troubleshooting Apply Failures - Terraform for Production Sysadmins→
- Terraform Logging and DebuggingPart XVIII-Troubleshooting - Terraform Logging and Debugging - Terraform for Production Sysadmins→
- The 3 AM Test: Production Under PressurePart XVIII-Troubleshooting - The 3 AM Test: Production Under Pressure - Terraform for Production Sysadmins→
Part XIX
Security: Credentials, Secrets, and Audit
6 checks
- Production Credential PatternsPart XIX-Security - Production Credential Patterns - Terraform for Production Sysadmins→
- Secrets Management for TerraformPart XIX-Security - Secrets Management for Terraform - Terraform for Production Sysadmins→
- Least Privilege for the Terraform Execution RolePart XIX-Security - Least Privilege for the Terraform Execution Role - Terraform for Production Sysadmins→
- IAM and Resource Policies in TerraformPart XIX-Security - IAM and Resource Policies in Terraform - Terraform for Production Sysadmins→
- Auditing Terraform ActionsPart XIX-Security - Auditing Terraform Actions - Terraform for Production Sysadmins→
- Rotating Credentials in ProductionPart XIX-Security - Rotating Credentials in Production - Terraform for Production Sysadmins→
Part XX
Supply Chain: Providers and Modules
6 checks
- Provider Provenance and VerificationHow Terraform resolves a provider, why the registry provenance model matters, how to verify the binary, and how to pin a provider with the dependency lock file.→
- Module Supply ChainThe discipline for internal Terraform modules: where they live, how they are versioned, who can change them, and how often they ship.→
- Evaluating Third-Party ModulesThe checklist, cadence, and approval workflow for adopting a third-party Terraform module from the public registry.→
- Third-Party Module RisksWhat makes a third-party module risky, how the registry trust model works, what maintenance and licence signals to look for, and why pinning is not optional.→
- CI/CD Dependencies and Supply ChainHow the CI/CD pipeline is itself a supply chain: the runner image, the secret storage, the audit trail, and the layers of defence between a PR and a production apply.→
- A Supply Chain IncidentA walkthrough of a third-party supply-chain incident: detection, containment, audit, rollback, and the role of the lock file.→
Part XXI
Testing, Linting, and Static Analysis
6 checks
- The Layered Testing ModelPart XXI-Testing - The Layered Testing Model - Terraform for Production Sysadmins→
- terraform test in DepthPart XXI-Testing - terraform test in Depth - Terraform for Production Sysadmins→
- Mock Providers for Unit TestsPart XXI-Testing - Mock Providers for Unit Tests - Terraform for Production Sysadmins→
- Format and Validate ChecksPart XXI-Testing - Format and Validate Checks - Terraform for Production Sysadmins→
- Linting with tflintPart XXI-Testing - Linting with tflint - Terraform for Production Sysadmins→
- Static Security AnalysisPart XXI-Testing - Static Security Analysis - Terraform for Production Sysadmins→
Part XXII
CI/CD for Production Terraform
6 checks
- The Production Pipeline DesignDesigning a Terraform CI/CD pipeline that catches errors early, gates destructive changes with explicit approval, and stays fast enough to run on every pull request.→
- CI/CD Credentials for TerraformWhy long-lived cloud access keys in CI are a production antipattern, how OIDC federation replaces them, and what the audit trail looks like when you do it right.→
- Controlled Apply: Saved Plans, Approvals, and ConcurrencyHow to apply Terraform in CI: the role of the state lock versus the saved-plan lock, how to ensure only one apply runs at a time, how to surface apply output, and why -target has no safe place in a production pipeline.→
- Plan Artifacts as the Audit TrailWhy the saved plan file is the audit trail of the apply, how it travels from plan stage to apply stage in CI, what it contains, and why it is itself a sensitive artefact.→
- Multi-Environment CI/CDHow to model multiple environments in a Terraform pipeline: one backend per environment, per-environment variable files, the workspaces versus OSS backends trade-off, the promotion model, and how to handle region and account differences.→
- CI/CD Observability and FailuresWhat observability means for a Terraform CI pipeline: plan and apply duration, drift detection failures, state lock contention, how to push metrics to Prometheus or OpenTelemetry, and what silent apply drift costs.→
Part XXIII
Policy as Code
6 checks
- Production Guardrails as CodeThe four classes of Terraform guardrails, the right severity for each, the exception process that does not become a back door, and the cost of over-blocking.→
- Policy Tools: Sentinel, OPA, Trivy, Checkov, tfsecA 2026 production comparison of the five policy tools a Terraform shop will encounter, the trade-offs (managed vs OSS, query language), and how to pick for the team.→
- Writing Effective Policy RulesDeny-by-default structure, the right abstraction level, the test-first authoring workflow, and the failure modes of a rule set that has outgrown its tests.→
- Required Tags and Resource NamingThe mandatory-tagging policy: tag keys, value patterns, propagation to the cloud provider, and the cost of missing tags in billing reconciliation, security audit, and ownership.→
- Encryption-at-Rest and Encryption-in-Transit PoliciesPlan-file and state encryption, KMS key management (rotation, key policy, audit), TLS requirements for the backend, and the audit cadence that proves encryption is in effect.→
- Network Exposure PoliciesThe VPC / subnet pattern codified in a module, CIDR discipline, security group rules as code, and the audit cadence that keeps the network policy enforceable.→
Part XXIV
Upgrading Terraform, Providers, and Modules
6 checks
- Upgrading Terraform CorePart XXIV-Upgrades - Upgrading Terraform Core - Terraform for Production Sysadmins→
- Upgrading Providers SafelyPart XXIV-Upgrades - Upgrading Providers Safely - Terraform for Production Sysadmins→
- Upgrading Internal Modules SafelyPart XXIV-Upgrades - Upgrading Internal Modules Safely - Terraform for Production Sysadmins→
- Testing Upgrades Before ProductionPart XXIV-Upgrades - Testing Upgrades Before Production - Terraform for Production Sysadmins→
- Rollback Plans for UpgradesPart XXIV-Upgrades - Rollback Plans for Upgrades - Terraform for Production Sysadmins→
- Emergency Upgrades in ProductionPart XXIV-Upgrades - Emergency Upgrades in Production - Terraform for Production Sysadmins→
Part XXV
Migrations and Backend Changes
6 checks
- Backend Migration Done RightPart XXV-Migrations - Backend Migration Done Right - Terraform for Production Sysadmins→
- State Migrations and RefactoringPart XXV-Migrations - State Migrations and Refactoring - Terraform for Production Sysadmins→
- Importing Existing InfrastructurePart XXV-Migrations - Importing Existing Infrastructure - Terraform for Production Sysadmins→
- Migration Strategy for 300+ ResourcesPart XXV-Migrations - Migration Strategy for 300+ Resources - Terraform for Production Sysadmins→
- Verifying the MigrationPart XXV-Migrations - Verifying the Migration - Terraform for Production Sysadmins→
- Rollback from a Failed MigrationPart XXV-Migrations - Rollback from a Failed Migration - Terraform for Production Sysadmins→
Part XXVI
Cloud and Platform Operations
6 checks
- Provider-Neutral PatternsPart XXVI-Cloud-Platform - Provider-Neutral Patterns - Terraform for Production Sysadmins→
- Terraform on AWSPart XXVI-Cloud-Platform - Terraform on AWS - Terraform for Production Sysadmins→
- Terraform on AzurePart XXVI-Cloud-Platform - Terraform on Azure - Terraform for Production Sysadmins→
- Terraform with ProxmoxPart XXVI-Cloud-Platform - Terraform with Proxmox - Terraform for Production Sysadmins→
- Terraform + Ansible: The Hand-OffPart XXVI-Cloud-Platform - Terraform + Ansible: The Hand-Off - Terraform for Production Sysadmins→
- Terraform On-PremisesPart XXVI-Cloud-Platform - Terraform On-Premises - Terraform for Production Sysadmins→
Part XXVII
Enterprise Scale: Multi-Team, Multi-Account
6 checks
- Multi-Team Terraform OperationsHow teams draw boundaries inside a shared Terraform estate — state ownership, role mapping, variable scoping, and CODEOWNERS as the boundary enforcer.→
- Multi-Account State BoundariesThe multi-account strategy for production Terraform — one AWS account per environment, per region, or per team; the trade-offs in blast radius, billing, IAM, and networking; and the per-account state pattern.→
- Multi-Region ArchitectureMulti-region IaC for production — per-region state, per-region providers, cross-region references via remote-state outputs, and the failure modes of cross-region state coupling.→
- Monorepo vs PolyrepoThe monorepo layout for Terraform at enterprise scale — every state in one repository, the trade-offs versus polyrepo, the tooling that makes it work, and the migration path from polyrepo.→
- The Repository ArchitectureThe Terraform repository strategy — one repo per state, one repo per module, or monorepo; the trade-offs by team size and policy; and the right CI layout per repo type.→
- Enterprise Module EcosystemThe internal module registry at enterprise scale — private registries, the contract between modules and consumers, the governance that keeps the ecosystem honest, and version pinning as a supply-chain control.→
Part XXVIII
Disaster Recovery and Resilience
6 checks
- RPO and RTO for TerraformTranslating Recovery Point Objective and Recovery Time Objective into Terraform-specific controls: the code repository is the configuration RPO, the state backup is the state RPO, and the runbook is the RTO.→
- State Backend Disaster RecoveryWhen the state file lies and the real world is right - the state-as-source-of-truth failure mode, the right recovery paths (state mv, import, rm, destroy+recreate), and the dangerous recovery (direct state edit without backup).→
- Terraform Execution Environment RecoveryRecovering the execution environment (CI runner images, provider binaries, credentials) in a disaster; the difference between restore-from-backup (state-led) and rebuild-from-code (config-led); and the role of the executable recovery plan.→
- Periodic DR TestingValidating the Terraform DR runbook by exercising it: tabletop review, an actual restore-from-backup in a sandbox, quarterly cadence, sign-off by an owner outside the team that built the runbook.→
- Cross-Region State ReplicationDesigning for a regional cloud outage: a region-agnostic backend, replicated state to a secondary region, the right order of restore (state, secrets, plan), and provider authentication that survives the failover.→
- Restoring the Production EstateState restoration end-to-end: pulling the right version from a versioned bucket, manually editing state only when unavoidable, confirming with `terraform plan`, and the cost of a stale state file in production.→
Part XXIX
Incident Response: The 3 AM Test
6 checks
- Preparing for the 3 AM TestPart XXIX-Incident-Response - Preparing for the 3 AM Test - Terraform for Production Sysadmins→
- Detecting a Production IncidentPart XXIX-Incident-Response - Detecting a Production Incident - Terraform for Production Sysadmins→
- Responding to a Production IncidentPart XXIX-Incident-Response - Responding to a Production Incident - Terraform for Production Sysadmins→
- Break-Glass ProcedurePart XXIX-Incident-Response - Break-Glass Procedure - Terraform for Production Sysadmins→
- Post-Incident ReviewPart XXIX-Incident-Response - Post-Incident Review - Terraform for Production Sysadmins→
- Preventive Measures from IncidentsPart XXIX-Incident-Response - Preventive Measures from Incidents - Terraform for Production Sysadmins→