Terraform Cheatsheet

variable "environment" {
  description = "Deployment environment"
  type        = string
  default     = "development"
}

# type string
variable "aws_region" {
  description = "AWS Region"
  type        = string
  default     = "us-east-1"
}

# type list(string)
variable "azs" {
  description = "AZs in the Region"
  type        = list(string)
  default     = ["us-east-1a", "us-east-1b", "us-east-1c"]
}

# type map
variable "amis" {
  type = map(string)
  default = {
    "eu-west-1" = "ami-0fdke15151513145",
    "us-east-1" = "ami-0d17359173587519"
  }
}

# type object
variable "egress_dsg" {
  type = object({
    from_port   = number
    to_port     = number
    protocol    = string
    cidr_blocks = list(string)
  })
  default = {
    from_port   = 0,
    to_port     = 65365,
    protocol    = "tcp",
    cidr_blocks = ["100.0.0.0/16", "200.0.0.0/16", "0.0.0.0/0"]
  }
}

# creating multiple EC2 instances using count
resource "aws_instance" "server" {
  ami           = "ami-06ec8443c2a35b0ba"
  instance_type = "t2.micro"
  count         = 3 # creating 3 resources
}

# declaring a variable
variable "users" {
  type    = list(string)
  default = ["demo-user", "admin1", "john"]
}

# creating IAM users using for_each
resource "aws_iam_user" "test" {
  for_each = toset(var.users) # converts a list to a set
  name     = each.key
}

# A for expression creates a complex type value by transforming another complex type value.
variable "names" {
  type    = list(string)
  default = ["som", "john", "mary"]
}

output "show_names" {
  # similar to Python's list comprehension
  value = [for n in var.names : upper(n)]
}

output "short_upper_names" {
  # filter the resulting list by specifying a condition:
  value = [for name in var.names : upper(name) if length(name) > 7]
}

# Launch an EC2 instance
resource "aws_instance" "server" {
  ami           = "ami-05cafdf7c9f772ad2"
  instance_type = "t2.micro"
  count         = 3
}

output "private_addresses" {
  value = aws_instance.server[*].private_ip # splat expression
}

resource "aws_iam_role_policy" "example" {
  name = "example"
  role = "example-role"
  policy = jsonencode({
    "Statement" = [{
      "Action"   = "s3:GetObject",
      "Resource" = "arn:aws:s3:::example-bucket/*",
      "Effect"   = "Allow",
    }],
  })
}

resource "aws_instance" "my_server" {
  ami           = "ami-a255235"
  instance_type = "t2.micro"

  iam_instance_profile = aws_iam_instance_profile.my_server.name

  depends_on = [
    aws_iam_role_policy.example,
  ]
}

resource "aws_instance" "server" {
  ami           = "ami-a1b3414"
  instance_type = "t2.micro"

  lifecycle {
    create_before_destroy = true
    ignore_changes = [
      # Some resources have metadata
      # modified automatically outside of TF

      tags
    ]
  }
}

provider "aws" {
  region = "us-east-1"
}

# Additional provider config reference as `aws.west`.
provider "aws" {
  alias  = "west"
  region = "us-west-2"
}

terraform {

  # required_providers block specifies source and version
  required_providers {
    aws = {
      source  = "hashicorp/aws" # where to find the provider
      version = "5.8.0"         # which version of the provider is needed for this config
    }
  }
}

locals {
  service_name = "forum"
  owner        = "Community Team"
}

# once local declared you can reference it
locals {
  common_tags = {
    Service = local.service_name
    Owner   = local.owner
  }
}

output "api_base_url" {
  value = "https://${aws_instance.example.private_dns}:8433/"

  # The EC2 instance must have an encrypted root volume.
  precondition {
    condition     = data.aws_ebs_volume.example.encrypted
    error_message = "The server's root volume is not encrypted."
  }

  # output can be marked as containing sensitive
  sensitive = true # output can be marked as containing sensitive
}

data "aws_ami" "example" {
  most_recent = true

  owners = ["self"]
  tags = {
    Name   = "app-server"
    Tested = "true"
  }
}

module "myec2" {
  source = "../modules/ec2"

  # module inputs
  ami_id        = var.ami_id
  instance_type = var.instance_type
  servers       = var.servers
}

terraform {
  backend "remote" {
    organization = "example_corp"

    workspaces {
      name = "my-app-prod"
    }
  }
}

terraform init [options]

    -upgrade            # Install latest module & provider versions
    -reconfigure        # reconfigure backend, ignoring any saved config
    -backend=false      # Disable backend & use previous Initialization
    -migrate-state      # reconfigure backend & attempt to migrate any existing state

terraform plan [options]

    -var 'user=john'    # set value for input vars in the root module of config
    -var-file=filename  # load var values from the given file
    -input=true         # ask for input for vars if not directly set
    -out=path           # write a plan file to given path. can be used as input for "apply"
    -refresh-only       # verifies remote object consistency without proposing actions to undo changes done outside TF
    -destroy            # create plan to destroy all objects currenly managed
    -target=resource    # target planning to given resouce & its dependencies only.

terraform plan -refresh-only # updates state to match changes made outside of TF. Good for drift detection

terraform validate      # Validates the config files for errors

terraform apply [options]

    -auto-approve       # skip interactive approval of plan before applying
    -replace            # force replacement of a particular resource instance
    -var 'foo=bar'      # set a value for input vars in the root module of config
    -var-file=filename  # load var values from the given file
    -parallelism=n      # limit the no of concurrent operations. Default=10

terraform apply -var-file=web-dev.tfvars
terraform apply -replace="aws_instance.server"
terraform plan -refresh-only # Updates statefile to accept changes made manually.

terraform destroy [options]

    -auto-approve        # skip interactive approval before destroying
    -target              # limits destroy to only given resource & its dependencies


terraform destroy -target aws_vpc.my_vpc -auto-approve

terraform state show aws_instance.my_vm
terraform state pull > my_terraform.tfstate
terraform state mv aws_iam_role.old_role aws_iam_role.new_role
terraform state list
terraform state rm aws_instance.my_server

terraform import aws_instance.new_server i-243abc
sudo apt install graphviz
terraform graph | dot -Tpng > graph.png

export TF_LOG_CORE=TRACE     # enable core logging
export TF_LOG_PROVIDER=TRACE # enable provider logging
export TF_LOG_PATH=logs.txt  # to persist logs