Terraform

Infrastructure as Code with Terraform — module 5HASH, Supinfo, days 1 and 2.

Two days to go from a first container described in code to an infrastructure structured into modules, deployed across several environments, with a shared, locked and protected state. The module continues with two days on Ansible.

Format	2 days · 4 lectures and 4 hands-on labs
Audience	computer science students with basic Linux and Docker
Environment	100% local: Docker and Floci (AWS emulator) — no cloud account, no cost, no risk
Common thread	CatCompressor, an image thumbnail pipeline (S3, SQS, containers)

---

Day 1 — The fundamentals

Lecture 1 — Introduction to Infrastructure as Code

1. Why Infrastructure as Code
2. Historical context: from physical servers to the cloud
3. Use cases and limits
4. Overview of the tools (Terraform, OpenTofu, Pulumi, Ansible…)
5. Terraform concepts: providers, resources, state, the plan / apply cycle

Lecture 2 — Terraform basics

1. HCL syntax and structure
2. Defining resources
3. Configuring providers
4. Reading existing infrastructure with data sources

Lab 1 — The Terraform workflow with Docker · 2 h

Walk through the full lifecycle of an infrastructure on a simple provider.

1. Set up the project: providers and pinned versions
2. Define a first web container
3. Add a second resource in code
4. Change the infrastructure: read a plan, understand a replacement
5. Clean up with destroy

Lab 2 — Terraform, AWS and Floci · 2 h 30

Drive locally emulated AWS services, in the middle of an existing infrastructure.

1. Start the Floci emulator
2. Point the AWS provider at a local endpoint
3. Create infrastructure outside Terraform
4. Read it with data sources, then create S3, DynamoDB, SSM, SQS (for_each) and EC2
5. Inspect with terraform console and the AWS CLI
6. Update in place, then clean up — what Terraform owns, and what it only reads

---

Day 2 — Structure, collaborate, secure

Lecture 3 — Modules

1. Organising code with modules
2. Variables and outputs
3. Locals and built-in functions

Lecture 4 — Backends and collaboration

1. Managing state
2. Backends and workspaces
3. Managing secrets
4. Infrastructure drift

Lab 3 — Reusable modules for several environments · 3 h

1. Getting started with the CatCompressor project
2. Split a project into a root module and child modules
3. Pass values around: variables, terraform.tfvars, locals, module arguments
4. Surface information through outputs, across three levels
5. Compose dev and staging from the same module
6. Clean up

Lab 4 — Shared state, workspaces, secrets and drift · 4 h

1. Starting point: the morning’s project, local state
2. Migrate the state to an S3 backend with native locking (use_lockfile)
3. Isolate dev and staging with workspaces
4. Reference a secret: sensitive variable, data source, AWS Secrets Manager
5. Detect drift and reconcile it through a reviewed plan
6. Switch backends: move the states to GitLab
7. Clean up
8. Bonus — Continuous integration on GitLab: fmt, validate and terraform test

---

Learning outcomes

Area	After the two days, students can…
Workflow	write, initialise, plan, apply, change and destroy an infrastructure; read a plan before applying it
Providers	configure Docker and AWS, pin their versions, target a local emulator
Existing	read infrastructure they do not manage, with data sources
Modules	split a project into reusable modules and compose several environments
Values	pass information through variables, .tfvars, locals, arguments and outputs
State	share a state on S3 or GitLab, lock it, version it, migrate it
Environments	isolate dev and staging with workspaces or environment files
Secrets	read a secret without writing it into the code, and know where it remains in plain text
Drift	detect a gap with plan -refresh-only and fix it through a saved, reviewed plan
Quality	test a configuration with terraform test and plug it into a CI pipeline

Tools

Terraform 1.11+ · AWS provider 6.x · Docker provider (kreuzwerker/docker) · Floci · AWS CLI v2 · Docker · GitLab (state storage, CI) · Git · scripts provided in bash and PowerShell

Teaching approach

• A single common thread: the same project grows from lab to lab, from the first resource to the CI pipeline.
• Fill-in-the-gaps labs: a project skeleton and step-by-step instructions — the block is given, students adapt it and watch its effect.
• Instructions checked before every session: each lab is replayed automatically, step by step, on the distributed skeleton; every announced result is verified, and the resulting project is compared with the solution.
• Up-to-date material: native S3 state locking (DynamoDB deprecated), AWS provider 6.x, the Floci emulator replacing LocalStack Community, Terraform tests with mocked providers.
• A solution and teacher’s notes explaining every code block line by line, with the expected pitfalls and fallback options.