Terraform for DevOps: Azure Capstone + Generative AI

What actually happens when you run terraform init: the hidden .terraform directory, provider plugin downloads, and the dependency lock file. The foundation every Terraform project stands on.

Master the difference between terraform plan and terraform apply -” the safety net that shows you exactly what will change before it changes. Never be surprised by your own infrastructure again.

Terraform state is what separates people who "know Terraform" from people who can be trusted with production. Deep dive into terraform.tfstate: what it tracks, why it matters, and how Terraform uses it to map your code to real Azure resources.

To keep this course aligned with today's technology, we've added this AI-focused section. These lessons show how Generative AI can enhance your productivity while reinforcing the importance of strong technical fundamentals. After completing this section, continue with the remaining course content to apply these concepts in practice.

See generative AI write a real PowerShell script, a Python script, a GitHub Actions workflow, a Kubernetes manifest, and a Terraform config — live, on screen. Whether you're learning to code, script, or build cloud infrastructure with AI coding assistants like ChatGPT and Copilot, this lecture sets the baseline: here's exactly what AI can already do for you, so the rest of the course can show you what it still can't.

AI can write a script in seconds — so why keep learning to write one yourself? This lecture answers that honestly, with two live, real examples in PowerShell and Python where AI-generated code looks perfect and quietly isn't. Essential for anyone using an AI coding assistant for scripting, automation, or infrastructure work who wants to close the judgment gap AI can't close for you.

A real near-miss story, reproduced live: an AI-generated script almost leaks a live API key straight to a public GitHub repo — and how an automated guardrail catches it in seconds. A must-watch for anyone using generative AI for coding, DevOps, or cloud automation who wants to build securely, not just quickly.

Beyond writing code — five real, practical ways to use generative AI every day: fast upskilling on new tools, automated documentation, smarter troubleshooting with real context, and a head start on architecture diagrams. Straight from a working Generative AI Architect's own daily toolkit, not theory — the habits that actually save time on real scripting, DevOps, and cloud engineering work.

Hardcoded values are the number one habit that separates hobby Terraform from professional Terraform. Introduce input variables, variable types, and defaults -” and make your configuration reusable across environments.

Use locals to eliminate repetition and refactor your Terraform configuration into clean, readable, DRY code -” the way it's written on real DevOps teams.

How Terraform automatically figures out the right creation order by reading references between your resources -” implicit dependencies, the dependency graph, and why you rarely need to spell out ordering yourself.

When Terraform can't infer the order on its own, depends_on is your emergency brake. Learn when explicit dependencies are genuinely needed -” and why overusing them is a code smell.

Terraform outputs are the handshake between your configuration and the outside world. Export resource attributes -” IPs, names, connection strings -” for humans, scripts, and other Terraform configurations to consume.

Bring everything from the previous sections together: visualize the dependency graph and launch a complete, multi-resource Azure deployment from a single terraform apply.

What happens when your laptop dies and terraform.tfstate dies with it? Simulate the disaster, then fix it forever: migrate state to a remote backend on Azure so your team -” and your future self -” can always find it.

terraform destroy is a chainsaw; -target turns it into a scalpel. Tear down infrastructure safely, remove a single resource without touching the rest, and understand the risks of targeted operations.

Manage one codebase across dev, QA, and prod using -var, -var-file, and .tfvars files. Master Terraform's variable precedence order so you always know which value wins and why.

Need five identical VMs? Don't copy-paste the block five times. Use count to multiply resources from a single definition -” and learn its index-based limitations that lead us to for_each.

for_each is count's smarter sibling: create resources from maps and sets with stable, meaningful keys, so adding or removing one item never forces Terraform to rebuild the others.

Conditional expressions let one codebase make decisions: create a resource only in production, size a VM differently per environment, toggle features with a single variable.

The capstone begins: a production-style Hub-and-Spoke network on Azure, the same architecture pattern used in real enterprise landing zones. Tour the target architecture, understand every component you're about to build, and see how everything you've learned so far comes together.

Authenticate like a professional: create an Azure Service Principal (SPN) for Terraform instead of personal logins, and wire up remote state from day one -” exactly how real teams start a project.

Real architecture starts on paper, not in code. Plan IP address spaces for hub and spokes without overlaps, and design an enterprise naming convention that scales -” the discipline that separates architects from coders.

Lay the foundation: the hub virtual network with its subnets and Azure Bastion for secure access -” the center every spoke will connect through.

Build the router VM by repurposing the official Terraform Azure VM example -” a real-world skill: adapting provider documentation into your own architecture instead of writing everything from scratch.

Create the spoke networks, peer them to the hub, and configure route tables that force all spoke traffic through the hub router -” the defining behavior of a true Hub-and-Spoke design.

The moment of truth: validate traffic flows end to end, verify the routing works as designed, and apply lifecycle discipline before anything ships -” then tear it all down cleanly.