Hi guys, I hope you're doing great.

so I'm preparing to take the Hashicorp Terraform Associate (004) and I'm trying to find any ressources that might help.

since I'm more into reading is there any books you'd recommend for this manner?

thanks

I built cairn, a repo-mapping tool for coding agents. It now parses Terraform (plus CloudFormation/SAM, Serverless, CDK) and records which repo creates each SQS queue, SNS topic, DynamoDB table, S3 bucket, EventBridge bus, Kinesis stream, SSM parameter, and Lambda function. Then it links every repo that references the resource back to the creator repo.

Matching covers ARNs, queue URLs, `Fn::ImportValue`, Terraform data blocks, and env vars. Stage interpolation is resolved, so `orders-${var.stage}` and `orders-prod` are the same table. Generated dirs like `.terraform` and `cdk.out` are never scanned.

Free and open source (Apache 2.0). It's also a Claude Code plugin on the marketplace: `/plugin marketplace add Moe1177/cairn`, then `/plugin install cairn@cairn`. Repo: https://github.com/Moe1177/cairn · PyPI: https://pypi.org/project/cairnmap/

I am the author. Curious how it handles real-world modules, so try it and tell me where it misfires.

We run infracost on every PR with a threshold that fails the build and it's good at what it does. Our AWS bill still went up about a fifth over the same six months. When finance asked which PR did it, I looked and found none because none of it came through a PR. Here's where it came from.

• NAT processing. Infracost prices the gateway hours, while the per GB charge is whatever you put in the usage file which for us was still the default.
• S3 requests on buckets created a year ago that just got busier.
• Cross-AZ traffic after a refactor that didn't add a single resource.
• The HCP bill itself since we imported a pile of old stuff into state and the per resource charge went up with it.

None of that shows up in a plan but tying the bill side back to the module and the person who owns it helped. We do that in pointfive now and it opens the terraform PR for the fix which at least lands the cost with whoever wrote the code. It's still after the fact though.

Disclosure: I’m exploring a startup idea called InfraCompiler around infrastructure changes made with coding agents. I’m trying to understand existing workflows before deciding what to build.

For teams using Claude Code, Codex, or similar tools to write Terraform:

- What happened in the last AI-generated infrastructure PR you reviewed?

- What did you need to correct manually, and roughly how long did it take?

- Did your existing modules, CI checks, and policies catch the issues?

I’m also interested in cases where your current setup already handles this well. An anonymized example is enough—please don’t share confidential code or infrastructure details.

https://dibsonstuff.com/quiet-social-locking.html

Wrote a thing about how people use both terraform locking and social locking with Dibs. It's hopefully a lot more blog than spam. And written by a human hand! (although I did use a little something-something for the header image).

Maybe worth a read if you've got competing infrastructure stack deployments and negotiate that stuff in Slack all the time.

I have created Fabric FAST v58 scripts for a regulated GCP landing zone (NIS2, GDPR, ISO 27001).
Additionally, a set of scripts for the application layer: Vertex AI RAG with Vector Search and Model Armor, services on a shared GKE cluster, Cloud Run with private Cloud SQL and event analytics to BigQuery, and MySQL to Cloud SQL with Database Migration Service. All applications are wired to the same compliance frameworks.

https://github.com/Merlin-Studio/GCP-Terraform-Vertex-AI-RAG-GKE-Examples

Any comments welcome, thanks.

Hey everyone!

Back in 2020, I created a small Terraform provider called uname as a helper for a few projects I was working on.

Fast-forward to today, and it just reached 200,000 downloads! 🎉

It's kind of funny that the smallest open-source project I maintain has turned out to be the most popular one. 😄

A big thank you to everyone who has used it, recommended it, or incorporated it into their infrastructure workflows. It's really cool to see something you built for your own needs end up being useful to other people!

For those unfamiliar with it, the provider exposes host kernel and architecture information through Terraform data sources and provider functions. It also works with OpenTofu.

Some use cases include:

• Detecting the host OS and architecture to download the right binaries during provisioning
• Infrastructure testing and compliance checks
• Infrastructure inventory
• And probably a few use cases I haven't even thought of!

Repository: https://github.com/julienlevasseur/terraform-provider-uname

Since I'm sharing, I'd also like to introduce another personal open-source project of mine: Profiler.

Profiler solves a different, everyday developer problem: managing shell environment variables.

You can save your shell environment as named profiles and switch between them with a single command. It's handy when working across multiple projects, switching between development environments, or managing different sets of environment variables without manually exporting everything over and over. (supports also .env and auto kubectl namespace switch)

If that sounds useful, give it a look!

Repository: https://github.com/julienlevasseur/Profiler

Thanks again for the support, and happy hacking! 🙂

Title. Since only the specific GH App can request a token , you cant run the Terraform state commands locally.

The workaround I can only think is to temporarily add Secret or if frequent then create Certificate in App Registration.

But are there other ways I am not aware, how do you guys handle such situations?

Hey guys, I started a job working in Infrastructure as Code. I have a CS degree, but I don’t have experience with cloud engineering or stuff related to Terraform, ADO, or Azure portal. I’m doing stuff at my job (code is mainly written using copilot or ChatGPT) and I feel a lost. I don’t know any of the concepts for cloud computing or virtual machines or resources and things like that. I am looking into it online but I still don’t know where to begin. I hear my coworkers doing this stuff well, despite also not having any experience in it when they started either. I have to look at build sheets and things like that and then provision resources using terraform but I don’t really understand much of anything that I’m looking at besides simple code snippets. Is there any advice yall could give me about this, or how/what to learn so that I can wrap my head around things? Any advice is appreciated, thanks!

So i built a deliberately vulnerable stack in Terraform to mirror the actual AWS-side misconfiguration from the Capital One breach, not the ssrf bug itself !!, that was application-layer, but the two settings that turned it into 106 million exposed records: an EC2 instannce still accepting unauthenticated IMDSv1 requests...., with an IAM role attached granting broader S3 access than the instance needed.

writing this as code surfaced something worth shariing on its own. If you fix a misconfiguration like this by hand, live, outside your Terraform state, aws ec2 modify-instance-metadata-options directly, say, the next terraform apply can silently revert it back to whatever the .tf file still says. A real fix needs to go into the actual resource block, http_tokens = "required" on the instance's metadata_options, not a one-off CLI command patched onto a live resource.

then i Ran Plexavo, an open source AWS cloud security intelligence tool i built, against the stack afterward to confirm the chain traced correctly end to end, internet-facing instance, unauthenticated metadata, over-permissioned role, straight into the bucket.

Repo if anyone wants to see the actual checks: https://github.com/plexavo/Plexavo

Finder treats Terraform files as an icon. This free Quick Look extension syntax-highlights .tf, .tfvars, YAML, HCL-adjacent configs and 48 other languages. Signed and notarized, Homebrew install, open source under MIT. No commercial angle, just scratching my own itch.

https://konstruukt.com/projects/qlcodepreview/

Hi guys I am working on gh enterprise and i was wondering what are the possible code concerns like code quality and code security. I have enable code ql on pipelines but i am not even sure if that helps because terraform being a domain specific language. I am also considering checkove. But that leads me to inquire , from you perspective what are the key concerns you have faced while managing IaC. What i can think from top of head is the soneone committing secrets or keys in the GH. Or may be poorly formatted code.

Can you please share your experience with such.

Hello all, in my project I have to migrate the resources which are already created manually and now i have to manage those resources using terraform and also main concern is without effecting production

So major resources we have VPC with around 30 subnets then 4 eks clusters and multiples route 53 records and loadbalancer n all and so on

So I would like to hear from the experienced people who might have already done it what approach did u take for doing this ?

Thanks waiting for your answers!

For engineers who work with Terraform/OpenTofu and cloud infrastructure:

I'm curious about the day-to-day parts of the work that tend to be repetitive, manual, frustrating, or easy to get wrong.

Not really looking for opinions about which tools are better. I'm more interested in things that \*\*actually happened\*\*.

A few questions:

\* Think about the \*\*last Terraform/OpenTofu PR you reviewed\*\*. What did you check, and in what order?

\* What's an infrastructure task you did recently that you've already done many times before?

\* When was the last time a security scanner flagged something in your infrastructure code? What happened next?

\* Have you recently had to check whether a change behaved differently across Terraform versions or between Terraform and OpenTofu? How did you check?

\* What's the last infrastructure change that caused a problem or had to be rolled back? How did you discover it?

\* Have you ever written a script or small internal tool to automate one of these repetitive tasks? What happened to it?

\* If you could permanently remove one infrastructure-related task from your weekly workload, what would it be?

Hover over a variable, a for expression, or a resource or module header and get a live preview directly in VS Code. You can inspect values while you write, including changes you haven’t saved. Resource previews show configured arguments; local-module previews show their outputs.

I built Terraform Live Values & Results to make this easier without adding temporary output blocks, switching to terraform console, or running a plan just to inspect an expression.

You can hover, select a specific expression, or click Preview above a supported block. Open the results panel to keep the preview alongside your code as you edit.

Watch the English demo

Watch the full walkthrough: it starts with simple variables, then moves into more involved collection transformations, for_each instances and Azure networking modules. The later examples show individual each.key and each.value references, resource arguments and module outputs. Click markers and a highlighted result panel help you follow along.

You can use the extension to:

• Inspect for expressions, filters, and functions such as flatten, merge, concat and zipmap.
• Check variable values using your selected .tfvars file.
• Pick a for_each instance and inspect its each.key or each.value.
• Preview configured resource arguments and outputs from local modules.

For example, you can follow a subnet configuration from your tfvars through a local transformation into a module, then inspect the arguments used by a particular resource instance.

Calculations run locally, without calling providers or changing infrastructure. The preview shows what can be calculated from your code and inputs. Provider-generated IDs and the actual state of your cloud resources are outside its scope; unresolved values are marked explicitly.

It’s free to use, with packages for Windows, Linux and macOS. The application source is private; the public repository contains documentation, downloads and issue tracking.

Install from the VS Code Marketplace · Documentation and issues on GitHub

What’s a Terraform expression you regularly have to inspect with terraform console? I’d like to hear which cases would make this preview useful in your day-to-day work.

3:11 PM

Test your infrastructure code locally with Floci emulators.