Terraform Authoring and Operations Professional 2026

Learn how Terraform is used in automation environments, including init, plan, apply, destroy, CLI options, and how automation workflows with git, security checks, and manager approvals replace manual operator workflows.

Explore the Terraform CLI commands and their options, including init, plan, apply, destroy, and fmt, with help flags and version changes for automated and manual workflows.

Set input=false in the Terraform CLI to avoid prompts in automated environments, making plan and apply fail immediately when values are missing, including during init with S3 backends.

Discover the importance of the no color flag in Terraform CLI, learn how color indicates create, update, and destroy, and see how no color improves automation and script readability.

Learn how Terraform plugin caching stores provider binaries in a local cache directory to speed up init and reduce bandwidth, with practical steps and benefits.

Learn practical steps to enable Terraform provider plugin caching across Windows and Linux. Create a cache directory and configure either Terraform RC or an environment variable to point to it.

Explore the explicit installation method with a file system mirror for Terraform provider plugins. Learn to prepare a local or NFS mirror for airgapped environments and run Terraform init offline.

Set up a file system mirror to download and serve Terraform provider plugins locally with the terraform providers mirror command, and configure the terraform rc file to fetch from mirror.

Explore static analysis for infrastructure as code with Terraform, focusing on Checkov to scan tf files, detect security issues, and enforce best practices before production.

Learn how to install Checkov on Linux, using Ubuntu 24.04 LTS, across AWS and DigitalOcean, including SSH setup, apt lock handling, and post-login verification.

Scan Terraform files with Checkov to identify secrets, misconfigurations, and best-practice gaps, explore severity-based guidance, and tailor checks for production deployments.

Save a terraform plan to a file and apply from that plan to guarantee configuration consistency. The lecture covers infra dot plan, plan files, and terraform show for json output.

Learn how code level and plan level scans using Checkov to detect security risks in Terraform, including leveraging saved plans and plan JSON with custom policies for secure deployments.

Set the TF_IN_AUTOMATION environment variable to a non-empty value to minimize Terraform init output in CI/CD pipelines, keeping essential details like provider versions and suggested steps.

Discover how Terraform import now generates both the state file and Terraform configuration for manually created resources, enabling end-to-end management from version 1.5 onward.

Create a security group manually in aws ec2, then import it into terraform using import blocks, generate configuration with plan, and apply changes to manage the resource in terraform.

Use the target flag to apply changes to a single resource (for example local_file.foo) in a multi-file Terraform project, instead of applying to all resources during plan, apply, or destroy.

Define random integer resource in Terraform with a min and max to generate value in range, then use it to avoid bucket name collisions in dev, staging, and testing environments.

Explore Terraform resource targeting and dependencies, using a random integer to name an S3 bucket, and show how targeting a resource can trigger updates to dependent resources.

Learn how moved blocks in Terraform handle renaming by moving from old to new addresses without recreation, update the state file, and ensure safe, visible changes for the team.

Explore how to use escape sequences in Terraform's quoted strings to safely include quotes, backslashes, and new lines in local file content like friends.txt.

Discover how here docs let Terraform store multi-line strings clearly, replacing long escape sequences. See uses for local file resources and scripts, plus scenarios like user data and IAM policies.

Explore the components of here doc strings—the marker, delimiter, and line break—and compare basic versus indented forms, including how whitespace is preserved or stripped in Terraform outputs.

Understand how Terraform handles leading whitespace in heredoc strings, comparing basic and indented here docs, and how the shortest leading spaces are removed from all lines to preserve indentation.

Learn how Terraform data sources fetch information outside Terraform to create flexible, modular code. Review DigitalOcean, local file, and AWS EC2 examples, and note how data is stored in state.

Explore HashiCorp Terraform documentation to learn how data sources work, distinguish them from resources, and identify available data sources for providers like AWS, GCP, and Azure.

Learn the Terraform data source format, using data blocks to fetch EC2 instance details. Use filters and single vs multiple instance sources to retrieve IDs and IPs.

Use a Terraform data source to fetch the latest operating system image from AWS and launch an EC2 instance, avoiding hard-coded AMI IDs across regions.

Learn to fetch the latest Amazon machine image using a Terraform data source and reference its id in an EC2 resource, avoiding hard-coded AMI IDs.

Learn how input variable validation in Terraform prevents plan-only errors by enforcing provider and user side constraints, such as minimum password length and naming rules, to align plan and apply.

Learn to enforce input variable validation in Terraform with a validation block that uses a length-based condition on var.db_password and a clear error message for a minimum of 12 characters.

Explore flexible input variable validation in Terraform by using contains, regex, and length checks to constrain instance types, emails, and ami IDs.

Learn to enforce constraints with Terraform preconditions and postconditions, such as launching EC2 instances only if they are free tier eligible, and validate post launch attributes.

Describe check blocks in Terraform, including nested data sources and assert blocks, to validate external infrastructure without blocking execution, with examples like website health and AWS budget.

Explore how the Terraform sensitive parameter protects secrets by redacting passwords in CLI output and logs, with examples using local file and local sensitive file resources during plan and apply.

Discover how HashiCorp Vault securely stores secrets, enables dynamic secrets with automatic rotation, and encrypts data, boosting access management for developers.

Overview of the vault provider in Terraform, showing how to read secret/DB_creds and output credentials, and noting the AWS engine for IAM keys and state security.

Understand Terraform's resource behavior and how apply actions create, update, or destroy infrastructure. Use the lifecycle meta argument to ignore changes, such as tag updates, in production scenarios.

Explore the lifecycle meta argument in Terraform, covering ignore_changes, create_before_destroy, prevent_destroy, and replace_triggered_by, and understand how these options shape resource behavior and replacement strategies.

Explore the create before destroy lifecycle argument in Terraform, which creates a new EC2 instance first and then destroys the old one when updating attributes like ami id.

Explore the life cycle block's prevent_destroy argument and how setting it to true prevents resource destruction during terraform destroy. Protection applies only when the resource block stays in configuration.

Explore how the ignore_changes argument in Terraform's life cycle block preserves desired state by ignoring manually altered attributes on EC2 instances, such as tags and instance_type during plan and apply.

Explore how the list data type in Terraform stores multiple values for a variable or argument with square brackets, enabling scenarios like VPC security group IDs and outputs.

Learn how map data type in Terraform stores key-value pairs, ideal for AWS tags, and how it differs from lists. Define maps with default values and apply them to resources.

Explore the object data type in Terraform, contrast it with maps, and learn how a defined structure with key-specific types allows varying values while extra fields are discarded.

Explore how Terraform variable types can nest to create highly structured configurations, including list of lists, list of maps, map of maps, map of lists, and list of objects.

Learn how to fetch values from nested variable types in Terraform, count inner lists with the length function, and reference specific elements across lists, maps, and objects.

Explore the challenges of using the Terraform count meta-argument, including index-based resource identification, impact of list reordering, and when to prefer count for identical resources over for_each.

Explore how the set data type in Terraform ensures uniqueness by removing duplicates, contrasts with lists' indexing, and shows that sets are unordered and track only element presence.

Explore how Terraform's foreach meta-argument creates multiple resource instances from a map or set, with examples using AWS IAM users and map key-value pairs.

Explore how Terraform conditional expressions pick between two values based on environment and region to determine EC2 instance types, such as t2.micro or m5.large, in plan outputs.

Explore the basics of for expressions in Terraform, transforming list elements to uppercase with the upper function and iterating over var.user_names, including maps.

Explore the basics of the csvdecode function in Terraform, decoding csv files into a list of maps by mapping headers to values and using the file function to fetch data.

Explore for expressions in Terraform with lists, maps, and tuples; learn key and value access, two-symbol forms, filtering with if, and producing object or tuple outputs.

Explore creating multiple aws_instance resources from a csv by using csv decode to transform data into a map with a for expression, and applying for_each.

Explore nested loops in Terraform for expressions, using an outer and inner loop to combine elements from var.list_zero_one and var.list_zero_two and generate outputs.

Learn how the flatten function converts nested lists into a single list, and how the distinct function removes duplicates in Terraform, with lists, maps, and tag data examples.

Learn how Terraform templates use the template file function to replace placeholders in external config files, enabling dynamic nginx configurations across environments.

Learn to use Terraform templates to manage lists and maps with for expressions, iterating DNS IPs and map keys. Understand newline suppression with tilde for clean, accurate config output.

Practice Terraform data extraction with for expression on a sample json config to retrieve server names, ips, environments, and roles, using flatten, distinct, and join to shape outputs.

Create inbound and outbound AWS VPC security group rules from a CSV data source in Terraform, using CSV decode and for_each to apply data dynamically.

Create security group ingress and egress rules from a CSV with nonunique names, using an index to build a unique map and apply changes with Terraform plan and apply.

Create an inbound security group rule from CSV data, handling port ranges with can, split, and foreach in Terraform.

Learn to create AWS VPC security group ingress rules in Terraform using CSV and JSON data, decoding files, mapping names, and applying dynamic rules without file modification.

Explore how Terraform settings in the Terraform block pin minimum Terraform versions and specific provider versions using version constraints to ensure compatibility.

Learn how to use Terraform backends to store the state remotely, replacing local state with a central backend like S3 for collaboration, locking, and secure access.

Configure a central S3 backend for Terraform by creating an S3 bucket, setting the key and region, and using aws cli credentials; initialize and apply to store state in S3.

Explain how Terraform uses state file locking to prevent concurrent writes, show how a lock blocks plans, and cover automatic and force unlocking, with emphasis on local backend support.

Enable reliable Terraform state locking by integrating a DynamoDB table with an S3 backend, storing lock details in DynamoDB while the state remains in S3.

Learn to manage Terraform state with an S3 backend using commands like terraform state list, show, pull, rm, mv, env, and replace provider to safely view, relocate, and adjust resources.

Learn how the remote state data source enables cross-team access to Terraform outputs stored in an S3 bucket. Use fetched IPs to whitelist addresses in firewall rules.

Fetch an elastic IP address from the networking team's remote state in S3 using the remote state data source, and apply it to the security group rule.

Explore the Terraform testing framework and automated test workflow with Terraform test, covering plan and apply stages, input validation, and S3 bucket examples for robust module testing.

Discover how to author Terraform tests in .tf test.cl or .tf test.json files, define run blocks, and use plan or apply to validate AWS security groups.

Learn to write granular Terraform tests using assert blocks within run blocks, validating conditions like bucket name length with the length function, and interpreting plan-time feedback during Terraform test.

Explore root level attributes in Terraform tests, including multiple run blocks, a variables block, and a providers block. Learn how test files override main configuration and specify region-specific providers.

Discover how Terraform modules enforce the dry principle by standardizing and centralizing infrastructure templates, enabling teams to reuse EC2, VPC, and other modules across projects.

Create an AWS EC2 instance using a Terraform module to reduce code, standardize configurations, and enforce security best practices, via Terraform init, plan, apply, and destroy.

Remember that not all Terraform modules create resources automatically. Some require subnet IDs and a cluster name; read the module documentation for inputs and structure, including IAM and EC2.

Learn how to select a reliable Terraform module by checking downloads, GitHub activity, documentation, version history, and maintainers, including HashiCorp partner modules and AWS modules.

Design a base module structure for Terraform with a modules folder and a teams folder. Teams reference EC2, IAM, VPC, and S3 modules to tailor infrastructure.

Create a simple EC2 module within the modules folder, add main.tf, and learn to reference it from teams; compare internal modules with publicly hosted ones and their options.

Define and reference Terraform modules from sources using the module block and source argument, including local path, git, GitHub, Bitbucket, S3, and Terraform registry; pin versions with the version block.

Reference the EC2 module via a local path using dot slash and dot dot slash, then run terraform init and terraform plan to create a T2 micro EC2 instance.

Remove hard coded values in custom module code, such as region, ami, and instance type, enable overrides, and add a required provider block with a compatible version constraint.

Learn to convert hard-coded values into variables in Terraform modules to let callers override settings and improve flexibility, including instance types like t2.micro or m5.large.

Discover how to convert hardcoded values to variables in a Terraform module, declaring ami, instance_type, and region, and override them in the calling module.

Replace hard-coded provider blocks with a required_providers block for the HashiCorp AWS provider, add version constraints, and simplify region handling for reliable terraform init and plan.

Learn how module outputs enable cross-project collaboration by exposing the EC2 instance id from a module and using it to attach an elastic IP to the created instance.

Understand root module as the entry point in the main Terraform working directory and how it calls a child module like the EC2 or SG module to build infrastructure.

Learn the standard module structure defined by HashiCorp, including the minimal layout of readme, main.tf, variables.tf, and outputs.tf, and how to organize Terraform into reusable modules for production environments.

Move blocks migrate a long-lived terraform configuration to a module, via an s3 bucket. Learn to specify from and to addresses, and run plan and apply for a clean transition.

This lecture shows configuring multiple provider configurations in terraform modules using aliases and a providers map. It demonstrates passing aliased providers to a child module to place resources in regions.

Terraform refactoring use case one, renaming a resource with count, and using moved blocks to migrate addresses from old to new names without recreating resources.

Refactor two ec2 resources into a single aws_instance block using count to manage identical ami and instance type, update state, plan, and apply without unnecessary recreations.

Enable for_each for existing resources by refactoring use case three, using a map of instance data to vary ami and instance type across EC2 blocks.

Learn how to refactor a Terraform module to enable count for AWS IAM user resources, ensure unique names, and safely migrate existing resources using moved blocks and index-based addressing.

Split a large root Terraform configuration into IAM and security group child modules, migrate resources with careful planning, and leverage public modules to simplify production-ready refactoring.

Understand how the AWS CLI stores credentials in the credentials file and region settings in the config file under the dot aws folder in your home directory, via aws configure.

Learn to manage multiple AWS accounts with named profiles in the AWS CLI, using default and production profiles, and configure or switch with the --profile flag.

Configure the AWS provider in Terraform to use named profiles, switching between default and account number two by setting a provider profile or the AWS_PROFILE environment variable.

Learn to deploy resources across regions by using Terraform alias providers and assigning resources to specific provider blocks, enabling Singapore, Mumbai, and US regions.

Learn how to use AWS provider default tags in Terraform to enforce a standard tagging strategy, simplify auditing, and override tags at the resource level.

Learn how to use the aws provider in terraform to assume an iam role, fetch temporary credentials via sts assume role, and create resources like ec2 and s3 across accounts.

Configure Terraform to assume an IAM role by setting the role ARN and session name, and grant the Terraform user permission to assume the role to create a security group.

Learn how the terraform log file locks provider plugin versions during terraform init, enforcing version constraints and preventing unwanted upgrades while explaining independent release cycles and upgrade options.

Learn how to debug Terraform by leveraging detailed logs, configuring TF_LOG and TF_LOG_PATH, and tailoring verbosity from error to trace to identify root causes during plan and troubleshooting.

Learn practical terraform debugging by configuring TF_LOG and TF_LOG_PATH, using Windows 'set' or Linux 'export' to emit info or trace logs, and saving logs to terraform.txt or terraform.log.

Explore HashiCorp cloud platform for Terraform (HCP) and its GUI workflow, including plan, cost estimation, policy checks, and apply, with collaboration, state management, and Git-based automation.

Get a clear view of ACP Terraform pricing, including essentials, standard, and premium plans, pay-as-you-go, flex, and enterprise self-manage options, with per-month and per-resource billing and features like audit logging.

Create a free HCP Terraform account on app.terraform.io, verify your email, and set up your first organization to explore platform features.

Explore the base structure of the HashiCorp cloud platform for Terraform, including organizations, workspaces linked to Git repositories, and projects that group related workspaces.

Create an organization, a project, and a workspace within the HashiCorp cloud platform. Explore the registry, plan settings, and version control workflows for HCP Terraform.

Explore the HCP Terraform workspace and version control workflow, linking a workspace to a GitHub repository and configuring credentials and environment variables for plan and apply.

Link your local working directory to an HCP Terraform workspace to run remote plan and apply from the CLI, best for those comfortable with Terraform CLI.

Explore practical steps of the cli-driven run workflow, including configuring cloud integration for organization and workspace, authenticating with a token, and running init, plan, and apply from the local cli.

Centralize and reuse variables across multiple Terraform workspaces with variable sets, enabling global or project-level scope and clear overwriting rules for workspace-specific overrides.

Learn how Sentinel, a policy as code framework for HashiCorp enterprise products, enforces Terraform plans using policy sets and workspaces to require EC2 tags.

Learn how run triggers in ACP Terraform automate cross-team updates by propagating remote state outputs from the network project to the security project.

Explore how teams in hcp terraform enable secure collaboration by inviting users, assigning them to teams such as owners, and managing permissions to safeguard infrastructure across organizations.

Learn how to manage permissions in HCP Terraform by creating teams, assigning project and workspace permissions, and configuring granular access to variables, state, and the private registry.

Learn how health assessments in HCP Terraform detect drift and validate configurations after provisioning. Use GUI or scripted checks to verify health and ensure standard or premium tier access.

Migrate your local Terraform state to the HCP Terraform remote state to enable collaboration and track historical state versions. Set up cloud blocks and run Terraform login and init.

Explore the AWS caller identity data source, which reveals the account ID and Arn used for API calls, and show how to reference these attributes in IAM policies.

Learn how to use the aws_subnets and aws_subnet data sources to fetch subnet IDs or detailed attributes from a VPC, apply filters, and drive resources like EC2 and security groups.

Create and manage IAM users with Terraform, including setting the login profile password and creating access and secret keys, while noting password resets and state file security.

Create and manage identity-based IAM policies with Terraform, covering managed versus inline policies and attachment to users, groups, and roles, plus jsonencode or file-based policy definitions.

Learn how the AWS IAM policy document data source generates a JSON representation for Terraform, offering a trimmed-down alternative to doc strings and enabling policy reference and validation.

Create and manage an IAM role using Terraform, defining the trust relationship with an assume role policy and attaching permission policies for services like EC2 and S3.

Attach a managed policy to an IAM role using Terraform and the aws_iam_role_policy_attachment resource, by supplying the role and the policy ARN, and apply the changes to establish the attachment.

Create a launch template with Terraform using the aws_launch_template resource, specifying image_id, instance_type, and VPC security group IDs, and apply it to launch EC2 instances or auto scaling groups.

Learn how to create an auto scaling group with Terraform using the AWS Auto Scaling Group resource, configuring minimum size, maximum size, desired capacity, availability zones, and a launch template.

Create an s3 bucket with aws_s3_bucket, then attach a bucket policy with aws_s3_bucket_policy, referencing a policy document via here doc string, a file, or a data source to produce json.

Learn how the source_profile in the AWS config file uses the base profile credentials to assume a role. See a hands-on example with role ARN, S3 access, and default credentials.

Explore the HashiCorp Terraform authoring and operations professional certification, a four-hour lab-based exam with hands-on challenges across modules, workflows, and AWS provider scenarios aligned to the official blueprint.

Learn how to book the terraform professional exam, verify your name, complete compatibility checks, select accommodations and extra time, choose a date, pay, and receive confirmation before starting the exam.

Navigate the four-hour HashiCorp Terraform exam by mastering the browser-based environment, balancing MCQs and lab scenarios, and using the right sidebar for credentials, VS Code links, and CLI workflows.

Learn Terraform exam strategies, including backing up base lab scenarios, hardcoding the aws provider, prioritizing faster scenarios, focusing on tasks, and using documentation and validation to succeed in two attempts.

Explore Terraform modules, refactoring scenarios, and lifecycle and provider configurations, including alias, data sources, S3 remote state, and resource import techniques.

Master essential HCP Terraform exam concepts for MCQs, including organizations, workspaces, policy and variable sets, vault provider, plan files, tf outputs, run triggers, and VCS triggers.

Bridge learning and real-world practice with Terraform professional challenges, practicing hands-on scenarios to simulate the four-hour exam using the TF Pro Challenges repository.

Clone the Terraform challenges repository with git, open challenge one in Visual Studio Code, read the readme, and start solving; alternatively download the zip to access all challenges.

Discover what challenge one tests for a Terraform professional, including broken code, Terraform import functionality, resource targeting, state management, output values, and splat expressions, with time estimates.

Fix Terraform challenge 1 tasks by correcting code, deploying resources, and implementing outputs for bucket names, user names, and security group IDs using for_each and count.

Explore a practical Terraform solution: save outputs to text files, manage state and imports, and align AWS resources—security groups, VPC ingress, and S3 objects—with the config.

Create a new.txt S3 object with content 'success', remove it from Terraform state using terraform state rm without deleting from AWS, then destroy resources with plan, apply, and force_destroy.

Explore the challenge 2 solution: deploy resources with terraform apply, replace hardcoded ami with a data source, and split configuration into modules loaded from local paths.

Refactor a monolithic Terraform setup into modules, update resource addresses with moved blocks, expose module outputs, and validate via plan with zero changes before destroying the state.

Explore how the AWS provider integrates with Terraform code and manages provider configurations in production environments. Examine credentials handling in CI/CD pipelines using environment variables and common pitfalls.

Learn to structure terraform modules for amazon web services resources, set up base tasks, and configure profiles and credentials to deploy ec2, asg, and iam resources using the aws provider.

Demonstrates deploying a local_file resource via terraform apply, fixing provider issues, and using lifecycle ignore_changes to keep auto-scaling group capacity at one while testing plan and destroy flows.

Master Terraform basics like count, count.index, for expressions, and output values while learning to fetch data from external files and transform values for production and exam readiness.

Create EC2 instances from a csv with Terraform; filter us east one, use count and count.index, map ami id and types (micro to t2.micro, nano to t3.nano), tag with team.

Implement Terraform output values for two EC2 instances, displaying id, region, team name, instance type, subnet id, and security group id, including computed data from the state file.

Execute Terraform tasks to create base resources, fetch subnet IDs via a data source, deploy two EC2 instances with for_each, and attach two security groups to the challenge five VPC.

Explore terraform to create vpc security group ingress and egress rules from csv data, using for_each filters, then apply, verify, and structure infra and modules.

Refactor task 8-10 in challenge five by moving aws vpc and subnet into the vpc child module, configure an s3 backend, and import existing resources with terraform state.

Configure AWS profiles, credentials, and provider aliases for challenge six, then deploy and destroy resources using Terraform init, plan, and apply with auto-approve.

Fetch data from a CSV file in Terraform using local values and CSV decode to produce dynamic outputs like army IDs, unique team names, region lists, and maps.

Demonstrates building base resources in a central VPC, retrieving subnet CIDR blocks via data sources, configuring a CSV-driven security group with ingress rules, and outputting subnet IDs.