Getting started session focussing on Terraform and how to use it for infrastructure as code for AWS.

1. Cobus Bernard
Sr Developer Advocate
Amazon Web Services
GettingStarted withAWS:
Infrastructure asCode-Terraform
@cobusbernard
cobusbernard
cobusbernard
CobusCloud

2. © 2020, Amazon Web Services, Inc. or its Affiliates.© 2020, Amazon Web Services, Inc. or its Affiliates.
Agenda
What is Terraform?
Components of Terraform
Demo!
Tips & tricks
Where can you learn more
Q & A

3. © 2020, Amazon Web Services, Inc. or its Affiliates.
What is Infrastructure as Code?

4. © 2020, Amazon Web Services, Inc. or its Affiliates.

5. © 2020, Amazon Web Services, Inc. or its Affiliates.
Infrastructure as code
✓
Make infrastructure
changes repeatable and
predictable
✓
Release infrastructure
changes using the same
tools as code changes
✓
Replicate production in a
staging environment to
enable continuous testing

6. © 2020, Amazon Web Services, Inc. or its Affiliates.
What isTerraform?

7. © 2020, Amazon Web Services, Inc. or its Affiliates.
HashiCorp Configuration Language (HCL)
provider "aws" {
region = "eu-west-1"
}
resource "aws_instance" "web" {
ami = data.aws_ami.ubuntu.id
instance_type = "t2.micro"
tags = {
Name = "🚀 Terraforming AWS 🚀"
}
}

8. © 2020, Amazon Web Services, Inc. or its Affiliates.
Resource Provider
provider "aws" {
region = "eu-west-1"
}

9. © 2020, Amazon Web Services, Inc. or its Affiliates.
Resource
resource "aws_instance" "web" {
ami = data.aws_ami.ubuntu.id
instance_type = "t2.micro"
tags = {
Name = "🚀 Terraforming AWS 🚀"
}
}

10. © 2020, Amazon Web Services, Inc. or its Affiliates.
Resource
resource "aws_instance" "web" {
ami = data.aws_ami.ubuntu.id
instance_type = "t2.micro"
tags = {
Name = "🚀 Terraforming AWS 🚀"
}
}

11. © 2020, Amazon Web Services, Inc. or its Affiliates.
Data Source
data "aws_ami" "ubuntu" {
most_recent = true
filter {
name = "name"
values = ["ubuntu/images/hvm-ssd/ubuntu-bionic-
18.04-amd64-server-*"]
}
owners = ["099720109477"] # Canonical
}

12. © 2020, Amazon Web Services, Inc. or its Affiliates.
How to manage lots of resources?
resource "aws_route53_zone" "cobus_io" {
provider = aws.DNS
name = "cobus.io"
}
resource "aws_route53_record" "cobus_io_gapps_mail" {
provider = aws.DNS
zone_id = aws_route53_zone.cobus_io.zone_id
name = ""
type = "MX"
records = [
"5 ASPMX.L.GOOGLE.COM",
"5 ALT1.ASPMX.L.GOOGLE.COM",
"1 ALT2.ASPMX.L.GOOGLE.COM",
"10 ASPMX2.GOOGLEMAIL.COM",
"10 ASPMX3.GOOGLEMAIL.COM",
]
ttl = "300"
}
resource "aws_route53_record" "cobus_io_gapps_spf" {
provider = aws.DNS
zone_id = aws_route53_zone.cobus_io.zone_id
name = ""
type = "TXT"
records = [
"google-site-verification=IfYouReadThisWave",
"v=spf1 include:_spf.google.com ~all"
]
ttl = "300"
}
resource "aws_route53_record" "cobus_io_gapps_dkim" {
provider = aws.DNS
zone_id = aws_route53_zone.cobus_io.zone_id
name = "google._domainkey"
type = "TXT"
records = [
"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4ThisIsAReallyLongStringLm05tu/lp9douAreWeThereYet?mPkjMv4iT
QMWeeeeeeeeee!IqTUbJN2hwR/frWM+Kvpq+ndXAAndItIsntDoneYetykisW8QiHJBJl8AvEIWFeAr+viKR5fCeyQIDAQABOkImDoneKThxBye"
]
ttl = "300"
}
resource "aws_route53_record" "cobus_io_www" {
provider = aws.DNS
zone_id = aws_route53_zone.cobus_io.zone_id
name = "www"
type = "CNAME"
records = ["cobus.io"]
ttl = "300"
}
resource "aws_instance" "web" {
ami = data.aws_ami.ubuntu.id
instance_type = "t2.micro"
tags = {
Name = "🚀 Terraforming AWS 🚀"
}
}
data "aws_ami" "ubuntu" {
most_recent = true
filter {
name = "name"
values = ["ubuntu/images/hvm-ssd/ubuntu-bionic-18.04-amd64-server-*"]
}
owners = ["099720109477"] # Canonical
}

13. © 2020, Amazon Web Services, Inc. or its Affiliates.
Terraform Modules
# Using the module from https://github.com/terraform-
aws-modules/terraform-aws-vpc
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
name = "AWS SSA Webinar"
cidr = var.vpc_cidr
azs = var.azs
private_subnets = var.private_subnets
public_subnets = var.public_subnets
}

14. © 2020, Amazon Web Services, Inc. or its Affiliates.
Variables
variable "my_favourite_things" {
type = list
default = [
"webinars",
"beers",
"not_lockdown",
"aws",
"devops"
]
}

15. © 2020, Amazon Web Services, Inc. or its Affiliates.
So how doesTerraform
know what was created?

16. © 2020, Amazon Web Services, Inc. or its Affiliates.
Terraform Statefile
{
"version": 3,
"serial": 1,
"lineage": "f0548872-7819-974d-5df7-34653dacd3a1",
"backend": {
"type": "s3",
"config": {
"access_key": null,
"acl": null,
"assume_role_policy": null,

17. © 2020, Amazon Web Services, Inc. or its Affiliates.
Demo!

18. © 2020, Amazon Web Services, Inc. or its Affiliates.
Tips &Tricks

19. © 2020, Amazon Web Services, Inc. or its Affiliates.
Bestpractices(1/3)
• Split your Environments!
• Learn about Workspaces
• Store your statefile safely!
provider "aws" {
version = "~> 2.0"
region = var.aws_region
profile = "default"
assume_role {
role_arn =
"arn:aws:iam::
${var.aws_account_id}:
role/administrator"
}
}

20. © 2020, Amazon Web Services, Inc. or its Affiliates.
Bestpractices(2/3)
• Layer your application to
reduce blast radius when
updating resources
• Use multiple, isolated
environments and services
for testing, production,
development, staging, etc.
• Smaller files are easier to
write, test, and troubleshoot
Instances,Auto Scaling groups
API endpoints, functions
Alarms, dashboards
VPCs, NAT gateways,VPNs, subnets
IAM users, groups, roles, policies
Front-end
resources
Backend
services
Stateful
resources
Base
network
Identity &
security
Monitoring
resources
Databases and clusters, queues

21. © 2020, Amazon Web Services, Inc. or its Affiliates.
Bestpractices(3/3)
• Use available modules, don’t
build your own for the basics
• Make sure you document the
files as you do your source,
make it easy for others to
follow and understand
• Use variables to avoid
hardcoding
# Using the module from
https://github.com/terraform-aws-
modules/terraform-aws-vpc
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
name = "AWS SSA Webinar"
cidr = var.vpc_cidr
azs = var.azs
# We need to put the DBs in private subnets!
private_subnets = var.private_subnets
public_subnets = var.public_subnets
}

22. © 2020, Amazon Web Services, Inc. or its Affiliates.
twitch.tv/aws – Mo/Fr @ 11am SAST Bean Streaming
twitch.tv/aws – Thu @ 12:00 SAST AWS Africa Office Hours
youtube.com/c/CobusCloud
youtube.com/c/Ruptwelve
bit.ly/notC_notD (Watch the recorded weekly sessions)

23. Thank you!
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Cobus Bernard
Sr Developer Advocate
Amazon Web Services
@cobusbernard
cobusbernard
cobusbernard
CobusCloud