DevOps4UA

terraform certificate #5

Jenkins

Source: Dev.to | Dec 18, 2025 (UTC)

Terraform Team Collaboration – Git-Based Workflow

1. Why This Topic Matters

In real organizations:

  • One person never manages the entire infrastructure
  • Multiple DevOps / Cloud engineers work on the same Terraform code

  • Infrastructure changes must be:

    • Safe
    • Trackable
    • Shareable
    • Recoverable

why local-only Terraform is dangerous and why Git is mandatory in production.

2. Local-Only Terraform Approach (Bad Practice)

What is Local-Only?

  • Terraform files (main.tf, variables.tf, terraform.tfvars)
  • Terraform state file (terraform.tfstate)
  • Stored only on your laptop

Example

/tmp/terraform/ main.tf variables.tf terraform.tfvars terraform.tfstate

Enter fullscreen mode

Exit fullscreen mode

You run:

terraform init terraform apply -auto-approve

Enter fullscreen mode

Exit fullscreen mode

Everything works — but only on your machine.

3. Problems with Local-Only Terraform

❌ Problem 1: Data Loss Risk

If:

You lose:

👉 Infrastructure becomes unmanageable

❌ Problem 2: No Team Collaboration

Terraform becomes person-dependent, not team-based.

❌ Problem 3: No Version History

👉 No rollback
👉 No audit
👉 No accountability

4. Git-Based Terraform Approach (Production Standard)

What Changes?

All Terraform code is stored in a Git repository.

terraform-repo/ main.tf variables.tf terraform.tfvars outputs.tf

Enter fullscreen mode

Exit fullscreen mode

Every team member:

5. Benefits of Using Git with Terraform

✅ 1. Centralized Access

✅ 2. Full Version History

Git tracks:

Example:

- managed from Terraform + managed from TF

Enter fullscreen mode

Exit fullscreen mode

You can:

✅ 3. Team Collaboration

✅ 4. Code Review & Approvals

Using Pull Requests:

This prevents:

✅ 5. CI/CD Integration (Advanced)

Git enables:

Before applying changes.

6. Real-World Rule: Always Commit Latest Changes

After:

You MUST:

git add . git commit -m "Updated security group rules" git push

Enter fullscreen mode

Exit fullscreen mode

Why?

7. Very Important: What NOT to Commit

❌ Do NOT Commit Terraform State

terraform.tfstate terraform.tfstate.backup

Enter fullscreen mode

Exit fullscreen mode

Why (brief explanation):

(Detailed explanation comes in later lectures)

❌ Do NOT Commit .terraform/ Folder

This folder contains:

Size example:

Why NOT commit?

terraform init

Enter fullscreen mode

Exit fullscreen mode

8. Correct .gitignore for Terraform

.terraform/ *.tfstate *.tfstate.backup

Enter fullscreen mode

Exit fullscreen mode

This is mandatory in production.

9. Summary (Key Takeaways)

2. What Is Terraform State File?

Terraform state file (terraform.tfstate) is a JSON file that stores:

Terraform must store this data to manage infrastructure.

3. Critical Security Risk: Secrets in Plain Text

Important Fact

Terraform state file can store secrets in plain text.

Examples:

Why This Happens

When Terraform creates a resource (example: database), the provider returns full details.
Terraform must save them in the state file to manage updates and deletes later.

4. Real Example: RDS Database

Terraform Configuration (Simplified)

resource "aws_db_instance" "example" { engine = "mysql" instance_class = "db.t3.micro" username = "admin" password = "mypassword123" }

Enter fullscreen mode

Exit fullscreen mode

What Happens After terraform apply

"username": "admin", "password": "mypassword123"

Enter fullscreen mode

Exit fullscreen mode

Password is stored in plain text

5. Why Committing State to Git Is Dangerous

Scenario 1: Too Many Git Permissions

Scenario 2: Public or Exposed Repository

➡ Leads to data breach

Scenario 3: Compromised Laptop

6. Common Mistake: “I’ll Hide the Password in a File”

Many engineers think:

“I won’t hardcode password. I’ll use file() function.”

Example

password = file("outside/pass.txt")

Enter fullscreen mode

Exit fullscreen mode

Where pass.txt contains:

mypassword123

Enter fullscreen mode

Exit fullscreen mode

Reality

Terraform still:

❌ This does NOT solve the problem.

7. Proof: Sensitive in Plan, Plain Text in State

password = (sensitive value)

Enter fullscreen mode

Exit fullscreen mode

"password": "mypassword123"

Enter fullscreen mode

Exit fullscreen mode

Plan hides it. State does NOT.

8. Why “It’s Fine Today” Is a Bad Argument

Many engineers say:

“Our current state file has no secrets.”

Problem:

Best practice is future-proofing, not reacting after breach.

9. Conclusion (State File Security)

Key Takeaways

Terraform and .gitignore

10. Why .gitignore Is Mandatory

Humans make mistakes.

Without .gitignore:

.gitignore acts as a safety net

11. Files You Should NEVER Commit

❌ Do NOT Commit

File / Folder

Reason

.terraform/

Huge provider binaries

terraform.tfstate

Secrets, conflicts

terraform.tfstate.backup

Same as state

crash.log

Debug only

terraform.log

Temporary logs

*.plan

Execution artifacts

12. What Is .gitignore?

.gitignore is a text file that tells Git:

“Ignore these files even if they exist.”

Placed at repo root.

13. Simple .gitignore Example

.terraform/ *.tfstate *.tfstate.backup crash.log *.plan

Enter fullscreen mode

Exit fullscreen mode

14. Demo Concept (Non-Terraform Example)

Files:

01.txt 02.txt secrets.txt

Enter fullscreen mode

Exit fullscreen mode

Without .gitignore:

With .gitignore:

secrets.txt

Enter fullscreen mode

Exit fullscreen mode

Secrets never reach Git.

15. Terraform Default .gitignore (Best Practice)

GitHub provides ready-made Terraform .gitignore.

It ignores:

You can customize it per organization needs.

16. Files You SHOULD Commit

✅ Always Commit

File

Why

*.tf

Terraform code

.terraform.lock.hcl

Provider version locking

.gitignore

Safety

README.md

Documentation

17. Final Summary

Terraform Backends – Where State Is Stored

1. What Is a Terraform Backend?

A Terraform backend determines:

Where and how Terraform stores its state file

The state file (terraform.tfstate) is critical because it tracks:

2. Default Backend: Local Backend

Important Rule

If no backend is explicitly configured, Terraform uses the local backend by default.

What Does That Mean?

Example Folder

jumptotech-terraform/ sg.tf terraform.tfstate ← created automatically

Enter fullscreen mode

Exit fullscreen mode

3. Simple Practical Example (Local Backend)

Terraform File: sg.tf

resource "aws_security_group" "prod" { name = "production-sg" }

Enter fullscreen mode

Exit fullscreen mode

Run Commands

terraform apply -auto-approve

Enter fullscreen mode

Exit fullscreen mode

Result

4. Why Local Backend Is a Problem in Teams

Problem 1: No Team Collaboration

State file exists:

Other team members:

Problem 2: Risk of State Loss

If:

➡ State file is lost
➡ Terraform can no longer manage resources properly

5. Production Architecture (Recommended)

Correct Setup

Visual Flow (Conceptual)

Developers | Git Repository (Terraform code) | Remote Backend (terraform.tfstate)

Enter fullscreen mode

Exit fullscreen mode

This allows:

6. Remote Backends in Terraform

Terraform supports many backend types.

Common Backends

Backend

Used When

S3

AWS environments

AzureRM

Azure environments

GCS

Google Cloud

Consul

HashiCorp ecosystem

Kubernetes

Cluster-based state

7. Backend Configuration Depends on Type

Each backend has:

Example: S3 Backend

terraform { backend "s3" { bucket = "my-tf-state" key = "prod/terraform.tfstate" region = "us-east-1" } }

Enter fullscreen mode

Exit fullscreen mode

Example: Kubernetes Backend

terraform { backend "kubernetes" { namespace = "terraform" } }

Enter fullscreen mode

Exit fullscreen mode

8. Why State Should NOT Be in Git

Key Reason

Terraform state can contain:

Git repository:

➡ State must be stored securely and encrypted

9. Explicit Local Backend Configuration

Even though local backend is default, you can explicitly configure it.

Why Would You Do This?

10. Best Practice: Use backend.tf

Instead of placing backend config in resource files:

✅ Good practice:

backend.tf sg.tf

Enter fullscreen mode

Exit fullscreen mode

11. Explicit Local Backend Example

backend.tf

terraform { backend "local" { path = "prod.tfstate" } }

Enter fullscreen mode

Exit fullscreen mode

Important Notes

12. Workflow with Explicit Backend

terraform init terraform apply -auto-approve

Enter fullscreen mode

Exit fullscreen mode

Result

prod.tfstate

Enter fullscreen mode

Exit fullscreen mode

Instead of:

terraform.tfstate

Enter fullscreen mode

Exit fullscreen mode

13. Authentication with Remote Backends

Remote backends require authentication.

Example: S3 Backend

Terraform must:

Terraform uses:

14. Backend Features: State Locking

Some backends:

Others:

👉 Always check backend documentation.

Terraform State Locking

15. Why State Locking Is Needed

Problem

Multiple users running:

terraform apply

Enter fullscreen mode

Exit fullscreen mode

At the same time → State corruption

16. Simple Scenario

Both try to:

➡ Inconsistencies
➡ Corrupted state

17. Real-Life Analogy

Like a phone call:

Terraform state works the same way.

18. What Is State Locking?

State locking ensures:

Only ONE Terraform operation can modify the state at a time

Other operations:

19. State Locking Workflow

  1. Terraform tries to acquire lock
  2. If lock acquired:

20. State Locking Depends on Backend

Examples

Backend

Locking

Local

.lock.info file

S3

DynamoDB-based locking

Consul

Native locking

GCS

Native locking

21. Local Backend Locking Mechanism

Terraform creates:

terraform.tfstate.lock.info

Enter fullscreen mode

Exit fullscreen mode

This file:

22. Practical Demo: State Locking

Resource: sleep.tf

resource "time_sleep" "wait" { create_duration = "100s" }

Enter fullscreen mode

Exit fullscreen mode

Run Apply

terraform apply -auto-approve

Enter fullscreen mode

Exit fullscreen mode

During execution:

Second Terminal Attempt

terraform plan

Enter fullscreen mode

Exit fullscreen mode

Error

Error acquiring the state lock The process cannot access the file because another process has locked it

Enter fullscreen mode

Exit fullscreen mode

23. Lock Release

After apply completes:

24. Important Clarification

terraform.lock.hcl ≠ State Lock

File

Purpose

terraform.lock.hcl

Provider version lock

terraform.tfstate.lock.info

State lock

25. Production Recommendation

When choosing a backend:

Examples:

26. Final Summary

Backends

State Locking

Terraform S3 Backend

1. What Is an S3 Backend?

An S3 backend allows Terraform to store its state file (.tfstate) in an Amazon S3 bucket instead of locally.

Key Idea

2. Why Use S3 Backend?

Problems with Local Backend

Benefits of S3 Backend

3. How Terraform Backends Work (Quick Recap)

All backends follow the same structure:

terraform { backend "<backend_name>" { # backend specific config } }

Enter fullscreen mode

Exit fullscreen mode

Only two things change:

  1. Backend name (local, s3, azurerm, gcs, etc.)
  2. Backend-specific configuration

4. S3 Backend Configuration Structure

terraform { backend "s3" { bucket = "example-bucket" key = "production.tfstate" region = "us-east-1" use_lockfile = true } }

Enter fullscreen mode

Exit fullscreen mode

What Each Field Means

Field

Meaning

bucket

S3 bucket name where state is stored

key

Path + filename of state inside bucket

region

AWS region of the bucket

use_lockfile

Enables state locking

5. Creating the S3 Bucket

Important Rule

S3 bucket names must be globally unique

Example:

jumptotech-demo-bucket-007

Enter fullscreen mode

Exit fullscreen mode

You can create the bucket:

Once created:

6. Best Practice: backend.tf

From production perspective:

Folder Structure

jumptotech-terraform/ backend.tf sg.tf

Enter fullscreen mode

Exit fullscreen mode

This helps when:

7. Example: backend.tf

terraform { backend "s3" { bucket = "jumptotech-demo-bucket-007" key = "production.tfstate" region = "us-east-1" use_lockfile = true } }

Enter fullscreen mode

Exit fullscreen mode

8. Example Resource File: sg.tf

resource "aws_security_group" "prod" { name = "production-sg" }

Enter fullscreen mode

Exit fullscreen mode

9. Initializing the S3 Backend

Mandatory Step

Whenever backend configuration is added or changed:

terraform init

Enter fullscreen mode

Exit fullscreen mode

Terraform will:

10. Applying the Configuration

terraform apply -auto-approve

Enter fullscreen mode

Exit fullscreen mode

What Happens

11. Verifying State Location

Local Folder

No terraform.tfstate file

Enter fullscreen mode

Exit fullscreen mode

S3 Bucket

production.tfstate

Enter fullscreen mode

Exit fullscreen mode

This confirms:

12. Authentication Requirement

Terraform must authenticate to AWS to access S3.

Terraform Uses

Required Permissions

13. Backend Locking Support

S3 backend:

This is mandatory in production environments.

Terraform State Management (Advanced)

14. Important Rule About State File

Never modify the Terraform state file manually

Reasons:

15. How to Safely Manage State

Terraform provides state subcommands:

terraform state <subcommand>

Enter fullscreen mode

Exit fullscreen mode

These allow:

16. terraform state list

Purpose

Lists all resources currently tracked in state.

Command

terraform state list

Enter fullscreen mode

Exit fullscreen mode

Output Example

aws_iam_user.dev aws_security_group.prod

Enter fullscreen mode

Exit fullscreen mode

Use Case

17. terraform state show

Purpose

Displays attributes of a single resource.

Command

terraform state show aws_security_group.prod

Enter fullscreen mode

Exit fullscreen mode

Why Useful

18. terraform state pull

Purpose

Fetches the current state from remote backend.

Command

terraform state pull

Enter fullscreen mode

Exit fullscreen mode

Use Case

19. terraform state rm

Purpose

Removes a resource from Terraform state without destroying it

Common Use Case

Command

terraform state rm aws_security_group.prod

Enter fullscreen mode

Exit fullscreen mode

Result

20. Safe Removal Workflow

  1. Remove resource from state
  2. Remove resource block from .tf file
  3. Run terraform plan
  4. No destruction occurs

21. terraform state mv

Purpose

Move resource from one address to another.

Problem Without mv

Changing name:

aws_iam_user.dev → aws_iam_user.prod

Enter fullscreen mode

Exit fullscreen mode

Terraform tries:

Solution

terraform state mv aws_iam_user.dev aws_iam_user.prod

Enter fullscreen mode

Exit fullscreen mode

Now:

22. terraform state replace-provider

Purpose

Change provider reference inside state.

Use Case

Command

terraform state replace-provider \ registry.terraform.io/hashicorp/aws \ kplabs.in/internal/aws

Enter fullscreen mode

Exit fullscreen mode

⚠ Dangerous Command

23. Recovery After Replace Provider

If broken:

terraform state replace-provider \ kplabs.in/internal/aws \ registry.terraform.io/hashicorp/aws

Enter fullscreen mode

Exit fullscreen mode

24. Final Best Practices Summary

S3 Backend

State Management

  1. Remote State Data Source (Concept + Practical)
  2. Terraform Import (Concept + New Auto-Generate Feature + Practical)

Language is simple, production-focused, and suitable for teaching.

Terraform Remote State Data Source

1. Why Remote State Data Source Is Important

In medium to large organizations:

Example Teams

Each team:

2. Real-World Challenge

Scenario

Security team needs:

Bad Approaches

❌ Manual
❌ Error-prone
❌ Not scalable

3. Solution: Remote State Data Source

Terraform provides:

terraform_remote_state data source

This allows:

4. What Remote State Data Source Does

It allows Terraform code to:

  1. Connect to a remote backend
  2. Read the state file
  3. Fetch output values
  4. Use those values in configuration

5. High-Level Architecture

Networking Team └─ Terraform └─ S3 backend (eip.tfstate) └─ Outputs: public IPs Security Team └─ Terraform └─ Reads networking state └─ Uses IPs in firewall rules

Enter fullscreen mode

Exit fullscreen mode

6. Practical Setup Overview

We create two Terraform projects:

Project 1: networking-team

Project 2: security-team

7. Networking Team – Code

backend.tf

terraform { backend "s3" { bucket = "kplabs-networking-bucket-demo" key = "eip.tfstate" region = "us-east-1" } }

Enter fullscreen mode

Exit fullscreen mode

eip.tf

resource "aws_eip" "public_ip" { domain = "vpc" } output "eip_addr" { value = aws_eip.public_ip.public_ip }

Enter fullscreen mode

Exit fullscreen mode

Apply

terraform init terraform apply -auto-approve

Enter fullscreen mode

Exit fullscreen mode

Result

8. Security Team – Remote State Configuration

data.tf

data "terraform_remote_state" "networking" { backend = "s3" config = { bucket = "kplabs-networking-bucket-demo" key = "eip.tfstate" region = "us-east-1" } }

Enter fullscreen mode

Exit fullscreen mode

This tells Terraform:

9. Using Remote State Output

sg.tf

resource "aws_security_group" "secure_sg" { name = "secure-sg" ingress { from_port = 443 to_port = 443 protocol = "tcp" cidr_blocks = [ "${data.terraform_remote_state.networking.outputs.eip_addr}/32" ] } }

Enter fullscreen mode

Exit fullscreen mode

10. Validate the Workflow

terraform init terraform plan

Enter fullscreen mode

Exit fullscreen mode

You will see:

11. Proof of Automation

  1. Destroy EIP in networking team
  2. Re-create EIP
  3. New IP generated
  4. Run terraform plan in security team

✅ New IP automatically fetched
✅ Firewall updated correctly

12. Key Takeaways (Remote State)

Terraform Import (Modern & Practical)

13. Why Terraform Import Is Needed

Most organizations:

Question

Can we bring existing resources under Terraform control?

Answer:

Yes – using Terraform Import

14. Old Terraform Import (Before v1.5)

Earlier behavior:

Problems:

15. New Terraform Import (v1.5+)

Terraform now supports:

This is a major improvement

16. New Import Workflow

  1. Resource exists manually
  2. Define import block
  3. Run terraform plan -generate-config-out
  4. Terraform generates .tf file
  5. Run terraform apply
  6. Resource is now managed by Terraform

17. Practical Example – Manual Security Group

Manually Created in AWS

Goal:

18. Import Configuration

import.tf

provider "aws" { region = "us-east-1" } import { to = aws_security_group.mysg id = "sg-0abc1234def56789" }

Enter fullscreen mode

Exit fullscreen mode

19. Generate Terraform Code

terraform plan -generate-config-out=mysg.tf

Enter fullscreen mode

Exit fullscreen mode

Result:

20. Apply Import

terraform apply -auto-approve

Enter fullscreen mode

Exit fullscreen mode

Terraform:

21. Verify Management

Modify generated code:

description = "Managed via Terraform"

Enter fullscreen mode

Exit fullscreen mode

Apply again:

terraform apply -auto-approve

Enter fullscreen mode

Exit fullscreen mode

AWS Console shows:

22. Important Notes

Terraform Version

Check version:

terraform version

Enter fullscreen mode

Exit fullscreen mode

23. Best Practices for Import

24. Final Summary

Remote State

Import

For further actions, you may consider blocking this person and/or reporting abuse

Залишити відповідь

Ваша e-mail адреса не оприлюднюватиметься. Обов’язкові поля позначені *

Читайте також