Chapter 1: Infrastructure as Code and Safe Setup

Learning objectives

Explain why IaC is a reviewed desired-state declaration, not a shell script log.
Choose Terraform or OpenTofu from the shared compatibility contract.
Confirm the AWS account, profile, and region before an AWS lab.
Run a provider-free plan and read its proposed change.

IaC is a desired-state contract

Configuration

You declare the result: a resource, inputs, and outputs. The configuration is reviewable and can be rerun.

Plan

The CLI compares the declaration with its state and shows the actions it would take. A plan is the decision point.

Apply

Only an explicit apply changes infrastructure. This chapter never reaches that step.

State

State maps configuration addresses to real objects. Later chapters cover locking, storage, and recovery.

Safe default: read the resource address, action, account, region, and cost impact in every plan before applying.

Terraform and OpenTofu

Both use HCL and support this course's shared configuration. Install Terraform from the official Terraform installation guide or OpenTofu from the official OpenTofu installation guide. Keep a workspace's state with the one CLI you choose.

terraform version
tofu version

Compare the installed versions with the compatibility contract before starting a lab. The contract, not copied snippets, records the course pins and supported ranges.

AWS context before an AWS plan

This first lab has no provider and needs no AWS login. Future AWS labs do. Prefer SSO or IAM Identity Center over long-lived access keys.

aws sso login --profile learning
aws sts get-caller-identity --profile learning
aws configure get region --profile learning

Check	Why it matters
Account ID and ARN	Confirms the identity and account that a provider will use.
Profile name	Keeps an intentional learning profile separate from personal or production work.
Region	Resources and prices vary by region. Make it explicit before apply.

Stop: if the account, role, or region is not the one you intended, do not plan or apply. Fix the profile first.

Lab: your first provider-free plan $0 plan-only

Open the lab README. Its terraform_data resource is built in, so it declares no AWS resource and downloads no third-party provider.

Terraform

cd learn-terraform/labs/01-first-plan
terraform init
terraform plan

OpenTofu

cd learn-terraform/labs/01-first-plan
tofu init
tofu plan

Use one command pair, not both in the same working directory. The configuration has the shared language constraint from the course design and is exercised with the current CLI ranges in COMPATIBILITY.md.

Read the plan before any apply

Expect one resource to add and one output. A value computed by a new resource is unknown until an apply, so the plan shows the input now and the output as pending.

  + input  = "hello, builder"
  + output = (known after apply)

Plan: 1 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + message = (known after apply)

The address is terraform_data.welcome.
The action is add, not change or destroy.
The input is hello, builder; the output is known only after apply.
There is no provider "aws" block and no cloud resource.

Failure drill: wrong tool or wrong directory

If init reports that the CLI version is unsupported, inspect terraform version or tofu version, then compare it with the compatibility contract. Do not loosen the version rule to make an old installation pass.

If the plan is empty or shows unexpected resources, stop and confirm that you are in labs/01-first-plan and that only the lab's main.tf is present.

Verify

Run terraform plan or tofu plan.
Confirm 1 to add, 0 to change, 0 to destroy.
Confirm the input is hello, builder and the output is known after apply.
Confirm no AWS login, account, or billing activity was required.

Cleanup

No cleanup is required because this lab intentionally ends at plan. If you later run apply while experimenting, use terraform destroy or tofu destroy with the same CLI before moving on.

Quick check

Does plan create infrastructure?

No. It calculates and presents proposed actions. apply performs them.

Why check account and region before a future AWS plan?

The same configuration can target a different account or region through credentials and provider settings. That is a meaningful change in blast radius.

Why does this lab not need AWS credentials?

It uses the built-in terraform_data resource and contains no AWS provider or AWS resource.

Recap and next

IaC makes desired state reviewable, but safety comes from reading plans and keeping identity context explicit. You now have a zero-cost workspace that demonstrates the configuration, init, plan, and output loop.

Next: Chapter 2, HCL as a Language, is planned. Return to the course index for the roadmap.