book

Terraform in Depth

Name: Terraform in Depth
Author: Robert Hafner
ISBN: 9781633438002

by Robert Hafner

March 2025

Intermediate to advanced

504 pages

15h 38m

English

Manning Publications

Read now

Unlock full access

Terraform in Depth
Copyright
dedication
contents
front matter
forewordsprefaceacknowledgmentsabout this bookWho should read this book?How this book is organized: a roadmapAbout the codeliveBook discussion forumOther online resourcesabout the authorabout the cover illustration
Part 1. Getting started with Terraform
1 A brief overview of Terraform
1.1 Infrastructure as code1.1.1 Software development practices with IaC1.1.2 Repeatability and shareability1.1.3 Continuous integration and deployment1.2 Terraform overview1.2.1 Terraform language1.2.2 Terraform CLI and core1.2.3 Providers1.2.4 Vendors1.2.5 Backends1.2.6 Workspaces1.3 Declarative languages1.3.1 Declarative vs. imperative languages1.3.2 Dependency resolution1.3.3 Pitfalls of declarative languages1.4 Terraform deployment flow1.4.1 Change desired1.4.2 Init1.4.3 Plan1.4.4 Apply1.5 What are people using this for?1.5.1 Machine learning training1.5.2 API and web services1.5.3 Single sign-on authentication structure1.5.4 Rapid prototyping1.6 Terraform and OpenTofu1.6.1 HashiCorp’s history with open source1.6.2 HashiCorp license changes1.6.3 Community reactions1.6.4 OpenTofu fork1.6.5 OpenTofu and Terraform compatibility1.6.6 Using OpenTofuSummary
2 Terraform HCL components
2.1 Hello World2.1.1 Research and design2.1.2 Creating the project2.1.3 Setup providers2.1.4 Getting our configuration values2.1.5 Creating an instance2.1.6 Running Terraform2.2 Block syntax2.2.1 Block types2.2.2 Labels and subtypes2.2.3 Arguments and subblocks2.2.4 Attributes2.2.5 Ordering2.2.6 Style2.3 Terraform settings2.3.1 Backend and cloud blocks2.3.2 Experiments2.4 Providers2.4.1 Provider registry2.4.2 Required providers2.4.3 Provider configuration2.4.4 Provider aliases2.5 Resources2.5.1 Resource usage2.6 Data sources2.7 Meta arguments2.7.1 Providers2.7.2 Lifecycle2.7.3 Explicit dependencies2.8 Modules2.9 Import, moved, and removedSummary
3 Terraform variables and modules
3.1 Modules3.1.1 Module usage3.1.2 Module file structure3.1.3 Root module3.1.4 Submodules3.1.5 Module registries3.2 Input, output, and local variables3.3 Input variables3.3.1 Defining and using inputs3.3.2 Marking variables as sensitive3.3.3 Using types for robust code3.4 Outputs3.4.1 Defining and using outputs3.4.2 Sensitive outputs3.4.3 Output dependencies3.5 Locals3.5.1 Defining and using locals3.6 Value types3.6.1 Strings3.6.2 Numbers3.6.3 Booleans3.6.4 Lists3.6.5 Sets3.6.6 Tuples3.6.7 Objects3.6.8 Maps3.6.9 Null3.6.10 Any3.7 Validating inputs3.8 A reusable instance module3.8.1 Refactoring into a module3.8.2 Using input variables to customize behavior3.8.3 Adding output variables to encourage reuse3.8.4 Testing our changes3.8.5 PublishingSummary
4 Expressions and iterations
4.1 Expanding our module4.1.1 Research4.1.2 Adding a name and tags4.1.3 Allowing multiple instances4.1.4 Creating a role4.1.5 Enabling the session manager4.1.6 Reviewing our work4.2 Operators and conditionals4.2.1 Math4.2.2 Comparison4.2.3 Boolean operators4.2.4 Conditional (Terraform’s ternary operator)4.2.5 Order4.3 Functions4.3.1 Calling and using functions4.3.2 The standard library4.3.3 Pure vs. impure functions4.4 Strings and templates4.4.1 The file function4.4.2 The templatefile function4.4.3 String template language4.4.4 The template_file resource4.4.5 When not to use templates4.5 Regular expressions4.5.1 Regex4.5.2 Regexall4.5.3 Replace4.6 Type conversion4.6.1 Implicit type conversion4.6.2 The toType functions4.6.3 Sensitive and nonsensitive4.7 Try and can4.8 count and for_each4.8.1 count4.8.2 for_each4.8.3 Accessing attributes4.8.4 Limitations and workarounds4.9 For4.9.1 List and object inputs4.9.2 List and object outputs4.9.3 Filtering4.9.4 Grouping mode4.9.5 Splat4.10 Dynamic blocksSummary

5 The Terraform plan
5.1 Directed acyclic graphs5.1.1 DAGs5.1.2 A Transport Layer Security example5.2 The Terraform resource graph5.2.1 Nodes5.2.2 terraform graph command5.2.3 Modules in the graph5.3 Plan5.3.1 Planning modes5.3.2 Replace (previously known as taint)5.3.3 Resource targeting5.3.4 Disabling refresh5.3.5 terraform refresh command5.3.6 Reviewing plan files with terraform show5.4 Root-level module input variables5.4.1 Interactive5.4.2 Variable flag5.4.3 Variable files5.4.4 Environment variables5.4.5 Input precedence5.4.6 A note on secrets and inputs5.5 Apply5.5.1 Plan and apply in a single command5.5.2 Using a plan file5.5.3 Destroy5.6 Apply and plan options5.6.1 Parallelism5.6.2 Locking5.6.3 JSON5.6.4 Formatting flags5.7 Common pitfalls and errors5.7.1 Circular dependencies5.7.2 Cascading changes5.7.3 Hidden dependencies5.7.4 Always detected changes5.7.5 Calculated values and iterations5.7.6 Failed state updatesSummary
Part 2. Terraform in production
6 State management
6.1 Purpose of state6.1.1 Real-world linkage6.1.2 Reduced complexity6.1.3 Performance6.1.4 State-only resources6.2 Important considerations6.2.1 Resiliency6.2.2 Security6.2.3 Availability6.3 Dissecting state6.3.1 State as JSON6.3.2 State versions6.3.3 Lineage and serial6.3.4 Resources, outputs, and checks6.4 Storing state6.4.1 Possible backends6.4.2 Configuring the backend Itself6.4.3 Backend block6.4.4 Alternative authentication methods6.4.5 Cloud block6.4.6 Migrating backends6.4.7 Workspaces6.4.8 Upgrading backends6.5 Manipulating state6.5.1 Backup and restore6.5.2 Code-driven changes6.5.3 CLI-driven changes6.5.4 Manually editing6.6 State drift6.6.1 Accidental manual changes6.6.2 Intentional manual changes6.6.3 Conflicting automated changes6.6.4 Terraform errors6.7 Accessing state across projects6.7.1 terraform_remote_state6.7.2 Structuring for remote state6.7.3 Alternatives to terraform_remote_state6.8 State-only resources6.8.1 Random provider6.8.2 Time provider6.8.3 Null provider6.8.4 terraform_dataSummary
7 Code quality and continuous integration
7.1 Continuous integration practices7.1.1 SCM7.1.2 Branching and PRs7.1.3 Code reviews7.2 Local development7.2.1 Standardizing and bootstrapping with software templates7.2.2 Repeatable tasks with makefiles7.2.3 Installing applications with makefiles7.2.4 Terraform and OpenTofu7.2.5 Terraform and OpenTofu versions7.2.6 Pre-commit hooks7.3 Tools for maintaining quality7.3.1 terraform validate7.3.2 Terratest and Terraform testing7.3.3 TFlint7.4 Validating security7.4.1 Checkov7.4.2 Trivy (formally TFSec)7.4.3 Snyk, Checkmarx, and Mend7.5 Custom policy enforcement7.5.1 OPA with TFLint7.5.2 Custom Checkov rules7.6 Automating chores7.6.1 terraform-docs7.6.2 terraform fmt7.6.3 tflint autofix7.7 Enforcing quality with CI systems7.7.1 Selecting a CI system7.7.2 Building the basic workflows7.7.3 Validating both OpenTofu and Terraform7.7.4 Branch protection and required pipelines7.7.5 Automated updates with DependabotSummary
8 Continuous delivery and deployment
8.1 Delivering modules8.1.1 Semantic versioning and constraints8.1.2 SCM-based module delivery8.1.3 Public software registries8.1.4 Private registries8.1.5 Artifactory8.2 Deploying infrastructure8.2.1 What is a deployment?8.2.2 Environments8.2.3 CD8.2.4 Deployment requirements and limitations8.3 GitOps8.3.1 GitOps development workflows8.3.2 Continuous reconciliation8.3.3 GitOps and CD platforms8.4 Project structures8.4.1 Application as root module8.4.2 Environment as root module8.4.3 Terragrunt8.5 Managing secrets8.5.1 OpenID Connect8.5.2 Secret managers8.5.3 Orchestrator Settings8.6 CD platform features8.6.1 Common features8.6.2 Terraform vs. OpenTofu8.6.3 State management and private registry8.6.4 Drift detection and correction8.6.5 IaC frameworks8.6.6 Policy enforcement8.6.7 Infrastructure cost estimates8.7 CD platform overview8.7.1 HCP Terraform8.7.2 Env0 and Spacelift8.7.3 Scalr8.7.4 Digger and Terrateam8.7.5 Harness and Octopus Deploy8.7.6 Atlantis and TerrakubeSummary
9 Testing and refactoring
9.1 The theory of IaC testing9.1.1 What to test (and what not to test)9.1.2 How IaC testing differs from software testing9.1.3 Terraform testing frameworks9.1.4 Unit testing vs. integration testing9.2 Testing IaC in practice9.2.1 Simple testing flow9.2.2 Starting with examples9.2.3 Concurrency and automated testing9.2.4 Timeouts9.2.5 Automatic cleanup9.2.6 Authentication and secrets9.2.7 Testing as code9.3 Terratest9.3.1 Getting started with Go9.3.2 Terratest Hello World9.3.3 Building on examples9.3.4 Terratest helpers9.3.5 Updating our makefile and template9.3.6 Testing with CI9.3.7 Terratest and Copilot9.4 Terraform testing framework9.4.1 Hello World9.4.2 Accessing named values9.4.3 Mocks9.4.4 Building on examples9.4.5 Managing versions9.4.6 Testing with CI9.4.7 Terraform testing framework and Copilot9.5 Refactoring9.5.1 Refactoring vs. development9.5.2 Internal vs. external refactoring9.5.3 Reorganizing your project9.5.4 Renaming resources and modules9.5.5 Renaming variables9.6 External refactoring9.6.1 When to break compatibility9.6.2 Planning your next major version9.6.3 Building your next major version9.6.4 Maintaining your previous major versionSummary
Part 3. Advanced Terraform topics
10 Advanced Terraform topics
10.1 Names and domains10.1.1 Naming considerations10.1.2 Hierarchical naming schemes10.1.3 Domains10.2 Network management10.2.1 Subnetting with Classless Inter-Domain Routing10.2.2 Common topologies10.2.3 Location module10.2.4 High-level module10.3 Provisioners10.3.1 Connections10.3.2 Command provisioners10.3.3 File provisioners10.3.4 Provisioner control10.3.5 terraform_data10.3.6 Alternatives to using provisioners10.4 External provider10.4.1 External datasource10.4.2 Wrapper program languages10.4.3 Writing wrapper programs10.4.4 Alternatives to external providers10.5 Local provider10.5.1 Functions10.5.2 Data sources10.5.3 Resources10.6 Checks and conditions10.6.1 Preconditions and postconditions10.6.2 Checks10.7 OpenTofu and Terraform compatibility10.7.1 Tofu files10.8 When Terraform isn’t appropriate10.8.1 Kubernetes10.8.2 Container image building10.8.3 Machine image building10.8.4 Artifact managementSummary
11 Alternative interfaces
11.1 Wrapping Terraform11.1.1 JSON output and machine-readable UI11.1.2 Initial Terraform client11.1.3 Init11.1.4 A detour into testing11.1.5 Validating11.1.6 State11.1.7 Apply11.1.8 Plan11.1.9 Output11.1.10 Using our library11.2 Using JSON instead of HCL11.2.1 JSON structure11.2.2 Expressions and keywords11.2.3 Comments11.3 Cloud Development Kit for Terraform11.3.1 Should I use CDKTF?11.3.2 CDKTF setup11.3.3 Apps, stacks, and resources11.3.4 CDKTF usageSummary
12 Terraform providers
12.1 Design12.2 Developer environment12.2.1 Template12.2.2 Developer overrides12.3 Terraform Plugin Framework features12.3.1 Schemas12.3.2 Error handling and logging12.3.3 Testing12.4 Provider interface12.4.1 Template cleanup12.4.2 Provider model and schema12.4.3 Provider configuration12.4.4 Provider testing12.5 Data source12.5.1 Data source schema12.5.2 Configure12.5.3 Read12.5.4 Registration12.5.5 Usage12.5.6 Testing12.6 Resources12.6.1 Resource schema12.6.2 Resource configure12.6.3 Resource create12.6.4 Resource read12.6.5 Resource update12.6.6 Resource delete12.6.7 Registration12.6.8 Testing12.7 Functions12.7.1 Function definition12.7.2 Function run12.7.3 Registration12.7.4 Testing12.8 Publishing12.8.1 Updating documentation12.8.2 Creating a GPG key12.8.3 Registering the provider12.8.4 Creating a releaseSummary
index

Content preview from Terraform in Depth

7 Code quality and continuous integration

This chapter covers

Learning from software development
Developing locally as a team
Code quality tools
Securing infrastructure
Automating chores
Ensuring quality automatically

Infrastructure as code (IaC) provides a number of benefits, but one of the biggest is that it allows the industry to apply the lessons learned from decades of software development to managing infrastructure. Software development has been around since the 1950s, and it’s an understatement to say that it has evolved quite a bit since then. Not only have the languages software developers used grown to take on new complexity and functionality, but the tools they use have also grown to make tackling that complexity feasible.

When developing ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781633438002Publisher Support Publisher Website

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Terraform in Depth

by Robert Hafner

7 Code quality and continuous integration

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.