Chapter 7: Environments, Testing, and Debugging

Learning objectives

Use a root module plus reviewed .tfvars inputs.
Run native plan tests for learning and production behavior.
Inspect plans, console values, logs, and drift without guessing.

Environment is input, not a hidden switch

Root modules

Each independently applied state has its own root and backend.

Variable files

Make reviewable values explicit with learning and production files.

Workspaces

They change state names, not account, region, credentials, or blast radius.

Native tests

Plan tests assert configuration behavior; use provider mocks only when a provider result is the subject.

Use terraform console or tofu console for expressions. Use TF_LOG=debug only for a focused diagnosis and remove sensitive logs afterward. A refresh-only plan reports drift; it does not decide whether configuration or the remote object is correct.

AWS context

Learning and production should normally differ by account and role, not merely a workspace. For production, deletion protection is an explicit input in the reviewed production variable file.

Lab: test the environment contract

Read learning.tfvars, production.tfvars, and the native test file.

cd learn-terraform/labs/07-environments
terraform init -backend=false
terraform test
terraform plan -var-file=learning.tfvars
terraform plan -var-file=production.tfvars

tofu init -backend=false
tofu test
tofu plan -var-file=learning.tfvars
tofu plan -var-file=production.tfvars

The tests make policy observable: learning returns false, production returns true. The plans confirm the committed variable files express the same intent.

Review environment input

Input	Learning	Production
deletion protection	`false`	`true`
account and role	separate learning access	separate production access and approval
workspace	optional state convenience	not an isolation boundary

Failure drill

A passing workspace name is not a safe production boundary. Stop if the current identity, account, or region is unclear. Confirm them before any apply, then use a saved reviewed plan.

Verify

Run each supported CLI's native test command.
Run both variable-file plans and compare output.
Use console to inspect a value, then leave without writing state.

Cleanup

This lab does not create provider resources. Remove generated initialization directories and local state before committing.

Quick check

Does a workspace isolate AWS accounts?

No. Provider credentials and account selection are separate concerns.

When should a native test use a mock?

When the test needs a provider response but must not call the real provider.

Recap and next

Values, tests, and identities must agree before an apply. Next, bootstrap a remote backend without a circular state dependency.

Next: AWS Providers and Remote State