Blog
Thoughts on engineering, design, and building great products.
Capstone: A Complete Multi-Tier Web Infrastructure
The final article assembles everything in the series into a complete web infrastructure: VPC, ALB, an Auto Scaling Group running nginx, RDS PostgreSQL and S3 — organized into three connected modules. Apply for real, access the application through the ALB, verify the DB password never leaks into state, then a clean teardown. Closes with a roadmap for what to learn next.
Testing: terraform test, mock_provider, and Terratest
Test Terraform code before it stands up real infrastructure. terraform test (GA since 1.6) with .tftest.hcl files runs run/assert to check logic, mock_provider (1.7) lets tests run without real AWS. Real demo of three passing tests and one failing test, then an introduction to Terratest for deep integration testing.
Advanced Lifecycle and Providers
Features that control resource and provider lifecycle: create_before_destroy, prevent_destroy, ignore_changes, replace_triggered_by; provider alias to run multi-region in one configuration; terraform_data replacing null_resource; provisioners as a last resort; and the check block that only warns. Each feature comes with a real demo.
Reading Another State and Refactoring: remote_state, moved, removed
When you split infrastructure across multiple states, terraform_remote_state lets one config read the output of another. And when reorganizing code, the moved block renames a resource without destroy-recreate, the removed block drops a resource from state without destroying it — both declared right in the configuration instead of the manual state mv/rm commands from Article 7.
Multiple Environments: Workspaces and Directory Layout
Dev, staging, prod need separate state. There are two ways: workspaces keep multiple states in the same backend, and directory layout splits each environment into its own directory with its own backend. This article demos both, and shows clearly why workspaces are NOT a good fit for strong separation between prod and dev — exactly the docs' warning.
Writing Your First Module
A module packages a group of resources behind a clean input/output interface, to reuse in many places without copying code. This article writes a 'secure-bucket' module that wraps an S3 bucket along with versioning, encryption and public-access blocking into a single concept, then calls it twice from the root with different inputs.
count and for_each: The Index Trap, Conditionals, templatefile
Two ways to create multiple resources: count by index and for_each by key. This article shows the real-world trap of using count with a list — dropping a middle element shifts the indexes and wrongly destroys-and-recreates a whole row of resources — with a live demo, then shows how for_each avoids it. Plus conditional resource creation and templatefile.