➡️ ALL resources go to us-east-2
In production, this happens often:
Resource
Region
Security Group
Tokio (to-west-1)
EC2 Instance
USA (us-east-1)
But Terraform does not allow multiple providers of same type unless we use alias.
Alias allows you to:
❌ This is NOT allowed
provider "aws" { region = "ap-south-1" } provider "aws" { region = "us-east-1" }
Enter fullscreen mode
Exit fullscreen mode
Terraform error:
Duplicate provider configuration
Enter fullscreen mode
Exit fullscreen mode
Step 1: Define Multiple Providers with Alias
provider "aws" { region = "ap-southeast-1" # default provider } provider "aws" { alias = "Tokio" region = "to-west-1" } provider "aws" { alias = "usa" region = "us-east-1" }
Enter fullscreen mode
Exit fullscreen mode
Provider Reference
Region
aws (default)
Singapore
aws.tokio
Tokio
aws.usa
USA
5. Important Rule (Very Common Exam Question)
If you do NOT specify provider inside a resource, Terraform uses default provider
6. Simplest Practical Example (Security Groups)
Resource
Region
prod_firewall
USA
staging_firewall
Tokio
provider "aws" { region = "ap-southeast-1" } provider "aws" { alias = "mumbai" region = "ap-south-1" } provider "aws" { alias = "usa" region = "us-east-1" } resource "aws_security_group" "prod_firewall" { provider = aws.usa name = "prod_firewall" description = "Production firewall" } resource "aws_security_group" "staging_firewall" { provider = aws.mumbai name = "staging_firewall" description = "Staging firewall" }
Enter fullscreen mode
Exit fullscreen mode
7. Key Line to Understand (Most Important)
provider = aws.usa
Enter fullscreen mode
Exit fullscreen mode
aws → provider typeusa → alias name➡️ Create this resource using AWS provider configured for us-east-2
terraform init terraform validate terraform apply -auto-approve
Enter fullscreen mode
Exit fullscreen mode
9. Verification in AWS Console
Region
Expected Resource
us-east-1
prod_firewall
to -west-1
staging_firewall
10. Common Mistakes (Interview + Exams)
resource "aws_security_group" "sg" {} resource "aws_security_group" "sg" {}
Enter fullscreen mode
Exit fullscreen mode
Terraform error:
Duplicate resource configuration
Enter fullscreen mode
Exit fullscreen mode
✔️ Solution: unique local names
provider "aws" { alias = "mumbai" }
Enter fullscreen mode
Exit fullscreen mode
But resource has no provider = aws.mumbai
➡️ Resource still goes to default region
11. When Alias is Used in Real Production
12. Exam-Ready Summary (Memorize)
provider = aws.<alias_name>
Enter fullscreen mode
Exit fullscreen mode
Terraform Sensitive Parameters (Security Topic)
1. Why This Topic Is Important
By default, Terraform prints values in plain text during:
terraform planterraform applyThis can leak secrets such as:
👉 In production, this is unacceptable.
2. Problem Demonstration (Default Behavior)
Example: Local File with Password
resource "local_file" "password_file" { filename = "password.txt" content = "supersecretpassw0rd" }
Enter fullscreen mode
Exit fullscreen mode
content = "supersecretpassw0rd"
Enter fullscreen mode
Exit fullscreen mode
✔ Password is visible
❌ Security risk
3. Common Mistake (Using Variable Only)
Many beginners think variables hide secrets.
variable "password" { default = "supersecretpassw0rd" } resource "local_file" "password_file" { filename = "password.txt" content = var.password }
Enter fullscreen mode
Exit fullscreen mode
content = "supersecretpassw0rd"
Enter fullscreen mode
Exit fullscreen mode
👉 Terraform evaluates variables before showing output.
4. Correct Solution: sensitive = true
Step 1: Mark Variable as Sensitive
variable "password" { default = "supersecretpassw0rd" sensitive = true }
Enter fullscreen mode
Exit fullscreen mode
Step 2: Use Variable in Resource
resource "local_file" "password_file" { filename = "password.txt" content = var.password }
Enter fullscreen mode
Exit fullscreen mode
Terraform Plan Output (✔ Secure)
content = (sensitive value)
Enter fullscreen mode
Exit fullscreen mode
✔ Secret hidden in CLI
✔ Still written to file
5. Important Rule (EXAM QUESTION)
Sensitive values are hidden only from CLI & logs
❌ They are NOT hidden from the state file
6. Alternative: local_sensitive_file Resource
Terraform provides special resource types for sensitive data.
resource "local_sensitive_file" "password_file" { filename = "password.txt" content = "supersecretpassw0rd" }
Enter fullscreen mode
Exit fullscreen mode
sensitive = true content = (sensitive value)
Enter fullscreen mode
Exit fullscreen mode
If documentation says:
“Use **sensitive resource when content is sensitive”**
7. Sensitive Values and Outputs (Very Important)
output "password" { value = var.password }
Enter fullscreen mode
Exit fullscreen mode
Terraform error:
Sensitive value cannot be displayed in output
Enter fullscreen mode
Exit fullscreen mode
8. Correct Way to Use Sensitive Outputs
output "password" { value = var.password sensitive = true }
Enter fullscreen mode
Exit fullscreen mode
password = (sensitive value)
Enter fullscreen mode
Exit fullscreen mode
9. Why Sensitive Outputs Exist (Real Production Use)
Sensitive outputs are used because:
terraform_remote_state needs values📌 CLI hides it, state keeps it
10. Sensitive Data in State File (Critical Concept)
Even with sensitive = true:
terraform.tfstate
Enter fullscreen mode
Exit fullscreen mode
❌ Still contains real values:
"password": "supersecretpassw0rd"
Enter fullscreen mode
Exit fullscreen mode
Sensitive flag does NOT encrypt state
State protection is a separate topic:
11. Provider-Level Automatic Sensitivity (AWS Example)
Terraform providers may auto-detect secrets.
resource "aws_db_instance" "db" { allocated_storage = 20 engine = "mysql" username = "admin" password = "mypassword123" }
Enter fullscreen mode
Exit fullscreen mode
username = "admin" password = (sensitive value)
Enter fullscreen mode
Exit fullscreen mode
✔ Password hidden automatically
✔ Username visible
12. Making Username Sensitive Too
variable "db_user" { default = "admin" sensitive = true } resource "aws_db_instance" "db" { username = var.db_user password = "mypassword123" }
Enter fullscreen mode
Exit fullscreen mode
username = (sensitive value) password = (sensitive value)
Enter fullscreen mode
Exit fullscreen mode
13. Exam & Interview Summary (Memorize)
sensitive = true hides values from:
❌ Does NOT hide from terraform.tfstate
Some providers auto-mark secrets
Outputs with sensitive values must also be marked sensitive
_sensitive_ resources exist for some providers
14. Real Production Best Practice
✔ Use:
❌ Never:
Part 1: HashiCorp Vault – High-Level Overview
HashiCorp Vault is a secrets management system used to:
2. The Core Problem Vault Solves
Secrets stored in:
This leads to:
3. Vault’s Biggest Feature: Dynamic Secrets
Secrets that are:
Example 1: Database Credentials
Vault generates:
Credential validity: 24 hours / 1 hour
After expiry:
✅ Reduced blast radius
✅ No long-lived credentials
✅ High security
Example 2: AWS IAM Credentials
Vault provides:
Keys auto-expire
Vault deletes them automatically
Vault generates:
Used for login
Revoked automatically after lease
Initially:
Now:
Easy to:
This improves:
5. Vault Encryption as a Service
Vault can:
Instead of writing encryption logic in your application:
6. Organizational Benefit of Vault
Imagine:
❌ Without Vault:
✅ With Vault:
Part 2: Terraform Vault Provider – High-Level Overview
7. What Is the Vault Provider in Terraform?
The Vault provider allows Terraform to:
secret/db_creds ├── username = admin └── password = password123
Enter fullscreen mode
Exit fullscreen mode
Terraform needs these credentials to:
9. Vault Provider Configuration (Basic)
provider "vault" { address = "http://127.0.0.1:8200" }
Enter fullscreen mode
Exit fullscreen mode
This tells Terraform:
10. Reading Secrets from Vault in Terraform
secret/db_creds
Enter fullscreen mode
Exit fullscreen mode
data "vault_generic_secret" "db" { path = "secret/db_creds" }
Enter fullscreen mode
Exit fullscreen mode
11. Accessing Vault Data in Terraform
output "vault_secret" { value = data.vault_generic_secret.db.data_json sensitive = true }
Enter fullscreen mode
Exit fullscreen mode
Terraform reads:
Output hidden from CLI
Data stored in state
12. Important Behavior (Very Important for Exam)
Any secret read from Vault using Terraform is stored in:
terraform.tfstate
Example:
"outputs": { "vault_secret": { "value": { "username": "admin", "password": "password123" } } }
Enter fullscreen mode
Exit fullscreen mode
👉 This is why:
Use:
14. Vault AWS Secrets Engine + Terraform
Vault can generate:
Terraform can:
No AWS keys in:
Terraform dynamically authenticates via Vault.
15. Real-World Terraform + Vault Flow
16. Exam-Ready Summary (Memorize This)
Using Vault with Terraform does NOT eliminate secrets from state files.
You must:
Terraform Dependency Lock File (.terraform.lock.hcl)
1. What Is the Dependency Lock File?
When you run:
terraform init
Enter fullscreen mode
Exit fullscreen mode
Terraform automatically creates a file called:
.terraform.lock.hcl
Enter fullscreen mode
Exit fullscreen mode
This file is called the dependency lock file.
2. Why This File Exists (Core Problem)
Component
Version
Terraform
1.2
AWS Provider
v1 → v2 → v3 (released later)
Your code:
Weeks later:
terraform init ❌ Code may break
❌ Unexpected behavior
❌ Production risk
3. First Line of Defense: Version Constraints
Inside Terraform code, you define version constraints.
terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 4.0" } } }
Enter fullscreen mode
Exit fullscreen mode
4.0, 4.1, 4.2, 4.6 5.x But this alone is not enough.
4. What Happens During First terraform init
.terraform.lock.hcl
Enter fullscreen mode
Exit fullscreen mode
5. What Is Stored in .terraform.lock.hcl
Example:
provider "registry.terraform.io/hashicorp/aws" { version = "4.62.0" constraints = "~> 4.0" hashes = [ "h1:abcd...", "zh:1234..." ] }
Enter fullscreen mode
Exit fullscreen mode
6. Why the Lock File Is Critical (Main Benefit)
terraform init may download a newer provider Ensures:
terraform init 4.62.0 installedterraform init 4.70.0 exists✔ Same behavior
✔ Same results
✔ No surprises
8. What If Code Version Changes but Lock File Doesn’t?
.terraform.lock.hcl has: version = 4.62.0
Enter fullscreen mode
Exit fullscreen mode
version = "= 4.60.0"
Enter fullscreen mode
Exit fullscreen mode
Now versions do not match.
terraform init
Enter fullscreen mode
Exit fullscreen mode
❌ Terraform fails with error
Because:
9. Correct Way to Upgrade or Downgrade Provider
You must explicitly tell Terraform to update providers.
terraform init -upgrade
Enter fullscreen mode
Exit fullscreen mode
.terraform.lock.hcl 10. Very Important Security Aspect (Checksums)
The lock file also contains hashes:
If checksum mismatch occurs:
terraform init fails✔ Supply-chain security
✔ Verified binaries only
11. Important Limitation (Exam Question)
.terraform.lock.hclONLY tracks provider dependencies
It does NOT lock:
Modules still follow:
12. Best Practices (Production)
✔ Always commit .terraform.lock.hcl
✔ Never delete it casually
✔ Use terraform init -upgrade intentionally
✔ Review provider changelogs before upgrade
❌ Do not rely only on version constraints
❌ Do not ignore lock file errors
13. Exam-Ready Summary (Memorize)
.terraform.lock.hcl locks exact provider version terraform init -upgrade to change versions 
For further actions, you may consider blocking this person and/or reporting abuse
Залишити відповідь