ned1313/getting-started-terraform

Exercise files for my Pluralsight course

Getting-Started-Terraform

Welcome to Terraform - Getting Started. These exercise files are meant to accompany my course on Pluralsight. The course was developed using version 1.4.2 of Terraform. Since the GA of version 1.0, HashiCorp has committed to no breaking changes until version 2.0. All the exercises in this course should be valid as long as you are using Terraform in the 1.X version family. The modules and providers in this course have no such guarantee, so I have pinned the version where applicable.

If you're looking for the exercise files for older versions of the course, there are two branches to check out:

• v3 - Corresponding to the course published on Novemeber 2, 2021.
• [pre-1.0] - Corresponding to the course published on October 1, 2019.

I don't recommend taking the older courses, as they are out of date and do not cover the latest features of Terraform. I have left the branches available since you may be assigned an older course by your employer.

Using the files

In the course, you are given a Terraform configuration for a basic web application from someone else on the Globomantics team. We are going to make a copy of this configuration and modify it over the length of the course. The base_web_app directory has the basic web app configuration, which we will copy over to a new directory called globo_web_app, and start making alterations.

As we progress through the modules, you will be challenged to make updates to the files in globo_web_app to meet the evolving needs and requirements of the web application infrastructure. The completed solution for each module is in the mX_solution directories. I recommend trying to first write the solution yourself, and then checking your answer against what you see in the solution file.

At the beginning of module three, we will hardcode our AWS keys into the configuration. You should not do this in any real world scenario! I am trying to illustrate a point in the course. Please do not commit your AWS keys to source control. Some of us (me) have done this in the past and felt very silly. We will move these keys into environment variables in module four, and they shall never again be hardcoded anywhere.

The suggested commands for each module are in the commands directory. You can run these commands to get through the exercises, but I also encourage you to experiment and try things out for yourself.

Providers

This course uses the AWS and Random providers. At the start of the course, we are not specifying a particular version of the AWS provider, meaning Terraform will grab the latest version. The day after I finished the course, version 5.0 of the AWS provider was released 😔. So while you will see version 4.X in the course video, when you initialize your configuration for the first time, you will get version 5.X. They are no breaking changes in the AWS provider between 4.X and 5.X that impact the example code, so it should all work as expected, with one minor exception.

In module 6, we add the Random provider and specify required versions for both providers, setting the AWS provider to use major version 4. In the videos, I am already using major version 4, so Terraform didn't have a problem with adding the version constraint and running terraform init. However, you will be using major version 5 of the provider, and the addition of the version constraint will mean Terraform has to download a different version of the provider and update the lock file. When you run terraform init, you will get an error message indicating that your version constraints have changed and you need to run terraform init -upgrade to update the lock file. You can safely run this command and everything will work as expected.

I admit the -upgrade switch is a little misleading, as it implies that you are moving to a newer version of the provider, when in reality you're moving down a major version. I wish the command was something else, like terraform init -update or something. But alas, it is what it is.

AWS Environment

You will need access to an AWS environment with permissions to create resources in EC2, S3, and IAM. I recommend creating a dedicated account just for this course. The exercises have been tested with AWS region us-east-1. The input variable aws_region has us-east-1 set as the default, but you can supply a different region if you prefer. Generally, the exercises should work in any region that has at least three availability zones and an Amazon Linux 2 AMI.

You will need to generate an AWS access key to run through the exercises. You can do this through the IAM console in a browser (hint: it's under security credentials for your user) by following the official AWS docs. I'd recommend assigning the AdministratorAccess policy to your user to give you permissions to do everything in the account. Also, enable 2FA for the user account!

Line Endings

An issue I have discovered from time to time is that Terraform doesn't much like the Windows style of ending a line with both a Carriage Return (CR) and a Line Feed (LF), commonly referred to as CRLF. If you are experiencing strange parsing issues, change the line ending to be Line Feed (LF) only. In VS Code this can be down by clicking on the CRLF in the lower right corner and changing it to LF. This primarily affects template files or scripts being sent to a Linux machine for processing.

MONEY!!!

A gentle reminder about cost. The course will have you creating resources in AWS. Some of the resources are not going to be 100% free. I have tried to use the Free-tier when possible, but you many still incur some charges.

When you complete an exercise in the course, you can easily tear down the deployed infrastructure using terraform destroy. Just run that command and approve the destruction to remove all resources from AWS. Before you start the next module, run terraform apply again and you should be right where you started. Isn't infrastructure automation amazing?!

Certification

HashiCorp has released the Terraform Certified Associate certification. You might be wondering if this course fully prepares you for the cert. It does not. Taking this course along with the Deep Dive - Terraform course on Pluralsight will meet most of the learning objectives for the certification, but there is no substitute for running the software on your own and hacking away.

I have coauthored a certification guide which you can find on Leanpub. This is an unofficial guide, but I believe in concert with the Pluralsight courses you will be in a good position to sit the exam. And in case you're wondering, yes it is fully updated for version 003 of the exam that was released in May 2023.

Conclusion

I hope you enjoy taking this course as much as I did creating it. I'd love to hear feedback and suggestions for revisions. Find me on Twitter (@ned1313) or add an issue to this repository.

Thanks and happy automating!

Ned

getting-started-terraform's Issues

Issue with terraform example

Hi Ned Bellavance,

I'm following the 1st training example using a recently created AWS test account.
https://github.com/ned1313/Getting-Started-Terraform/tree/main/base_web_app

It was created/destroyed by using:

• terraform init
• terraform plan
• terraform apply
• terraform destroy

No problems with these terraform commands.

BUT I couldn't get the web application to return: "Go have a taco." or whatever.
It failed when using the domain name or the IP address of the nginx server this example creates.

Have you tried this examples a recent AWS test environment?
I think there might be some extra security in AWS now that might prevent this sample (and maybe the others) from working.

Thanks

Hi, where is the m3 folder. I'm trying to follow the course under the plural sight.

no such file/dir error during remote-exec (m4)

Get the following output when applying m4 scripts. Appears to be either a change to ami selected and/or change to ami itself. On the ami selected the index.html exists as a symlink to a different file (fedora). Deleting the symlink first resolves the issue.

the file:
[ec2-user@ip-10-1-0-33 ~]$ ls -al /usr/share/nginx/html/index.html
lrwxrwxrwx 1 root root 32 Sep 18 00:19 /usr/share/nginx/html/index.html -> ../../fedora-testpage/index.html
[ec2-user@ip-10-1-0-33 ~]$

terraform apply output:
aws_instance.nginx1 (remote-exec): Dependency Installed:
aws_instance.nginx1 (remote-exec): gperftools-libs.x86_64 0:2.0-11.5.amzn1
aws_instance.nginx1 (remote-exec): libunwind.x86_64 0:1.1-10.8.amzn1

aws_instance.nginx1 (remote-exec): Complete!
aws_instance.nginx1 (remote-exec): Starting nginx: [ OK ]
aws_instance.nginx1 (remote-exec): tee: /usr/share/nginx/html/index.html: No such file or directory
aws_instance.nginx1 (remote-exec): <title>Blue Team Server</title>

Blue Team

Error: error executing "/tmp/terraform_1667424955.sh": Process exited with status 1

Latest AWS provider(version 4) does not work with some arguements in m5 solution

Hello Ned,

I was following along your course and I see that some arguements are deprecated. For example :

terraform validate ╷ │ Warning: Argument is deprecated │ │ with aws_s3_bucket.web_bucket, │ on s3.tf line 57, in resource "aws_s3_bucket" "web_bucket": │ 57: acl = "private" │ │ Use the aws_s3_bucket_acl resource instead │ │ (and 5 more similar warnings elsewhere) ╵ Success! The configuration is valid, but there were some validation warnings as shown above.

I am using :
`terraform version
Terraform v1.1.5
on darwin_amd64

• provider registry.terraform.io/hashicorp/aws v4.18.0
• provider registry.terraform.io/hashicorp/random v3.3.1`

I had to use AWS provider version 4 as I was getting errors while performing validate :
`terraform init

Initializing the backend...

Initializing provider plugins...

• Reusing previous version of hashicorp/aws from the dependency lock file
• Finding hashicorp/random versions matching "~> 3.3"...
• Installing hashicorp/random v3.3.1...
• Installed hashicorp/random v3.3.1 (signed by HashiCorp)
  ╷
  │ Error: Failed to query available provider packages
  │
  │ Could not retrieve the list of available versions for provider hashicorp/aws: locked provider registry.terraform.io/hashicorp/aws 4.18.0 does not match configured
  │ version constraint ~> 3.0; must use terraform init -upgrade to allow selection of new versions`

Would it be possible to update m5 solutions to incorporate updated arguements?

m3 error when deploying

I can't deploy from your repository
I'm getting the following error

_Error: Error launching source instance: InvalidKeyPair.NotFound: The key pair 'publickey' does not exist
status code: 400, request id: efbda3eb-541b-4e1d-8273-33d6b8a9c6ee

on module_three.tf line 82, in resource "aws_instance" "nginx":
82: resource "aws_instance" "nginx" {_

is there anything we should do at AWS side?

my variables

aws_access_key = ""
aws_secret_key = ""
key_name = "publickey"
private_key_path = "C:\LVS\Training\PluralSight\terraform-getting-started\Getting-Started-Terraform-master\m3\publickey"

my dir files

.terraform
.vs
m3.tfplan
m3_commands.txt
module_three.tf
privatekey.ppk
publickey
terraform.tfstate
terraform.tfstate.backup
terraform.tfvars

Module 6 instances.tf missing `iam_instance_profile` and `depends_on` for nginx2 instance

In m6_solution/instances.tf the config for nginx2 is missing some important config values (iam_instance_profile, and depends_on) when compared to nginx1.

nginx1:

Getting-Started-Terraform/m6_solution/instances.tf

Lines 14 to 20 in c19a681

	resource "aws_instance" "nginx1" {
	ami = nonsensitive(data.aws_ssm_parameter.ami.value)
	instance_type = var.instance_type
	subnet_id = aws_subnet.subnet1.id
	vpc_security_group_ids = [aws_security_group.nginx-sg.id]
	iam_instance_profile = aws_iam_instance_profile.nginx_profile.name
	depends_on = [aws_iam_role_policy.allow_s3_all]

nginx2:

Getting-Started-Terraform/m6_solution/instances.tf

Lines 37 to 42 in c19a681

	resource "aws_instance" "nginx2" {
	ami = nonsensitive(data.aws_ssm_parameter.ami.value)
	instance_type = var.instance_type
	subnet_id = aws_subnet.subnet2.id
	vpc_security_group_ids = [aws_security_group.nginx-sg.id]

This results in one healthy instance (nginx1) and one unhealthy instance (nginx2)

Unable to load private key

I am taking your course on Pluralsight. Under m3 folder, I set up terraform.tfvars as:

aws_access_key = "*******"

aws_secret_key = "******"

key_name = "ssss"

private_key_path = "/Users/myuser/terraform/ssss.pem"

when I do 'ls -l /Users/myuser/terraform/ssss.pem', I got
-rwxr-xr-x 1 myuser staff 1695 18 Jul 21:48 /Users/myuser/terraform/ssss.pem

After running 'terraform plan -out m3.tfplan', I got errors when execute 'terraform apply "m3.tfplan"':
aws_instance.nginx: Destroying... [id=i-06527067970169520]
aws_instance.nginx: Still destroying... [id=i-06527067970169520, 10s elapsed]
aws_instance.nginx: Still destroying... [id=i-06527067970169520, 20s elapsed]
aws_instance.nginx: Still destroying... [id=i-06527067970169520, 30s elapsed]
aws_instance.nginx: Still destroying... [id=i-06527067970169520, 40s elapsed]
aws_instance.nginx: Destruction complete after 41s
aws_instance.nginx: Creating...
aws_instance.nginx: Still creating... [10s elapsed]
aws_instance.nginx: Still creating... [20s elapsed]
aws_instance.nginx: Still creating... [30s elapsed]
aws_instance.nginx: Provisioning with 'remote-exec'...

Error: Failed to read ssh private key: no key found

Can you help this?

My terraform version is
Terraform v0.12.28

• provider.aws v2.70.0

and I am on MacOs

M3: No default VPC found in this region

Module 3:
When performing terraform apply "m3.tfplan"

│ Error: No default VPC found in this region.
│
│ with aws_default_vpc.default,
│ on module_three.tf line 53, in resource "aws_default_vpc" "default":
│ 53: resource "aws_default_vpc" "default" {

Though i have confirmed that there's a default VPC in my region.

The current context in AWS CLI has also been set to the respective region.

Error while parsing: At 18:16: Unknown token: 18:16 IDENT var.aws_access_key

I am using terraform v0.12.24 and I got the below error

"Error while parsing: At 18:16: Unknown token: 18:16 IDENT var.aws_access_key"

help me to resolve.

m5.tfplan S3 bucket /nginx/ folder creation issue

Hi,

Not sure what happened but I tried manual execution of this
/usr/local/bin/s3cmd sync --config=/home/ec2-user/.s3cfg /var/log/nginx/ s3://globo-dev-59843/nginx/i-06e34b5321f02686b/

(don't worry this is a sandbox so everything above will be irrelevant in couple of mins)

and this executed as expected:
i-06e34b5321f02686b[root@ip-10-1-0-231 ec2-user]# [root@ip-10-1-0-231 ec2-user]# /usr/local/bin/s3cmd sync --config=/home/ec2-user/.s3cfg /var/log/nginx/ s3://globo-dev-59843/nginx/i-06e34b5321f02686b/ upload: '/var/log/nginx/access.log' -> 's3://globo-dev-59843/nginx/i-06e34b5321f02686b/access.log' [1 of 3] 0 of 0 0% in 0s 0.00 B/s done upload: '/var/log/nginx/access.log-20210531.gz' -> 's3://globo-dev-59843/nginx/i-06e34b5321f02686b/access.log-20210531.gz' [2 of 3] 20 of 20 100% in 0s 707.16 B/s done upload: '/var/log/nginx/error.log' -> 's3://globo-dev-59843/nginx/i-06e34b5321f02686b/error.log' [3 of 3] 0 of 0 0% in 0s 0.00 B/s done remote copy: 'access.log-20210531.gz' -> 'error.log-20210531.gz' Done. Uploaded 20 bytes in 1.0 seconds, 20.00 B/s.

However when I applied this via tf apply m5.tfplan it skipped this part???:

provisioner "file" { content = <<EOF /var/log/nginx/*log { daily rotate 10 missingok compress sharedscripts postrotate endscript lastaction INSTANCE_ID=curl --silent http://169.254.169.254/latest/meta-data/instance-id`
sudo /usr/local/bin/s3cmd sync --config=/home/ec2-user/.s3cfg /var/log/nginx/ s3://${aws_s3_bucket.web_bucket.id}/nginx/$INSTANCE_ID/
endscript
}`

It's like the "file" provisioner was skipped, which was not the case with the "remote-exec" one and the /website/ was created. What would happen if this action is moved to the "remote-exec" provisioner? Haven't tried it yet, wondering if that might fix anything?

Cheers,
Vlatko

M3 main.tf file has a wrong setting

Looks like the default main.tf file for M3 has 2 wrong settings:

enable_dns_hostnames from the vpc module
map_public_ip_on_launch from the subnet module

Originally they are mapped as "true", where they should be true

This causes that it is not possible to connect to the EC2 instance after completing M3.

Fails with i/o timeout error

│
│ with aws_instance.nginx,
│ on module_three.tf line 96, in resource "aws_instance" "nginx":
│ 96: provisioner "remote-exec" {
│
│ timeout - last error: dial tcp 18.216.2.64:22: i/o timeout

M3 folder is not available

hi ,

I am new to your Pluralsight course and I can not see M3 folder.

Error M3 File

Hello i am following your tutorials and have issue
Line 83 its says
Error: Error launching source instance: InvalidKeyPair.NotFound: The key pair 'devop' does not exist
status code: 400, request id: b7698138-bcf2-467f-9e5a-679c1944e87d

on myec2.tf line 82, in resource "aws_instance" "nginx":
82: resource "aws_instance" "nginx" {

i am using your code from M3 directory with ngnix example

Following is my path private_key_path = "ec2-1/secret.pem"
this file lies inn same directory is this error with path ?

errors in m6 solution due to naming mismatches

1. m6 instances.tf line 17 errors out -> aws_subnet.subnet1.id should be aws_subnet.public_subnet1.id
2. m6 instances.tf line 18 errors out -> aws_security_group.nginx-sg.id should be aws_security_group.nginx_sg.id
3. m6 instances.tf line 40 errors out -> aws_subnet.subnet2.id should be aws_subnet.public_subnet2.id
4. m6 instances.tf line 41 errors out -> aws_security_group.nginx-sg.id should be aws_security_group.nginx_sg.id
5. m6 s3.tf doesn't match pluralsight video 😅 missing aws_iam_role & aws_iam_role_policy (which aren't needed as the env comes up fine)
6. m8 network.tf ran tf fmt
7. m8 renamed folder from globo-web-app-s3 to globo-webapp-s3 to match module call in s3.tf

Terraform was not able to find KeyPair

Taking your course on Pluralsight and trying to do the work along side. Terraform is not able to find the KeyPairs though and that is fairly frustrating

rror: Error launching source instance: InvalidKeyPair.NotFound: The key pair 'Pluralsight' does not exist
status code: 400, request id: 2de81fda-4527-4418-8bb4-a5d94d85739c

I have created the key pair in advance in the aws console

AWS t2.micro instance no longer available

Need to change "intsance_type" value in main.tf file, line 82, from t2.micro to t3.micro because no longer available in AWS.
Actually will be displayed error:

aws_instance.nginx1: Creating...

│ Error: creating EC2 Instance: Unsupported: The requested configuration is currently not supported. Please check the documentation for supported configurations.
│ status code: 400, request id:
│
│ with aws_instance.nginx1,
│ on main.tf line 80, in resource "aws_instance" "nginx1":
│ 80: resource "aws_instance" "nginx1" {

Provisioning file using terraform in Windows errors on Amazon linux VM

Within Module 5, the terraform apply deploys an nginx configuration for the logrotate software using here-doc notation (lines ~249-264/317-332). When executed on Windows, the file is deployed as a DOS file and logrotate errors when trying to run. Errors will be seen in the output as shown below when the logrotate command is executed on each instance. (The output below shows the second instance only, but the same occurs for nginx1)

'''
aws_instance.nginx2 (remote-exec): error: nginx:1 lines must begin with a keyword or a filename (possibly in double quotes)
aws_instance.nginx2 (remote-exec): error: nginx:2 unexpected text
aws_instance.nginx2 (remote-exec): error: nginx:3 unexpected text
aws_instance.nginx2 (remote-exec): error: nginx:4 unexpected text
aws_instance.nginx2 (remote-exec): error: nginx:5 unexpected text
aws_instance.nginx2 (remote-exec): error: nginx:6 unexpected text
aws_instance.nginx2 (remote-exec): error: nginx:prerotate or postrotate without endscript
aws_instance.nginx2 (remote-exec): error: found error in file nginx, skipping
'''
Note: Whilst this is problematic, Module 5 serves to demonstrate the use of provisioners and clearly states that they should only be used as a last resort. There are probably better/recommended methods to achieve the end result than demonstrated here.

This is using Terraform v0.12.24 with AWS provider v2.58.0 and the current AMI image "ami-01a6e31ac994bbc09" (AL2 with kernel 4.14, systemd 219, GCC7.3, Glibc2.26, Binutils2.29.1) and logrotate-3.7.8-26.14.amzn1.x86_64)
The errors occur as a result of the CRLF mappings between UNIX & DOS.

Whilst the local solution on the linux VM is simple enough to effect, is there any mechanism that Terraform can provision files using the system native format? i.e. DOS for Windows, unix for Linux VMs,

Not found Git repository for Implementing-Terraform-with-AWS course

Not found Git repository for Implementing-Terraform-with-AWS course,
can you provide it please

Outdated resources

Hi!

First many thank´s for this course and your work. Following this course I recognized that some resource arguments are not valid anymore and were replaced by other resources, e.g. the argument acl in aws_s3_bucket. This leads to a new resource aws_s3_bucket_acl to use and this requires the new aws_s3_bucket_ownership_controls. Because of this it is quite hard to follow the Pluralsight video because the configuration is unclear. Is there a chance you update this course or just the files?

Code compatible with terraform 0.13?

I got this when I try to run 'terraform init'. Is this code tested to work with 0.13? I tried running the command suggested, and run into problems, seemingly because the alternative provider isn't valid anymore.

$ terraform init

Initializing the backend...

Initializing provider plugins...
- Using previously-installed hashicorp/azurerm v1.44.0
- Using previously-installed hashicorp/random v3.0.0
- Using previously-installed hashicorp/aws v3.15.0
- Finding latest version of hashicorp/azure...

Error: Failed to install providers

Could not find required providers, but found possible alternatives:

  hashicorp/azure -> terraform-providers/azure

If these suggestions look correct, upgrade your configuration with the
following command:
    terraform 0.13upgrade .

It seems there are significant changes in 0.13, and I don't think it makes sense to use an old version anyway.

Question on the code

I'm sorry to use Github as a Q&A but Pluralsight's Disqus is broken.

In each modules .tf files you have a data source:
data "aws_availability_zones" "available" {}

and then in the resources you have defined:

data.aws_availability_zones.available.names[0]
and
data.aws_availability_zones.available.names[1]

Where is this list, names, being populated?