Free through lesson 3

Terraform Fundamentals Course

From installation to HCL, plan and apply, tfstate and remote backends, modules, VPC, EC2, and IAM, secrets, CI review, and import and drift. Over 20 lessons, you'll work up to writing infrastructure as code, reading a plan before applying it, and running it as a team with review in place. No AWS account is needed — every output shown was actually run against local files, Docker, and moto with Terraform 1.16.2.

Start from lesson 1 Unlock every course

Curriculum

The 20 lessons are split into 5 chapters. We recommend working through them in order starting from Chapter 1, but feel free to skip around to whatever interests you. * Terraform commands can't run in the browser, so install Terraform (1.14 or later) locally to try them. Lessons 5, 6, and 9 use local Docker, and lesson 8 and lessons 12–20 use moto (an AWS stand-in that runs on Docker), so no AWS account is required.

Chapter 1 — What Is IaC (lessons 1–4)

You'll pin down exactly what goes wrong when infrastructure is built by hand, then install Terraform and get a handle on init, fmt, validate, and reading HCL. You'll finish by learning to read plan's symbols and applying a plan exactly as saved.

1

What Is IaC: Writing the Desired State as Code

What goes wrong when infrastructure is built by hand, and Terraform's idea of "writing what should exist." The smallest example — a file on your computer — shows idempotency and recreation.

Free
2

Installing Terraform, and init, fmt, validate

Install Terraform 1.16, and pin versions with required_version and required_providers. Why the lock file init creates belongs in git, and how fmt and validate check your formatting and catch mistakes.

Free
3

How to Read HCL, and terraform console

Blocks and arguments, string/number/bool/list/map/object types, and reading interpolation, conditionals, for expressions, and functions. locals and output without a provider, plus terraform console.

Free
4

Plan's Symbols, and Applying a Saved Plan

The symbols for create (+), update in place (~), replace (-/+), and destroy (-), and how to spot forces replacement. Save a plan with plan -out and apply exactly that plan.

🔒 Basic

Chapter 2 — Resources and State (lessons 5–8)

You'll see how resources connect to each other against local Docker, and make configuration adjustable from the outside with variables and outputs. You'll read what Terraform remembers as the "current state" — tfstate itself — and finish by storing it in S3 with a lock.

5

Resources and Dependencies (Docker and graph)

Spin up an nginx container on local Docker with Terraform, with creation order auto-decided from other resources' values. Check connections with terraform graph, and test safely using mock_provider.

🔒 Basic
6

Variables and Outputs (validation, tfvars, sensitive)

When to use variable, locals, and output, and reusing one config for dev/prod with only value changes. How validation catches bad values, tfvars vs TF_VAR_, and how sensitive only hides screen output.

🔒 Basic
7

What's Inside tfstate, and state mv / rm

What terraform.tfstate remembers, checked via state list and state show. Even sensitive passwords end up as plain text in state. Running state mv/rm out of sync with .tf invites rebuilds and dupes.

🔒 Basic
8

The S3 Remote Backend and Locking

State kept in S3, and locking with use_lockfile. Create the bucket first on moto, pass backend.hcl to init, and see two simultaneous applies stopped with a 412.

🔒 Basic

Chapter 3 — Structuring Things (lessons 9–12)

You'll bundle the same configuration into a module, and separate dev and prod with folders and workspaces. Handle quantity with for_each and count, finishing by reading values that live outside your configuration with data sources.

9

Reusing the Same Configuration with Modules

A module turns a whole web server setup into a component with inputs and outputs, called twice to stand up two different servers. Addresses split as module.name, and a rule of thumb for module scope.

🔒 Basic
10

Splitting Environments (Folders and Workspaces)

Two ways to separate dev and prod: folders versus workspaces. A test failure while still in the prod workspace exposes the risk of not seeing which environment you're in.

🔒 Basic
11

for_each and count

count vs for_each for duplicating a resource, and how count's numbering shifts when you delete one from the middle. for_each over a map, toggling creation with count, and splat/for outputs.

🔒 Basic
12

Reading External Values with Data Sources (AMI, AZ, remote_state)

Data sources read an AMI's ID or an AZ's name without copying it by hand. Read another config's output with terraform_remote_state, test with override_data, and see the list vs tuple type trap.

🔒 Basic

Chapter 4 — Building Out the Cloud (lessons 13–16)

Against moto, you'll build up a VPC and subnets, security groups, EC2, and IAM in order. You'll finish with ephemeral and write-only, which keep passwords out of the state file entirely.

13

Networking (VPC, Subnets, Security Groups)

Build a VPC on moto: public/private subnets per AZ, an internet gateway, route tables, and a security group allowing only port 443. default_tags, and writing values explicitly even at the default.

🔒 Basic
14

EC2, user_data, and IMDSv2

Create an EC2 instance in the prior network. Read the AMI via data source, embed values into user_data with templatefile, harden with IMDSv2-only and disk encryption, and rebuild on user_data change.

🔒 Basic
15

IAM and Testing Least Privilege

Grant server access via an IAM role, not a key. Write a policy scoped to uploads/ with aws_iam_policy_document, lock in least privilege via jsondecode tests, and split mock vs. real providers.

🔒 Basic
16

Handling Secrets (ephemeral and write-only)

A database password ends up in state even when sensitive — ephemeral/write-only attributes send it to Secrets Manager instead. Compare state files, and bump the version on change.

🔒 Basic

Chapter 5 — Running It as a Team (lessons 17–20)

You'll post plans to pull requests for review with GitHub Actions, and bring things built through the console under management with import. The course wraps up with how to spot drift, and how lifecycle, moved, and removed prevent destructive changes.

17

Reviewing Plans in CI (GitHub Actions)

A GitHub Actions flow reading CI's plan on a PR before merging. Checks for fmt, validate, test; a Summary plan via -detailed-exitcode; an apply gated on approval; and local checks with act/actionlint.

🔒 Basic
18

Bringing In Existing Resources with an import Block

An import block bringing a console-made bucket and parameter under Terraform. Rewriting the -generate-config-out draft, and confirming the plan: "2 to import, 0 to add, 0 to change" before applying.

🔒 Basic
19

Finding and Fixing Drift (refresh-only, ignore_changes)

Spot drift — values or tags changed outside Terraform — via plan -refresh-only, and revert via plan. A daily heads-up via -detailed-exitcode, and choosing revert, adopt, or ignore via ignore_changes.

🔒 Basic
20

Preventing Destructive Changes (lifecycle, moved, removed)

Five safeguards — prevent_destroy, create_before_destroy, moved, removed, precondition — stop a plan destroying the real thing when you meant only to rename or drop it from .tf. The course's capstone.

🔒 Basic

Once you've finished all 20 lessons, move on to the Kubernetes Fundamentals Course to run apps on top of the foundation Terraform built, or the GitHub Actions Fundamentals Course to go deeper on the CI that backs your plan reviews. A membership unlocks every course.