Challengeterraform
Terraform Validation, Linting & CI — Challenge
Build the gate that runs before every apply: format, validate, lint, scan, and a plan a human approves.
- Time
- 25 min
- Level
- Intermediate
- Objectives
- 4 objectives
- Cost
- Free
Before you start
You will need
- Terraform >= 1.6
- tflint
- trivy or checkov
- A GitHub repository
You will be able to
- Chain the checks that catch a bad change before it reaches AWS
- Apply exactly the plan that was reviewed
- Detect drift on a schedule rather than during an incident
Cost — Free
— everything here runs without creating infrastructure. `plan` reads AWS but changes nothing.
You are done when
0 of 4
The goal#
Achieve the same outcome as Terraform Validation, Linting & CI, from an empty starting point, without the steps.
Terraform runs from someone's laptop. Reviews read the HCL, not the plan, so nobody notices the -/+ that would recreate the database until it happens.
This lab puts the checks in front of the apply.
What must be true when you are done#
fmt,validate,tflintand a security scan all run in CI on a pull request.- A misformatted or insecure change fails the pipeline — proven deliberately.
- The apply consumes a saved plan artifact rather than re-planning.
- A scheduled run reports drift when a resource is changed outside Terraform.
Rules#
- Do not open the guided lab until you are finished, or until the same problem has held you up for 20 minutes.
- Documentation is allowed and encouraged.
- Verify every criterion with a command whose output you can read.
If you get stuck#
- What did you expect, exactly?
- What happened instead — the error text, not a paraphrase?
- Which layer is that error from?
- What is the smallest command that proves the layer below is fine?
The concept behind it
Phase complete · 04 Infrastructure as Code
You can now: The AWS environment is described in version-controlled modules with remote, locked state.
Next phase
Lab 28 of 58 on the project path