10 Prompts for Terraform and IaC: From Modules to Multi-Cloud Mastery

Write a Terraform configuration file (main.tf) that creates an AWS EC2 instance of type t3.micro in us-east-1. Include:
- A variable for instance_name with default "web-server"
- A security group allowing SSH (port 22) and HTTP (port 80) from 0.0.0.0/0
- An output showing the public IP of the instance
- Use the hashicorp/aws provider version ~> 5.0

# main.tf
provider "aws" {
  region = "us-east-1"
}

variable "instance_name" {
  description = "Name tag for the EC2 instance"
  type        = string
  default     = "web-server"
}

resource "aws_security_group" "web_sg" {
  name        = "web-sg"
  description = "Allow SSH and HTTP"

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t3.micro"
  security_groups = [aws_security_group.web_sg.name]

  tags = {
    Name = var.instance_name
  }
}

output "public_ip" {
  value = aws_instance.web.public_ip
}

Design a Terraform module for a VPC with the following requirements:
- Module name: "vpc-module"
- Inputs: vpc_cidr (default "10.0.0.0/16"), environment (default "dev"), public_subnet_cidrs (list of strings)
- Outputs: vpc_id, public_subnet_ids
- Create two public subnets in different availability zones
- Attach an internet gateway to the VPC
- Use count to iterate over subnet CIDRs
- Include a description for each variable and output

# modules/vpc-module/main.tf
variable "vpc_cidr" {
  description = "CIDR block for the VPC"
  type        = string
  default     = "10.0.0.0/16"
}

variable "environment" {
  description = "Deployment environment (dev, staging, prod)"
  type        = string
  default     = "dev"
}

variable "public_subnet_cidrs" {
  description = "List of CIDR blocks for public subnets"
  type        = list(string)
}

resource "aws_vpc" "main" {
  cidr_block = var.vpc_cidr
  tags = {
    Name        = "${var.environment}-vpc"
    Environment = var.environment
  }
}

resource "aws_internet_gateway" "gw" {
  vpc_id = aws_vpc.main.id
  tags = {
    Name = "${var.environment}-igw"
  }
}

resource "aws_subnet" "public" {
  count                   = length(var.public_subnet_cidrs)
  vpc_id                  = aws_vpc.main.id
  cidr_block              = var.public_subnet_cidrs[count.index]
  availability_zone       = element(data.aws_availability_zones.available.names, count.index)
  map_public_ip_on_launch = true
  tags = {
    Name = "${var.environment}-public-subnet-${count.index + 1}"
  }
}

data "aws_availability_zones" "available" {
  state = "available"
}

output "vpc_id" {
  description = "ID of the VPC"
  value       = aws_vpc.main.id
}

output "public_subnet_ids" {
  description = "IDs of the public subnets"
  value       = aws_subnet.public[*].id
}

Generate Terraform code to create an S3 bucket (with versioning enabled) and a DynamoDB table for state locking. Then show how to configure the backend in root configuration. The bucket name should include a random suffix. The DynamoDB table should have a primary key "LockID" of type String. Use the random provider to generate a unique bucket name.

# backend-setup.tf
provider "aws" {
  region = "us-west-2"
}

resource "random_id" "bucket_suffix" {
  byte_length = 8
}

resource "aws_s3_bucket" "terraform_state" {
  bucket = "terraform-state-${random_id.bucket_suffix.hex}"

  versioning {
    enabled = true
  }

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = "AES256"
      }
    }
  }

  tags = {
    Name = "Terraform State Bucket"
  }
}

resource "aws_dynamodb_table" "terraform_locks" {
  name         = "terraform-locks"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "LockID"

  attribute {
    name = "LockID"
    type = "S"
  }

  tags = {
    Name = "Terraform Lock Table"
  }
}

output "state_bucket" {
  value = aws_s3_bucket.terraform_state.bucket
}

output "lock_table" {
  value = aws_dynamodb_table.terraform_locks.name
}

# backend.tf (in root module)
terraform {
  backend "s3" {
    bucket         = "terraform-state-<actual-suffix>"
    key            = "global/s3/terraform.tfstate"
    region         = "us-west-2"
    dynamodb_table = "terraform-locks"
    encrypt        = true
  }
}

Given the following monolithic Terraform code that creates an EC2 instance, an RDS database, and an S3 bucket, rewrite it into three separate modules: ec2-module, rds-module, s3-module. Each module should have its own variables.tf and outputs.tf. The root main.tf should call these modules with appropriate inputs. Include a module for networking (vpc) that is shared.

# main.tf
provider "aws" {
  region = var.region
}

module "vpc" {
  source = "./modules/vpc"
  vpc_cidr = "10.0.0.0/16"
  environment = var.environment
  public_subnet_cidrs = ["10.0.1.0/24", "10.0.2.0/24"]
}

module "ec2" {
  source = "./modules/ec2"
  instance_type = var.instance_type
  subnet_id     = module.vpc.public_subnet_ids[0]
  environment   = var.environment
}

module "rds" {
  source = "./modules/rds"
  db_name     = var.db_name
  db_username = var.db_username
  db_password = var.db_password
  subnet_ids  = module.vpc.public_subnet_ids
  environment = var.environment
}

module "s3" {
  source = "./modules/s3"
  bucket_name = var.bucket_name
  environment = var.environment
}

Write a multi-cloud Terraform configuration using the hashicorp/aws and hashicorp/azurerm providers. Deploy:
- AWS: one EC2 instance (t3.micro) with a public IP in us-east-1
- Azure: one VM (Standard_B1s) with a public IP in East US
- Use a module for each cloud provider
- Output the public IPs of both instances
- Do not implement the VPN tunnel (just stub the resources)

# main.tf
provider "aws" {
  region = "us-east-1"
}

provider "azurerm" {
  features {}
}

module "aws_vm" {
  source = "./modules/aws-vm"
  instance_type = "t3.micro"
  ami_id        = "ami-0c55b159cbfafe1f0"
  subnet_id     = module.vpc.public_subnet_ids[0]
}

module "azure_vm" {
  source = "./modules/azure-vm"
  vm_size     = "Standard_B1s"
  location    = "eastus"
  admin_username = "adminuser"
}

output "aws_public_ip" {
  value = module.aws_vm.public_ip
}

output "azure_public_ip" {
  value = module.azure_vm.public_ip
}

Show how to configure Terraform workspaces for three environments (dev, staging, prod). The configuration should use a local backend but with different state files per workspace. Include a variables file that sets instance_type based on workspace: dev=t3.nano, staging=t3.micro, prod=t3.small. Also show commands to create and switch workspaces.

# variables.tf
variable "instance_type" {
  description = "EC2 instance type based on environment"
  type        = string
}

# terraform.tfvars (not used directly; workspace-specific)
# Use a map in main.tf:
locals {
  instance_type_map = {
    dev     = "t3.nano"
    staging = "t3.micro"
    prod    = "t3.small"
  }
}

resource "aws_instance" "app" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = local.instance_type_map[terraform.workspace]
  tags = {
    Name        = "app-${terraform.workspace}"
    Environment = terraform.workspace
  }
}

terraform workspace new dev
terraform workspace new staging
terraform workspace new prod
terraform workspace select dev
terraform apply -auto-approve

Create a Sentinel policy file (ec2-encryption.sentinel) that enforces: all EC2 instances must have root_block_device with encrypted = true. The policy should apply to all resources of type aws_instance. Show how to attach this policy to a Terraform Cloud workspace.

# ec2-encryption.sentinel
import "tfplan"

# Get all EC2 instances in the plan
instances = tfplan.resource_changes["aws_instance"] ?? []

# Rule: all instances must have encrypted root block device
main = rule {
  all instances as _, instance {
    instance.applied.root_block_device.encrypted else false
  }
}

Write a Terragrunt configuration that defines a remote state block in root.hcl and then uses it in two child modules (vpc and ec2). The root.hcl should configure S3 backend with DynamoDB locking. Show the directory structure.

# terragrunt.hcl (root)
remote_state {
  backend = "s3"
  config = {
    bucket         = "my-terraform-state"
    key            = "${path_relative_to_include()}/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    dynamodb_table = "terraform-locks"
  }
}

# dev/terragrunt.hcl
include {
  path = find_in_parent_folders()
}

# dev/vpc/terragrunt.hcl
include {
  path = find_in_parent_folders()
}

generate "provider" {
  path      = "provider.tf"
  if_exists = "overwrite_terragrunt"
  contents  = <<EOF
provider "aws" {
  region = "us-east-1"
}
EOF
}

Explain step-by-step how to diagnose and resolve a Terraform state lock error caused by a stale lock in DynamoDB. Provide the AWS CLI command to check the lock, force unlock if safe, and preventive measures using pre-commit hooks or CI pipelines.

# Check current lock
aws dynamodb get-item --table-name terraform-locks --key '{"LockID": {"S": "my-bucket/global/s3/terraform.tfstate-md5"}}'

# Force unlock (only after confirming no active process)
terraform force-unlock <LOCK_ID>

# Preventive: use CI pipeline with sequential stages
# In GitHub Actions, use concurrency group:
concurrency:
  group: terraform-${{ github.ref }}
  cancel-in-progress: false

Provide strategies to speed up Terraform plan for large deployments (100+ resources). Include: using -target for specific resources, splitting state into multiple workspaces, using terraform_remote_state data sources, and leveraging refresh=false in CI. Give concrete examples of -target usage and a script to identify long-running resources.

# Plan only a specific module
export TF_WORKSPACE=prod
export TF_LOG=WARN
time terraform plan -target=module.vpc -target=module.ec2

# Skip refresh in CI
export TF_IN_AUTOMATION=true
terraform plan -refresh=false

# Use terraform_remote_state instead of data sources where possible
# In module:
data "terraform_remote_state" "network" {
  backend = "s3"
  config = {
    bucket = "shared-state"
    key    = "network/terraform.tfstate"
    region = "us-east-1"
  }
}