Build and manage complete cloud infrastructure using Terraform with modules, state management, multi-environment, and CI/CD integration.
Build and manage complete cloud infrastructure using Terraform with modules, state management, multi-environment, and CI/CD integration. This comprehensive guide covers everything from design through implementation, testing, and deployment.
Terraform: declarative IaC (describe desired state, not steps to get there). Provider: plugin for each cloud/service (AWS, GCP, Azure, Kubernetes, Datadog). Resource: each cloud object (aws_instance, aws_s3_bucket, aws_rds_cluster). Data sources: read existing resources not managed by Terraform. State file: tracks actual deployed resources to detect drift. Plan: shows what will change before applying. Apply: makes changes. Destroy: remove all resources. Never modify state file manually.
10 components required for this project.
| # | Component | Purpose | Qty |
|---|---|---|---|
| 1 | Terraform CLI 1.6+ | Infrastructure provisioning tool | x1 |
| 2 | AWS Account or GCP/Azure | Cloud provider | x1 |
| 3 | AWS CLI | Cloud provider authentication | x1 |
| 4 | Terraform Cloud (free tier) | State backend and team collaboration | x1 |
| 5 | VS Code + HashiCorp extension | Terraform development environment | x1 |
| 6 | tfsec / checkov | Terraform security scanning | x1 |
| 7 | Terratest (Go) | Infrastructure testing framework | x1 |
| 8 | pre-commit hooks | Terraform format and validation | x1 |
| 9 | GitHub Actions | Terraform plan/apply in CI/CD | x1 |
| 10 | AWS Cost Explorer | Infrastructure cost monitoring | x1 |
Follow these 6 steps carefully.
Terraform: declarative IaC (describe desired state, not steps to get there). Provider: plugin for each cloud/service (AWS, GCP, Azure, Kubernetes, Datadog). Resource: each cloud object (aws_instance, aws_s3_bucket, aws_rds_cluster). Data sources: read existing resources not managed by Terraform. State file: tracks actual deployed resources to detect drift. Plan: shows what will change before applying. Apply: makes changes. Destroy: remove all resources. Never modify state file manually.
Create a complete AWS VPC: CIDR 10.0.0.0/16. Public subnets (10.0.1.0/24, 10.0.2.0/24) in 2 AZs — for load balancers, NAT gateways. Private subnets (10.0.11.0/24, 10.0.12.0/24) — for EC2 instances, ECS tasks. Database subnets (10.0.21.0/24, 10.0.22.0/24) — for RDS, isolated from internet. Internet Gateway for public subnets. NAT Gateway for private subnets (outbound internet access). Route tables configured appropriately. Terraform modules encapsulate this for reuse.
ECS Fargate: serverless containers — no EC2 to manage. Define task definition: container image, CPU (256 units = 0.25 vCPU), memory (512 MB), port mapping, environment variables from Parameter Store, logging to CloudWatch. ECS Service: maintain 2 running tasks, ALB health check integration, auto-scaling based on CPU/request count. ALB: distribute traffic across ECS tasks, SSL termination with ACM certificate, health checks at /health endpoint.
RDS PostgreSQL Multi-AZ deployment: primary in AZ1, standby replica in AZ2 (automatic failover). db.t3.medium instance. Encrypted storage (KMS CMK). Automated backups: 7-day retention, daily snapshots. DB subnet group using database subnets (isolated from internet). Security group: allow only from ECS task security group on port 5432. Password: generated with random_password resource, stored in AWS Secrets Manager, injected into ECS task at runtime.
Directory structure: modules/ (reusable: vpc, ecs, rds, alb), environments/dev/, environments/staging/, environments/prod/ — each environment calls modules with different variable values (instance sizes, replica counts, backup retention). Use Terraform workspaces or separate state files per environment. Environment-specific variables: dev uses smaller instances (cost), prod uses Multi-AZ (reliability). Backend configuration: each environment uses separate Terraform Cloud workspace or S3 state bucket prefix.
tfsec: static analysis of Terraform files before apply — detect security misconfigurations (S3 bucket public access, security groups open to 0.0.0.0/0, unencrypted storage). Checkov: compliance scanning against CIS AWS Benchmark. Cost estimation: infracost CLI shows monthly cost of plan changes before applying — prevent accidental expensive resource creation. Tag enforcement: require tags (Environment, Team, CostCenter) via Sentinel policy or pre-commit validation. Drift detection: terraform plan run daily in CI/CD to detect out-of-band changes.
Core code for main.tf:
# CATB.in Infrastructure — Terraform Configuration terraform { required_version = ">= 1.6" required_providers { aws = { source = "hashicorp/aws", version = "~> 5.0" } } backend "s3" { bucket = "catb-terraform-state" key = "prod/terraform.tfstate" region = "ap-south-1" } } provider "aws" { region = "ap-south-1" } module "vpc" { source = "terraform-aws-modules/vpc/aws" version = "5.0" name = "catb-prod-vpc" cidr = "10.0.0.0/16" azs = ["ap-south-1a", "ap-south-1b"] public_subnets = ["10.0.1.0/24", "10.0.2.0/24"] private_subnets = ["10.0.11.0/24", "10.0.12.0/24"] enable_nat_gateway = true; single_nat_gateway = false # HA NAT tags = { Environment = "prod", Project = "catb" } } resource "aws_ecs_cluster" "main" { name = "catb-prod-cluster" setting { name = "containerInsights", value = "enabled" } } resource "aws_db_instance" "main" { identifier = "catb-prod-db" engine = "postgres" engine_version = "15.4" instance_class = "db.t3.medium" allocated_storage = 100 storage_encrypted = true multi_az = true backup_retention_period = 7 db_subnet_group_name = aws_db_subnet_group.main.name vpc_security_group_ids = [aws_security_group.rds.id] skip_final_snapshot = false }Test Cloud Infrastructure with Terraform by verifying each subsystem individually before full integration.
Verify power voltages, check ground connections, use serial monitor for debug.
An interactive simulator will be available here — simulate circuits and run code in-browser without hardware.