Terraform in Action

Terraform in Action
contents
foreword
preface
acknowledgments
about this book
	Who should read this book
	How this book is organized: A roadmap
	About the code
	liveBook discussion forum
about the author
about the cover illustration
Part 1 Terraform bootcamp
	1 Getting started with Terraform
		1.1 What makes Terraform so great?
			1.1.1 Provisioning tool
			1.1.2 Easy to use
			1.1.3 Free and open source software
			1.1.4 Declarative programming
			1.1.5 Cloud-agnostic
			1.1.6 Richly expressive and highly extensible
		1.2 “Hello Terraform!”
			1.2.1 Writing the Terraform configuration
			1.2.2 Configuring the AWS provider
			1.2.3 Initializing Terraform
			1.2.4 Deploying the EC2 instance
			1.2.5 Destroying the EC2 instance
		1.3 Brave new “Hello Terraform!”
			1.3.1 Modifying the Terraform configuration
			1.3.2 Applying changes
			1.3.3 Destroying the infrastructure
		1.4 Fireside chat
		Summary
	2 Life cycle of a Terraform resource
		2.1 Process overview
			2.1.1 Life cycle function hooks
		2.2 Declaring a local file resource
		2.3 Initializing the workspace
		2.4 Generating an execution plan
			2.4.1 Inspecting the plan
		2.5 Creating the local file resource
		2.6 Performing No-Op
		2.7 Updating the local file resource
			2.7.1 Detecting configuration drift
			2.7.2 Terraform refresh
		2.8 Deleting the local file resource
		2.9 Fireside chat
		Summary
	3 Functional programming
		3.1 Fun with Mad Libs
			3.1.1 Input variables
			3.1.2 Assigning values with a variable definition file
			3.1.3 Validating variables
			3.1.4 Shuffling lists
			3.1.5 Functions
			3.1.6 Output values
			3.1.7 Templates
			3.1.8 Printing output
		3.2 Generating many Mad Libs stories
			3.2.1 for expressions
			3.2.2 Local values
			3.2.3 Implicit dependencies
			3.2.4 count parameter
			3.2.5 Conditional expressions
			3.2.6 More templates
			3.2.7 Local file
			3.2.8 Zipping files
			3.2.9 Applying changes
		3.3 Fireside chat
		Summary
	4 Deploying a multi-tiered web application in AWS
		4.1 Architecture
		4.2 Terraform modules
			4.2.1 Module syntax
			4.2.2 What is the root module?
			4.2.3 Standard module structure
		4.3 Root module
			4.3.1 Code
		4.4 Networking module
		4.5 Database module
			4.5.1 Passing data from the networking module
			4.5.2 Generating a random password
		4.6 Autoscaling module
			4.6.1 Trickling down data
			4.6.2 Templating a cloudinit_config
		4.7 Deploying the web application
		4.8 Fireside chat
		Summary
Part 2 Terraform in the wild
	5 Serverless made easy
		5.1 The “two-penny website”
		5.2 Architecture and planning
			5.2.1 Sorting by group and then by size
		5.3 Writing the code
			5.3.1 Resource group
			5.3.2 Storage container
			5.3.3 Storage blob
			5.3.4 Function app
			5.3.5 Final touches
		5.4 Deploying to Azure
		5.5 Combining Azure Resource Manager (ARM) with Terraform
			5.5.1 Deploying unsupported resources
			5.5.2 Migrating from legacy code
			5.5.3 Generating configuration code
		5.6 Fireside chat
		Summary
	6 Terraform with friends
		6.1 Standard and enhanced backends
		6.2 Developing an S3 backend module
			6.2.1 Architecture
			6.2.2 Flat modules
			6.2.3 Writing the code
		6.3 Sharing modules
			6.3.1 GitHub
			6.3.2 Terraform Registry
		6.4 Everyone gets an S3 backend
			6.4.1 Deploying the S3 backend
			6.4.2 Storing state in the S3 backend
		6.5 Reusing configuration code with workspaces
			6.5.1 Deploying multiple environments
			6.5.2 Cleaning up
		6.6 Introducing Terraform Cloud
		6.7 Fireside chat
		Summary
	7 CI/CD pipelines as code
		7.1 A tale of two deployments
		7.2 CI/CD for Docker containers on GCP
			7.2.1 Designing the pipeline
			7.2.2 Detailed engineering
		7.3 Initial workspace setup
			7.3.1 Organizing the directory structure
		7.4 Dynamic configurations and provisioners
			7.4.1 for_each vs. count
			7.4.2 Executing scripts with provisioners
			7.4.3 Null resource with a local-exec provisioner
			7.4.4 Dealing with repeating configuration blocks
			7.4.5 Dynamic blocks: Rare boys
		7.5 Configuring a serverless container
		7.6 Deploying static infrastructure
		7.7 CI/CD of a Docker container
			7.7.1 Kicking off the CI/CD pipeline
		7.8 Fireside chat
		Summary
	8 A multi-cloud MMORPG
		8.1 Hybrid-cloud load balancing
			8.1.1 Architectural overview
			8.1.2 Code
			8.1.3 Deploy
		8.2 Deploying an MMORPG on a federated Nomad cluster
			8.2.1 Cluster federation 101
			8.2.2 Architecture
			8.2.3 Stage 1: Static infrastructure
			8.2.4 Stage 2: Dynamic infrastructure
			8.2.5 Ready player one
		8.3 Re-architecting the MMORPG to use managed services
			8.3.1 Code
			8.3.2 Ready player two
		8.4 Fireside chat
		Summary
Part 3 Mastering Terraform
	9 Zero-downtime deployments
		9.1 Lifecycle customizations
			9.1.1 Zero-downtime deployments with create_before_destroy
			9.1.2 Additional considerations
		9.2 Blue/Green deployments
			9.2.1 Architecture
			9.2.2 Code
			9.2.3 Deploy
			9.2.4 Blue/Green cutover
			9.2.5 Additional considerations
		9.3 Configuration management
			9.3.1 Combining Terraform with Ansible
			9.3.2 Code
			9.3.3 Infrastructure deployment
			9.3.4 Application deployment
		9.4 Fireside chat
		Summary
	10 Testing and refactoring
		10.1 Self-service infrastructure provisioning
			10.1.1 Architecture
			10.1.2 Code
			10.1.3 Preliminary deployment
			10.1.4 Tainting and rotating access keys
		10.2 Refactoring Terraform configuration
			10.2.1 Modularizing code
			10.2.2 Module expansions
			10.2.3 Replacing multi-line strings with local values
			10.2.4 Looping through multiple module instances
			10.2.5 New IAM module
		10.3 Migrating Terraform state
			10.3.1 State file structure
			10.3.2 Moving resources
			10.3.3 Redeploying
			10.3.4 Importing resources
		10.4 Testing infrastructure as code
			10.4.1 Writing a basic Terraform test
			10.4.2 Test fixtures
			10.4.3 Running the test
		10.5 Fireside chat
		Summary
	11 Extending Terraform by writing a custom provider
		11.1 Blueprints for a Terraform provider
			11.1.1 Terraform provider basics
			11.1.2 Petstore provider architecture
		11.2 Writing the Petstore provider
			11.2.1 Setting up the Go project
			11.2.2 Configuring the provider schema
		11.3 Creating a pet resource
			11.3.1 Defining Create()
			11.3.2 Defining Read()
			11.3.3 Defining Update()
			11.3.4 Defining Delete()
		11.4 Writing acceptance tests
			11.4.1 Testing the provider schema
			11.4.2 Testing the pet resource
		11.5 Build, test, deploy
			11.5.1 Deploying the Petstore API
			11.5.2 Testing and building the provider
			11.5.3 Installing the provider
			11.5.4 Pets as code
		11.6 Fireside chat
		Summary
	12 Automating Terraform
		12.1 Poor person’s Terraform Enterprise
			12.1.1 Reverse-engineering Terraform Enterprise
			12.1.2 Design details
		12.2 Beginning at the root
		12.3 Developing a Terraform CI/CD pipeline
			12.3.1 Declaring input variables
			12.3.2 IAM roles and policies
			12.3.3 Building the Plan and Apply stages
			12.3.4 Configuring environment variables
			12.3.5 Declaring the pipeline as code
			12.3.6 Touching base
		12.4 Deploying the Terraform CI/CD pipeline
			12.4.1 Creating a source repository
			12.4.2 Creating a least-privileged deployment policy
			12.4.3 Configuring Terraform variables
			12.4.4 Deploying to AWS
			12.4.5 Connecting to GitHub
		12.5 Deploying “Hello World!” with the pipeline
			12.5.1 Queuing a destroy run
		12.6 Fireside chat
			12.6.1 FAQ
		Summary
	13 Security and secrets management
		13.1 Securing Terraform state
			13.1.1 Removing unnecessary secrets from Terraform state
			13.1.2 Least-privileged access control
			13.1.3 Encryption at rest
		13.2 Securing logs
			13.2.1 What sensitive information?
			13.2.2 Dangers of local-exec provisioners
			13.2.3 Dangers of external data sources
			13.2.4 Dangers of the HTTP provider
			13.2.5 Restricting access to logs
		13.3 Managing static secrets
			13.3.1 Environment variables
			13.3.2 Terraform variables
			13.3.3 Redirecting sensitive Terraform variables
		13.4 Using dynamic secrets
			13.4.1 HashiCorp Vault
			13.4.2 AWS Secrets Manager
		13.5 Sentinel and policy as code
			13.5.1 Writing a basic Sentinel policy
			13.5.2 Blocking local-exec provisioners
		13.6 Final words
		Summary
appendix A Authenticating to AWS
	A.1 Creating an AWS account
	A.2 Creating an IAM user
	A.3 Installing the AWS CLI (optional)
	A.4 Configuring the credentials file
	A.5 Configuring the AWS provider in Terraform
appendix B Authenticating to Azure
	B.1 Creating an Azure account
	B.2 Installing the Azure CLI
	B.3 Obtaining credentials via the CLI
	B.4 Configuring Azure CLI authentication in Terraform
appendix C Authenticating to GCP
	C.1 Creating a GCP account
	C.2 Creating a new project
	C.3 Installing the Google Cloud SDK
	C.4 Authenticating with the Google Cloud SDK
	C.5 Configuring the GCP provider in Terraform
appendix D Creating custom resources with the Shell provider
	D.1 Installing the provider
	D.2 Using the provider
	D.3 Final thoughts
appendix E Creating a Petstore data source
	E.1 Registering the data source
	E.2 Creating the data source
	E.3 Writing acceptance tests
		E.3.1 Running acceptance tests
	E.4 Using the data source
index
	A
	B
	C
	D
	E
	F
	G
	H
	I
	J
	L
	M
	N
	O
	P
	Q
	R
	S
	T
	U
	V
	W
	Z
Terraform in Action - back