{"id":12956,"date":"2026-10-13T08:33:31","date_gmt":"2026-10-13T08:33:31","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=12956"},"modified":"2026-10-13T08:33:33","modified_gmt":"2026-10-13T08:33:33","slug":"terraform-conditioning-example-program","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/terraform-conditioning-example-program\/","title":{"rendered":"Terraform Conditional Expressions and Logic: Complete Guide with Examples"},"content":{"rendered":"\n

Terraform Conditional Expressions and Logic \u2014 Summary Table<\/h2>\n\n\n\n
#<\/th>Concept<\/th>Purpose<\/th>Example<\/th>Creates Resources?<\/th><\/tr>
1<\/td>Ternary operator<\/td>Choose between two values<\/td>var.env == \"prod\" ? \"t3.large\" : \"t3.micro\"<\/code><\/td>No<\/td><\/tr>
2<\/td>Equality operators<\/td>Check equality or inequality<\/td>var.env == \"prod\"<\/code><\/td>No<\/td><\/tr>
3<\/td>Comparison operators<\/td>Compare values<\/td>var.count > 2<\/code><\/td>No<\/td><\/tr>
4<\/td>Logical AND (&&<\/code>)<\/td>All conditions must be true<\/td>var.env == \"prod\" && var.monitoring<\/code><\/td>No<\/td><\/tr>
5<\/td>Logical OR (\\|\\|<\/code>)<\/td>At least one condition must be true<\/td>var.env == \"prod\" \\|\\| var.env == \"stage\"<\/code><\/td>No<\/td><\/tr>
6<\/td>Logical NOT (!<\/code>)<\/td>Reverse a Boolean value<\/td>!var.enable_public_ip<\/code><\/td>No<\/td><\/tr>
7<\/td>Parentheses<\/td>Group complex conditions<\/td>(var.env == \"prod\" \\|\\| var.env == \"stage\") && var.enabled<\/code><\/td>No<\/td><\/tr>
8<\/td>Conditional count<\/code><\/td>Create zero or one resource<\/td>count = var.enabled ? 1 : 0<\/code><\/td>Yes<\/td><\/tr>
9<\/td>Conditional for_each<\/code><\/td>Create selected named resources<\/td>for_each = var.enabled ? var.instances : {}<\/code><\/td>Yes<\/td><\/tr>
10<\/td>Conditional locals<\/code><\/td>Select configuration by environment<\/td>instance_type = var.env == \"prod\" ? \"t3.large\" : \"t3.micro\"<\/code><\/td>No<\/td><\/tr>
11<\/td>Filter with for<\/code><\/td>Select collection elements that meet a condition<\/td>{ for k, v in var.rules : k => v if v.enabled }<\/code><\/td>No, but can feed for_each<\/code><\/td><\/tr>
12<\/td>lookup()<\/code><\/td>Retrieve a map value with a default<\/td>lookup(var.sizes, var.env, \"t3.micro\")<\/code><\/td>No<\/td><\/tr>
13<\/td>try()<\/code><\/td>Fall back when an expression errors<\/td>try(var.settings.instance_type, \"t3.micro\")<\/code><\/td>No<\/td><\/tr>
14<\/td>can()<\/code><\/td>Check whether an expression evaluates without error<\/td>can(var.settings.port)<\/code><\/td>No<\/td><\/tr>
15<\/td>coalesce()<\/code><\/td>Return the first non-null, non-empty string<\/td>coalesce(var.name, \"default-name\")<\/code><\/td>No<\/td><\/tr>
16<\/td>Variable validation<\/td>Reject invalid input<\/td>validation { ... }<\/code><\/td>No<\/td><\/tr>
17<\/td>Preconditions<\/td>Enforce requirements before an operation<\/td>precondition { ... }<\/code><\/td>No<\/td><\/tr>
18<\/td>Postconditions<\/td>Verify a resource or data-source result<\/td>postcondition { ... }<\/code><\/td>No<\/td><\/tr>
19<\/td>Conditional dynamic<\/code> block<\/td>Include nested configuration conditionally<\/td>for_each = var.enabled ? [1] : []<\/code><\/td>No standalone resource<\/td><\/tr>
20<\/td>Conditional module<\/td>Deploy a module only when needed<\/td>count = var.create_network ? 1 : 0<\/code><\/td>Yes, module instances<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Complete Master Guide with AWS and Azure Labs<\/h2>\n\n\n\n

Audience:<\/strong> Beginners to advanced DevOps \/ Cloud engineers
Terraform:<\/strong> Terraform 1.5+ recommended (some examples use features available in Terraform 1.2+)
Clouds:<\/strong> AWS EC2 and Azure Linux Virtual Machines
Format:<\/strong> Self-contained labs, explanations, run commands, expected outcomes, troubleshooting, and cleanup<\/p>\n\n\n\n

\n\n\n\n

Table of Contents<\/h2>\n\n\n\n
    \n
  1. Learning objectives<\/a><\/li>\n\n\n\n
  2. Before you begin<\/a><\/li>\n\n\n\n
  3. Conditional logic: the basic idea<\/a><\/li>\n\n\n\n
  4. Lab 1 — Ternary conditional expression<\/a><\/li>\n\n\n\n
  5. Lab 2 — Logical operators and compound conditions<\/a><\/li>\n\n\n\n
  6. Lab 3 — Conditional resource creation with count<\/a><\/li>\n\n\n\n
  7. Lab 4 — for_each with conditional filtering<\/a><\/li>\n\n\n\n
  8. Lab 5 — Conditional configuration using locals<\/a><\/li>\n\n\n\n
  9. Lab 6 — Dynamic blocks and optional nested rules<\/a><\/li>\n\n\n\n
  10. Lab 7 — Input variable validation<\/a><\/li>\n\n\n\n
  11. Lab 8 — Preconditions and postconditions<\/a><\/li>\n\n\n\n
  12. Lab 9 — try(), can(), lookup(), and coalesce()<\/a><\/li>\n\n\n\n
  13. Lab 10 — Conditional module instances<\/a><\/li>\n\n\n\n
  14. Important patterns and gotchas<\/a><\/li>\n\n\n\n
  15. Troubleshooting<\/a><\/li>\n\n\n\n
  16. Best practices<\/a><\/li>\n\n\n\n
  17. Quick reference<\/a><\/li>\n\n\n\n
  18. Exercises and answers<\/a><\/li>\n\n\n\n
  19. Glossary<\/a><\/li>\n<\/ol>\n\n\n\n
    \n\n\n\n

    1. Learning objectives<\/h2>\n\n\n\n

    After completing this guide, you should be able to:<\/p>\n\n\n\n

      \n
    • Choose a value using Terraform’s conditional (condition ? true_value : false_value<\/code>) expression.<\/li>\n\n\n\n
    • Combine conditions using\u00a0&&<\/code>,\u00a0||<\/code>,\u00a0!<\/code>, and comparison operators.<\/li>\n\n\n\n
    • Create zero, one, or many resources using\u00a0count<\/code>\u00a0and\u00a0for_each<\/code>.<\/li>\n\n\n\n
    • Filter collections using\u00a0for<\/code>\u00a0expressions and\u00a0if<\/code>.<\/li>\n\n\n\n
    • Generate nested configuration using\u00a0dynamic<\/code>\u00a0blocks.<\/li>\n\n\n\n
    • Validate input values and enforce assumptions with preconditions and postconditions.<\/li>\n\n\n\n
    • Handle optional values and expression errors with\u00a0try<\/code>,\u00a0can<\/code>,\u00a0lookup<\/code>, and\u00a0coalesce<\/code>.<\/li>\n\n\n\n
    • Test a configuration with\u00a0terraform plan<\/code>,\u00a0apply<\/code>,\u00a0output<\/code>, and\u00a0destroy<\/code>.<\/li>\n<\/ul>\n\n\n\n

      2. Before you begin<\/h2>\n\n\n\n

      Install and authenticate<\/h3>\n\n\n\n

      You need Terraform and credentials for the cloud you are testing.<\/p>\n\n\n\n

      AWS<\/strong> – Install the AWS CLI and Terraform. – Configure credentials, for example with aws configure<\/code>, an AWS profile, or an IAM role. – The identity needs permission to create and delete EC2 instances and security groups. Depending on the lab, it may also need permissions for VPC-related resources. – Choose a region where your account can create the requested instance type.<\/p>\n\n\n\n

      Azure<\/strong> – Install Azure CLI and Terraform. – Sign in with az login<\/code>. – Select the correct subscription: az account set --subscription \"<SUBSCRIPTION_ID_OR_NAME>\"<\/code>. – Your identity needs permission to create and delete resource groups and networking\/compute resources. Subscription policy and regional quotas can affect VM creation.<\/p>\n\n\n\n

      Check tools:<\/p>\n\n\n

      terraform version\naws sts get<\/span>-caller-identity\naz account show --output table\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      A safe lab workflow<\/h3>\n\n\n\n
      For each lab: 1. Create a new, empty directory. 2. Save the complete example as main.tf<\/code>. 3. Run terraform init<\/code>. 4. Run terraform fmt<\/code>. 5. Run terraform validate<\/code>. 6. Review terraform plan<\/code>. 7. Run terraform apply<\/code> and confirm when ready. 8. Inspect the outputs and cloud console. 9. Run terraform destroy<\/code> when finished.<\/p>\n\n\n\n
      \n
      Cost and security warning:<\/strong> Applying cloud labs can incur charges. Destroy resources after testing. Some examples create public IP addresses or permit SSH only from an address you specify. Do not use 0.0.0.0\/0<\/code> for SSH in production. Never commit cloud credentials or private keys to source control.<\/p>\n<\/blockquote>\n\n\n\n
      How the examples are organized<\/h3>\n\n\n\n
      Each cloud example below is intended to be a complete main.tf<\/code> for that scenario. AWS examples create EC2 infrastructure. Azure VM examples include a resource group, virtual network, subnet, network interface, public IP, network security group, and Linux VM. For simplicity, examples use common Ubuntu image identifiers; image availability and cloud policies can vary by region and subscription.<\/p>\n\n\n\n
      \n\n\n\n
      3. Conditional logic: the basic idea<\/h2>\n\n\n\n
      Terraform configuration is declarative. You describe the desired infrastructure, and Terraform determines the actions needed to reach that state. Terraform does not use ordinary procedural if { ... } else { ... }<\/code> statements around resource blocks. Instead, conditions are expressed through values, collection filtering, meta-arguments, and validation constructs.<\/p>\n\n\n\n
      The conditional expression<\/h3>\n\n\n
      condition ? value_if_true : value_if_false\n<\/code><\/span><\/pre>\n\n\n
      Example:<\/p>\n\n\n
      variable \"environment\"<\/span> {\n  type    = string\n  default<\/span> = \"dev\"<\/span>\n}\n\nlocals {\n  instance_type = var<\/span>.environment == \"prod\"<\/span> ? \"t3.medium\"<\/span> : \"t3.micro\"<\/span>\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      If environment<\/code> is \"prod\"<\/code>, instance_type<\/code> is \"t3.medium\"<\/code>. Otherwise, it is \"t3.micro\"<\/code>.<\/p>\n\n\n\n
      Logical and comparison operators<\/h3>\n\n\n\n
      \n\n\n\n
      Operator Meaning Example<\/p>\n\n\n\n
      \n\n\n\n
      ==<\/code> Equal var.environment == \"prod\"<\/code><\/p>\n\n\n\n
      !=<\/code> Not equal var.environment != \"dev\"<\/code><\/p>\n\n\n\n
      ><\/code> \/ <<\/code> Greater \/ less than var.instance_count > 1<\/code><\/p>\n\n\n\n
      >=<\/code> \/ <=<\/code> Greater\/less than or var.port >= 1024<\/code> equal<\/p>\n\n\n\n
      &&<\/code> AND: both sides must be var.enabled && var.environment == \"prod\"<\/code> true<\/p>\n\n\n\n
      ||<\/code> OR: either side may be var.environment == \"dev\" || var.environment == \"test\"<\/code> true<\/p>\n\n\n\n
      !<\/code> NOT: reverse a Boolean !var.disabled<\/code><\/h2>\n\n\n\n
      Use parentheses for readability when combining multiple conditions.<\/p>\n\n\n\n
      \n\n\n\n
      4. Lab 1 — Ternary conditional expression<\/h2>\n\n\n\n
      Goal<\/h3>\n\n\n\n
      Choose a smaller compute size for non-production and a larger size for production. This lab demonstrates a condition selecting a value; it does not conditionally omit the resource.<\/p>\n\n\n\n
      4A. AWS — choose EC2 instance type<\/h3>\n\n\n\n
      Create main.tf<\/code>:<\/p>\n\n\n
      terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    aws = {\n      source  = \"hashicorp\/aws\"<\/span>\n      version = \"~> 5.0\"<\/span>\n    }\n  }\n}\n\nprovider \"aws\"<\/span> {\n  region = var<\/span>.aws_region\n}\n\nvariable \"aws_region\"<\/span> {\n  type    = string\n  default<\/span> = \"ap-northeast-1\"<\/span>\n}\n\nvariable \"environment\"<\/span> {\n  type        = string\n  description = \"Set to dev or prod.\"<\/span>\n  default<\/span>     = \"dev\"<\/span>\n\n  validation {\n    condition     = contains([\"dev\"<\/span>, \"prod\"<\/span>], var<\/span>.environment)\n    error_message = \"environment must be dev or prod.\"<\/span>\n  }\n}\n\nvariable \"ami_id\"<\/span> {\n  type        = string\n  description = \"A valid Ubuntu AMI ID in the selected AWS region.\"<\/span>\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type        = string\n  description = \"Your public IPv4 address in CIDR notation, for example 203.0.113.10\/32.\"<\/span>\n}\n\nlocals {\n  instance_type = var<\/span>.environment == \"prod\"<\/span> ? \"t3.small\"<\/span> : \"t3.micro\"<\/span>\n}\n\nresource \"aws_security_group\"<\/span> \"web\"<\/span> {\n  name_prefix = \"conditional-lab-\"<\/span>\n  description = \"SSH for a temporary Terraform conditional-expression lab\"<\/span>\n\n  ingress {\n    description = \"SSH from the student's address only\"<\/span>\n    from_port   = 22<\/span>\n    to_port     = 22<\/span>\n    protocol    = \"tcp\"<\/span>\n    cidr_blocks = [var<\/span>.ssh_cidr]\n  }\n\n  egress {\n    from_port   = 0<\/span>\n    to_port     = 0<\/span>\n    protocol    = \"-1\"<\/span>\n    cidr_blocks = [\"0.0.0.0\/0\"<\/span>]\n  }\n\n  tags = {\n    Name = \"conditional-lab-sg\"<\/span>\n  }\n}\n\nresource \"aws_instance\"<\/span> \"example\"<\/span> {\n  ami                    = var<\/span>.ami_id\n  instance_type          = local.instance_type\n  vpc_security_group_ids = [aws_security_group.web.id]\n\n  tags = {\n    Name        = \"conditional-${var.environment}\"<\/span>\n    Environment = var<\/span>.environment\n  }\n}\n\noutput \"selected_instance_type\"<\/span> {\n  value = local.instance_type\n}\n\noutput \"instance_id\"<\/span> {\n  value = aws_instance.example.id\n}\n\noutput \"public_ip\"<\/span> {\n  value = aws_instance.example.public_ip\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Run it (replace the placeholders with values valid for your account and region):<\/p>\n\n\n
      terraform init\nterraform fmt\nterraform validate\nterraform plan \\\n  -var<\/span>=\"ami_id=ami-REPLACE_WITH_VALID_UBUNTU_AMI\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\nterraform apply \\\n  -var<\/span>=\"ami_id=ami-REPLACE_WITH_VALID_UBUNTU_AMI\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\nterraform output\nterraform destroy \\\n  -var<\/span>=\"ami_id=ami-REPLACE_WITH_VALID_UBUNTU_AMI\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Observe:<\/strong> With the default environment = \"dev\"<\/code>, output selected_instance_type<\/code> is t3.micro<\/code>. To test production, add -var=\"environment=prod\"<\/code> to both plan<\/code> and apply<\/code>.<\/p>\n\n\n\n
      AMI tip:<\/strong> AMI IDs are regional. Find a current Ubuntu AMI in the selected region using the AWS console or Canonical’s published images. Do not copy an AMI ID from a different region.<\/p>\n\n\n\n
      4B. Azure — choose Linux VM size<\/h3>\n\n\n\n
      Create main.tf<\/code>:<\/p>\n\n\n
      terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"<\/span>\n      version = \"~> 4.0\"<\/span>\n    }\n  }\n}\n\nprovider \"azurerm\"<\/span> {\n  features {}\n  resource_provider_registrations = \"none\"<\/span>\n}\n\nvariable \"location\"<\/span> {\n  type    = string\n  default<\/span> = \"Japan East\"<\/span>\n}\n\nvariable \"environment\"<\/span> {\n  type    = string\n  default<\/span> = \"dev\"<\/span>\n\n  validation {\n    condition     = contains([\"dev\"<\/span>, \"prod\"<\/span>], var<\/span>.environment)\n    error_message = \"environment must be dev or prod.\"<\/span>\n  }\n}\n\nvariable \"admin_username\"<\/span> {\n  type    = string\n  default<\/span> = \"azureuser\"<\/span>\n}\n\nvariable \"ssh_public_key\"<\/span> {\n  type        = string\n  description = \"Contents of your SSH public key, not the private key.\"<\/span>\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type        = string\n  description = \"Your public IPv4 address in CIDR notation, for example 203.0.113.10\/32.\"<\/span>\n}\n\nlocals {\n  vm_size = var<\/span>.environment == \"prod\"<\/span> ? \"Standard_B2s\"<\/span> : \"Standard_B1s\"<\/span>\n  prefix  = \"tfcond-${var.environment}\"<\/span>\n}\n\nresource \"azurerm_resource_group\"<\/span> \"lab\"<\/span> {\n  name     = \"${local.prefix}-rg\"<\/span>\n  location = var<\/span>.location\n}\n\nresource \"azurerm_virtual_network\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-vnet\"<\/span>\n  address_space       = [\"10.20.0.0\/16\"<\/span>]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n}\n\nresource \"azurerm_subnet\"<\/span> \"lab\"<\/span> {\n  name                 = \"default\"<\/span>\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n  address_prefixes     = [\"10.20.1.0\/24\"<\/span>]\n}\n\nresource \"azurerm_public_ip\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-pip\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  allocation_method   = \"Static\"<\/span>\n  sku                 = \"Standard\"<\/span>\n}\n\nresource \"azurerm_network_security_group\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-nsg\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  security_rule {\n    name                       = \"AllowSSHFromMyIP\"<\/span>\n    priority                   = 100<\/span>\n    direction                  = \"Inbound\"<\/span>\n    access                     = \"Allow\"<\/span>\n    protocol                   = \"Tcp\"<\/span>\n    source_port_range          = \"*\"<\/span>\n    destination_port_range     = \"22\"<\/span>\n    source_address_prefix      = var<\/span>.ssh_cidr\n    destination_address_prefix = \"*\"<\/span>\n  }\n}\n\nresource \"azurerm_network_interface\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-nic\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  ip_configuration {\n    name                          = \"internal\"<\/span>\n    subnet_id                     = azurerm_subnet.lab.id\n    private_ip_address_allocation = \"Dynamic\"<\/span>\n    public_ip_address_id          = azurerm_public_ip.lab.id\n  }\n}\n\nresource \"azurerm_network_interface_security_group_association\"<\/span> \"lab\"<\/span> {\n  network_interface_id      = azurerm_network_interface.lab.id\n  network_security_group_id = azurerm_network_security_group.lab.id\n}\n\nresource \"azurerm_linux_virtual_machine\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-vm\"<\/span>\n  resource_group_name = azurerm_resource_group.lab.name\n  location            = azurerm_resource_group.lab.location\n  size                = local.vm_size\n  admin_username      = var<\/span>.admin_username\n  network_interface_ids = [\n    azurerm_network_interface.lab.id\n  ]\n\n  disable_password_authentication = true<\/span>\n\n  admin_ssh_key {\n    username   = var<\/span>.admin_username\n    public_key = var<\/span>.ssh_public_key\n  }\n\n  os_disk {\n    caching              = \"ReadWrite\"<\/span>\n    storage_account_type = \"Standard_LRS\"<\/span>\n  }\n\n  source_image_reference {\n    publisher = \"Canonical\"<\/span>\n    offer     = \"0001-com-ubuntu-server-jammy\"<\/span>\n    sku       = \"22_04-lts-gen2\"<\/span>\n    version   = \"latest\"<\/span>\n  }\n\n  tags = {\n    Environment = var<\/span>.environment\n  }\n}\n\noutput \"selected_vm_size\"<\/span> {\n  value = local.vm_size\n}\n\noutput \"public_ip\"<\/span> {\n  value = azurerm_public_ip.lab.ip_address\n}\n\noutput \"ssh_command\"<\/span> {\n  value = \"ssh ${var.admin_username}@${azurerm_public_ip.lab.ip_address}\"<\/span>\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Run:<\/p>\n\n\n
      terraform init\nterraform fmt\nterraform validate\nterraform plan \\\n  -var<\/span>=\"ssh_public_key=$(cat ~\/.ssh\/id_ed25519.pub)\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\nterraform apply \\\n  -var<\/span>=\"ssh_public_key=$(cat ~\/.ssh\/id_ed25519.pub)\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\nterraform output\nterraform destroy \\\n  -var<\/span>=\"ssh_public_key=$(cat ~\/.ssh\/id_ed25519.pub)\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      If you use a different public key file, substitute its path. If ~\/.ssh\/id_ed25519.pub<\/code> does not exist, create a key pair with ssh-keygen -t ed25519<\/code>. Check that the selected VM size is available and permitted in the subscription and region.<\/p>\n\n\n\n
      Observe:<\/strong> The default selects Standard_B1s<\/code>; -var=\"environment=prod\"<\/code> selects Standard_B2s<\/code>. These are example sizes, not a guarantee of regional availability or quota.<\/p>\n\n\n\n
      \n\n\n\n
      5. Lab 2 — Logical operators and compound conditions<\/h2>\n\n\n\n
      Goal<\/h3>\n\n\n\n
      Use more than one input to decide a value. This is useful when production settings should be selected only when the environment is production and<\/strong> a feature is enabled.<\/p>\n\n\n\n
      5A. AWS — conditionally choose instance type<\/h3>\n\n\n\n
      Save as main.tf<\/code>:<\/p>\n\n\n
      terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    aws = {\n      source  = \"hashicorp\/aws\"<\/span>\n      version = \"~> 5.0\"<\/span>\n    }\n  }\n}\n\nprovider \"aws\"<\/span> {\n  region = var<\/span>.aws_region\n}\n\nvariable \"aws_region\"<\/span> {\n  type    = string\n  default<\/span> = \"ap-northeast-1\"<\/span>\n}\n\nvariable \"environment\"<\/span> {\n  type    = string\n  default<\/span> = \"prod\"<\/span>\n}\n\nvariable \"high_performance_enabled\"<\/span> {\n  type    = bool\n  default<\/span> = true<\/span>\n}\n\nvariable \"ami_id\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nlocals {\n  use_large_instance = var<\/span>.environment == \"prod\"<\/span> && var<\/span>.high_performance_enabled\n  instance_type      = local.use_large_instance ? \"t3.small\"<\/span> : \"t3.micro\"<\/span>\n  environment_class  = var<\/span>.environment == \"dev\"<\/span> || var<\/span>.environment == \"test\"<\/span> ? \"nonproduction\"<\/span> : \"production-like\"<\/span>\n  feature_disabled   = !var<\/span>.high_performance_enabled\n}\n\nresource \"aws_security_group\"<\/span> \"lab\"<\/span> {\n  name_prefix = \"logic-lab-\"<\/span>\n\n  ingress {\n    from_port   = 22<\/span>\n    to_port     = 22<\/span>\n    protocol    = \"tcp\"<\/span>\n    cidr_blocks = [var<\/span>.ssh_cidr]\n  }\n\n  egress {\n    from_port   = 0<\/span>\n    to_port     = 0<\/span>\n    protocol    = \"-1\"<\/span>\n    cidr_blocks = [\"0.0.0.0\/0\"<\/span>]\n  }\n}\n\nresource \"aws_instance\"<\/span> \"lab\"<\/span> {\n  ami                    = var<\/span>.ami_id\n  instance_type          = local.instance_type\n  vpc_security_group_ids = [aws_security_group.lab.id]\n\n  tags = {\n    Name               = \"logic-lab\"<\/span>\n    EnvironmentClass   = local.environment_class\n    HighPerformanceOff = tostring(local.feature_disabled)\n  }\n}\n\noutput \"use_large_instance\"<\/span> {\n  value = local.use_large_instance\n}\n\noutput \"instance_type\"<\/span> {\n  value = local.instance_type\n}\n\noutput \"environment_class\"<\/span> {\n  value = local.environment_class\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Run with the same terraform init<\/code>, validate<\/code>, plan<\/code>, apply<\/code>, output<\/code>, and destroy<\/code> workflow used in Lab 1. Supply ami_id<\/code> and ssh_cidr<\/code> as variables. Try:<\/p>\n\n\n
      terraform plan \\\n  -var<\/span>=\"ami_id=ami-REPLACE_WITH_VALID_AMI\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span> \\\n  -var<\/span>=\"environment=prod\"<\/span> \\\n  -var<\/span>=\"high_performance_enabled=true\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Then change high_performance_enabled=false<\/code> and inspect the plan. The selected instance type changes from t3.small<\/code> to t3.micro<\/code>.<\/p>\n\n\n\n
      5B. Azure — logical operators choose VM size<\/h3>\n\n\n\n
      Save as main.tf<\/code>:<\/p>\n\n\n
      terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"<\/span>\n      version = \"~> 4.0\"<\/span>\n    }\n  }\n}\n\nprovider \"azurerm\"<\/span> {\n  features {}\n  resource_provider_registrations = \"none\"<\/span>\n}\n\nvariable \"location\"<\/span> {\n  type    = string\n  default<\/span> = \"Japan East\"<\/span>\n}\n\nvariable \"environment\"<\/span> {\n  type    = string\n  default<\/span> = \"prod\"<\/span>\n}\n\nvariable \"high_performance_enabled\"<\/span> {\n  type    = bool\n  default<\/span> = true<\/span>\n}\n\nvariable \"admin_username\"<\/span> {\n  type    = string\n  default<\/span> = \"azureuser\"<\/span>\n}\n\nvariable \"ssh_public_key\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nlocals {\n  use_large_vm       = var<\/span>.environment == \"prod\"<\/span> && var<\/span>.high_performance_enabled\n  vm_size            = local.use_large_vm ? \"Standard_B2s\"<\/span> : \"Standard_B1s\"<\/span>\n  environment_class  = var<\/span>.environment == \"dev\"<\/span> || var<\/span>.environment == \"test\"<\/span> ? \"nonproduction\"<\/span> : \"production-like\"<\/span>\n  prefix             = \"tflogic\"<\/span>\n}\n\nresource \"azurerm_resource_group\"<\/span> \"lab\"<\/span> {\n  name     = \"${local.prefix}-rg\"<\/span>\n  location = var<\/span>.location\n}\n\nresource \"azurerm_virtual_network\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-vnet\"<\/span>\n  address_space       = [\"10.30.0.0\/16\"<\/span>]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n}\n\nresource \"azurerm_subnet\"<\/span> \"lab\"<\/span> {\n  name                 = \"default\"<\/span>\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n  address_prefixes     = [\"10.30.1.0\/24\"<\/span>]\n}\n\nresource \"azurerm_public_ip\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-pip\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  allocation_method   = \"Static\"<\/span>\n  sku                 = \"Standard\"<\/span>\n}\n\nresource \"azurerm_network_security_group\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-nsg\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  security_rule {\n    name                       = \"AllowSSHFromMyIP\"<\/span>\n    priority                   = 100<\/span>\n    direction                  = \"Inbound\"<\/span>\n    access                     = \"Allow\"<\/span>\n    protocol                   = \"Tcp\"<\/span>\n    source_port_range          = \"*\"<\/span>\n    destination_port_range     = \"22\"<\/span>\n    source_address_prefix      = var<\/span>.ssh_cidr\n    destination_address_prefix = \"*\"<\/span>\n  }\n}\n\nresource \"azurerm_network_interface\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-nic\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  ip_configuration {\n    name                          = \"internal\"<\/span>\n    subnet_id                     = azurerm_subnet.lab.id\n    private_ip_address_allocation = \"Dynamic\"<\/span>\n    public_ip_address_id          = azurerm_public_ip.lab.id\n  }\n}\n\nresource \"azurerm_network_interface_security_group_association\"<\/span> \"lab\"<\/span> {\n  network_interface_id      = azurerm_network_interface.lab.id\n  network_security_group_id = azurerm_network_security_group.lab.id\n}\n\nresource \"azurerm_linux_virtual_machine\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-vm\"<\/span>\n  resource_group_name = azurerm_resource_group.lab.name\n  location            = azurerm_resource_group.lab.location\n  size                = local.vm_size\n  admin_username      = var<\/span>.admin_username\n  network_interface_ids = [\n    azurerm_network_interface.lab.id\n  ]\n  disable_password_authentication = true<\/span>\n\n  admin_ssh_key {\n    username   = var<\/span>.admin_username\n    public_key = var<\/span>.ssh_public_key\n  }\n\n  os_disk {\n    caching              = \"ReadWrite\"<\/span>\n    storage_account_type = \"Standard_LRS\"<\/span>\n  }\n\n  source_image_reference {\n    publisher = \"Canonical\"<\/span>\n    offer     = \"0001-com-ubuntu-server-jammy\"<\/span>\n    sku       = \"22_04-lts-gen2\"<\/span>\n    version   = \"latest\"<\/span>\n  }\n\n  tags = {\n    EnvironmentClass = local.environment_class\n  }\n}\n\noutput \"use_large_vm\"<\/span> {\n  value = local.use_large_vm\n}\n\noutput \"vm_size\"<\/span> {\n  value = local.vm_size\n}\n\noutput \"environment_class\"<\/span> {\n  value = local.environment_class\n}\n\noutput \"public_ip\"<\/span> {\n  value = azurerm_public_ip.lab.ip_address\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Run the standard workflow and provide:<\/p>\n\n\n
      -var<\/span>=\"ssh_public_key=$(cat ~\/.ssh\/id_ed25519.pub)\"<\/span> \\\n-var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Test these combinations: – environment=prod<\/code>, high_performance_enabled=true<\/code> \u2192 larger VM. – environment=prod<\/code>, high_performance_enabled=false<\/code> \u2192 smaller VM. – environment=dev<\/code>, high_performance_enabled=true<\/code> \u2192 smaller VM.<\/p>\n\n\n\n
      \n\n\n\n
      6. Lab 3 — Conditional resource creation with count<\/h2>\n\n\n\n
      Concept<\/h3>\n\n\n\n
      Use count = condition ? 1 : 0<\/code> when a resource should exist only when a condition is true. When the condition is false, Terraform plans zero instances of that resource.<\/p>\n\n\n\n
      Important:<\/strong> Resources using count<\/code> are addressed with numeric indexes, such as aws_instance.optional[0]<\/code>. Changing count<\/code> from one to zero destroys that instance when you apply the change.<\/p>\n\n\n\n
      6A. AWS — optional EC2 instance<\/h3>\n\n\n
      terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    aws = {\n      source  = \"hashicorp\/aws\"<\/span>\n      version = \"~> 5.0\"<\/span>\n    }\n  }\n}\n\nprovider \"aws\"<\/span> {\n  region = var<\/span>.aws_region\n}\n\nvariable \"aws_region\"<\/span> {\n  type    = string\n  default<\/span> = \"ap-northeast-1\"<\/span>\n}\n\nvariable \"create_instance\"<\/span> {\n  type    = bool\n  default<\/span> = true<\/span>\n}\n\nvariable \"ami_id\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nresource \"aws_security_group\"<\/span> \"lab\"<\/span> {\n  name_prefix = \"count-lab-\"<\/span>\n\n  ingress {\n    from_port   = 22<\/span>\n    to_port     = 22<\/span>\n    protocol    = \"tcp\"<\/span>\n    cidr_blocks = [var<\/span>.ssh_cidr]\n  }\n\n  egress {\n    from_port   = 0<\/span>\n    to_port     = 0<\/span>\n    protocol    = \"-1\"<\/span>\n    cidr_blocks = [\"0.0.0.0\/0\"<\/span>]\n  }\n}\n\nresource \"aws_instance\"<\/span> \"optional\"<\/span> {\n  count                  = var<\/span>.create_instance ? 1<\/span> : 0<\/span>\n  ami                    = var<\/span>.ami_id\n  instance_type          = \"t3.micro\"<\/span>\n  vpc_security_group_ids = [aws_security_group.lab.id]\n\n  tags = {\n    Name = \"optional-ec2\"<\/span>\n  }\n}\n\noutput \"instance_ids\"<\/span> {\n  value = aws_instance.optional[*].id\n}\n\noutput \"instance_count\"<\/span> {\n  value = length(aws_instance.optional)\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Run:<\/p>\n\n\n
      terraform init\nterraform validate\nterraform plan -var<\/span>=\"ami_id=ami-REPLACE_WITH_VALID_AMI\"<\/span> -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\nterraform apply -var<\/span>=\"ami_id=ami-REPLACE_WITH_VALID_AMI\"<\/span> -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\nterraform output\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      To turn off the instance:<\/p>\n\n\n
      terraform plan -var<\/span>=\"create_instance=false\"<\/span> -var<\/span>=\"ami_id=ami-REPLACE_WITH_VALID_AMI\"<\/span> -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      If the state currently contains the instance, applying this plan destroys it. Finish with terraform destroy<\/code>, using the same required variable values.<\/p>\n\n\n\n
      6B. Azure — optional Linux VM<\/h3>\n\n\n\n
      This example conditionally creates the VM. The network foundation remains present while create_vm = false<\/code>, which makes the effect easy to observe.<\/p>\n\n\n
      terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"<\/span>\n      version = \"~> 4.0\"<\/span>\n    }\n  }\n}\n\nprovider \"azurerm\"<\/span> {\n  features {}\n  resource_provider_registrations = \"none\"<\/span>\n}\n\nvariable \"location\"<\/span> {\n  type    = string\n  default<\/span> = \"Japan East\"<\/span>\n}\n\nvariable \"create_vm\"<\/span> {\n  type    = bool\n  default<\/span> = true<\/span>\n}\n\nvariable \"admin_username\"<\/span> {\n  type    = string\n  default<\/span> = \"azureuser\"<\/span>\n}\n\nvariable \"ssh_public_key\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nlocals {\n  prefix = \"tfcount\"<\/span>\n}\n\nresource \"azurerm_resource_group\"<\/span> \"lab\"<\/span> {\n  name     = \"${local.prefix}-rg\"<\/span>\n  location = var<\/span>.location\n}\n\nresource \"azurerm_virtual_network\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-vnet\"<\/span>\n  address_space       = [\"10.40.0.0\/16\"<\/span>]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n}\n\nresource \"azurerm_subnet\"<\/span> \"lab\"<\/span> {\n  name                 = \"default\"<\/span>\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n  address_prefixes     = [\"10.40.1.0\/24\"<\/span>]\n}\n\nresource \"azurerm_public_ip\"<\/span> \"lab\"<\/span> {\n  count               = var<\/span>.create_vm ? 1<\/span> : 0<\/span>\n  name                = \"${local.prefix}-pip\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  allocation_method   = \"Static\"<\/span>\n  sku                 = \"Standard\"<\/span>\n}\n\nresource \"azurerm_network_security_group\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-nsg\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  security_rule {\n    name                       = \"AllowSSHFromMyIP\"<\/span>\n    priority                   = 100<\/span>\n    direction                  = \"Inbound\"<\/span>\n    access                     = \"Allow\"<\/span>\n    protocol                   = \"Tcp\"<\/span>\n    source_port_range          = \"*\"<\/span>\n    destination_port_range     = \"22\"<\/span>\n    source_address_prefix      = var<\/span>.ssh_cidr\n    destination_address_prefix = \"*\"<\/span>\n  }\n}\n\nresource \"azurerm_network_interface\"<\/span> \"lab\"<\/span> {\n  count               = var<\/span>.create_vm ? 1<\/span> : 0<\/span>\n  name                = \"${local.prefix}-nic\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  ip_configuration {\n    name                          = \"internal\"<\/span>\n    subnet_id                     = azurerm_subnet.lab.id\n    private_ip_address_allocation = \"Dynamic\"<\/span>\n    public_ip_address_id          = azurerm_public_ip.lab[0<\/span>].id\n  }\n}\n\nresource \"azurerm_network_interface_security_group_association\"<\/span> \"lab\"<\/span> {\n  count                     = var<\/span>.create_vm ? 1<\/span> : 0<\/span>\n  network_interface_id      = azurerm_network_interface.lab[0<\/span>].id\n  network_security_group_id = azurerm_network_security_group.lab.id\n}\n\nresource \"azurerm_linux_virtual_machine\"<\/span> \"lab\"<\/span> {\n  count               = var<\/span>.create_vm ? 1<\/span> : 0<\/span>\n  name                = \"${local.prefix}-vm\"<\/span>\n  resource_group_name = azurerm_resource_group.lab.name\n  location            = azurerm_resource_group.lab.location\n  size                = \"Standard_B1s\"<\/span>\n  admin_username      = var<\/span>.admin_username\n  network_interface_ids = [\n    azurerm_network_interface.lab[0<\/span>].id\n  ]\n  disable_password_authentication = true<\/span>\n\n  admin_ssh_key {\n    username   = var<\/span>.admin_username\n    public_key = var<\/span>.ssh_public_key\n  }\n\n  os_disk {\n    caching              = \"ReadWrite\"<\/span>\n    storage_account_type = \"Standard_LRS\"<\/span>\n  }\n\n  source_image_reference {\n    publisher = \"Canonical\"<\/span>\n    offer     = \"0001-com-ubuntu-server-jammy\"<\/span>\n    sku       = \"22_04-lts-gen2\"<\/span>\n    version   = \"latest\"<\/span>\n  }\n}\n\noutput \"vm_count\"<\/span> {\n  value = length(azurerm_linux_virtual_machine.lab)\n}\n\noutput \"public_ip\"<\/span> {\n  value = var<\/span>.create_vm ? azurerm_public_ip.lab[0<\/span>].ip_address : null<\/span>\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Run:<\/p>\n\n\n
      terraform init\nterraform fmt\nterraform validate\nterraform plan \\\n  -var<\/span>=\"ssh_public_key=$(cat ~\/.ssh\/id_ed25519.pub)\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\nterraform apply \\\n  -var<\/span>=\"ssh_public_key=$(cat ~\/.ssh\/id_ed25519.pub)\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\nterraform output\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      To test no VM:<\/p>\n\n\n
      terraform plan \\\n  -var<\/span>=\"create_vm=false\"<\/span> \\\n  -var<\/span>=\"ssh_public_key=$(cat ~\/.ssh\/id_ed25519.pub)\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      The VM, NIC, and public IP are removed if you apply that change. The resource group, VNet, subnet, and NSG remain until destroyed. Destroy the lab when finished.<\/p>\n\n\n\n
      \n\n\n\n
      7. Lab 4 — for_each with conditional filtering<\/h2>\n\n\n\n
      Concept<\/h3>\n\n\n\n
      Use for_each<\/code> when each instance has a stable key. A filtered map can include only items that meet a condition. Unlike count<\/code>, for_each<\/code> instances are addressed by keys rather than numeric positions.<\/p>\n\n\n\n
      7A. AWS — create EC2 instances only for enabled applications<\/h3>\n\n\n
      terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    aws = {\n      source  = \"hashicorp\/aws\"<\/span>\n      version = \"~> 5.0\"<\/span>\n    }\n  }\n}\n\nprovider \"aws\"<\/span> {\n  region = var<\/span>.aws_region\n}\n\nvariable \"aws_region\"<\/span> {\n  type    = string\n  default<\/span> = \"ap-northeast-1\"<\/span>\n}\n\nvariable \"ami_id\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nvariable \"applications\"<\/span> {\n  type = map(object({\n    enabled = bool\n    type    = string\n  }))\n  default<\/span> = {\n    frontend = { enabled = true<\/span>,  type = \"t3.micro\"<\/span> }\n    backend  = { enabled = true<\/span>,  type = \"t3.micro\"<\/span> }\n    sandbox  = { enabled = false<\/span>, type = \"t3.micro\"<\/span> }\n  }\n}\n\nlocals {\n  enabled_applications = {\n    for<\/span> name, app in<\/span> var<\/span>.applications : name<\/span> =><\/span> app\n    if<\/span> app.enabled\n  }\n}\n\nresource \"aws_security_group\"<\/span> \"lab\"<\/span> {\n  name_prefix = \"foreach-lab-\"<\/span>\n\n  ingress {\n    from_port   = 22<\/span>\n    to_port     = 22<\/span>\n    protocol    = \"tcp\"<\/span>\n    cidr_blocks = [var<\/span>.ssh_cidr]\n  }\n\n  egress {\n    from_port   = 0<\/span>\n    to_port     = 0<\/span>\n    protocol    = \"-1\"<\/span>\n    cidr_blocks = [\"0.0.0.0\/0\"<\/span>]\n  }\n}\n\nresource \"aws_instance\"<\/span> \"app\"<\/span> {\n  for_each               = local.enabled_applications\n  ami                    = var<\/span>.ami_id\n  instance_type          = each.value.type\n  vpc_security_group_ids = [aws_security_group.lab.id]\n\n  tags = {\n    Name        = \"app-${each.key}\"<\/span>\n    Application = each.key\n  }\n}\n\noutput \"created_instance_ids\"<\/span> {\n  value = { for<\/span> name, instance in<\/span> aws_instance.app : name<\/span> =><\/span> instance.id }\n}\n\noutput \"created_application_names\"<\/span> {\n  value = keys(aws_instance.app)\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Run using the standard workflow and supply ami_id<\/code> and ssh_cidr<\/code>. The defaults create frontend<\/code> and backend<\/code>, but not sandbox<\/code>.<\/p>\n\n\n\n
      To enable sandbox<\/code>, pass a complete replacement map through a .tfvars<\/code> file or change the default. For example, create terraform.tfvars<\/code>:<\/p>\n\n\n
      applications = {\n  frontend = { enabled = true<\/span>,  type = \"t3.micro\"<\/span> }\n  backend  = { enabled = true<\/span>,  type = \"t3.micro\"<\/span> }\n  sandbox  = { enabled = true<\/span>,  type = \"t3.micro\"<\/span> }\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Then run terraform plan<\/code> and terraform apply<\/code>.<\/p>\n\n\n\n
      7B. Azure — create Linux VMs only for enabled applications<\/h3>\n\n\n
      terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"<\/span>\n      version = \"~> 4.0\"<\/span>\n    }\n  }\n}\n\nprovider \"azurerm\"<\/span> {\n  features {}\n  resource_provider_registrations = \"none\"<\/span>\n}\n\nvariable \"location\"<\/span> {\n  type    = string\n  default<\/span> = \"Japan East\"<\/span>\n}\n\nvariable \"admin_username\"<\/span> {\n  type    = string\n  default<\/span> = \"azureuser\"<\/span>\n}\n\nvariable \"ssh_public_key\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nvariable \"applications\"<\/span> {\n  type = map(object({\n    enabled = bool\n    size    = string\n  }))\n  default<\/span> = {\n    frontend = { enabled = true<\/span>,  size = \"Standard_B1s\"<\/span> }\n    backend  = { enabled = true<\/span>,  size = \"Standard_B1s\"<\/span> }\n    sandbox  = { enabled = false<\/span>, size = \"Standard_B1s\"<\/span> }\n  }\n}\n\nlocals {\n  prefix = \"tfforeach\"<\/span>\n  enabled_applications = {\n    for<\/span> name, app in<\/span> var<\/span>.applications : name<\/span> =><\/span> app\n    if<\/span> app.enabled\n  }\n}\n\nresource \"azurerm_resource_group\"<\/span> \"lab\"<\/span> {\n  name     = \"${local.prefix}-rg\"<\/span>\n  location = var<\/span>.location\n}\n\nresource \"azurerm_virtual_network\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-vnet\"<\/span>\n  address_space       = [\"10.50.0.0\/16\"<\/span>]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n}\n\nresource \"azurerm_subnet\"<\/span> \"lab\"<\/span> {\n  name                 = \"default\"<\/span>\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n  address_prefixes     = [\"10.50.1.0\/24\"<\/span>]\n}\n\nresource \"azurerm_network_security_group\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-nsg\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  security_rule {\n    name                       = \"AllowSSHFromMyIP\"<\/span>\n    priority                   = 100<\/span>\n    direction                  = \"Inbound\"<\/span>\n    access                     = \"Allow\"<\/span>\n    protocol                   = \"Tcp\"<\/span>\n    source_port_range          = \"*\"<\/span>\n    destination_port_range     = \"22\"<\/span>\n    source_address_prefix      = var<\/span>.ssh_cidr\n    destination_address_prefix = \"*\"<\/span>\n  }\n}\n\nresource \"azurerm_public_ip\"<\/span> \"app\"<\/span> {\n  for_each            = local.enabled_applications\n  name                = \"${local.prefix}-${each.key}-pip\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  allocation_method   = \"Static\"<\/span>\n  sku                 = \"Standard\"<\/span>\n}\n\nresource \"azurerm_network_interface\"<\/span> \"app\"<\/span> {\n  for_each            = local.enabled_applications\n  name                = \"${local.prefix}-${each.key}-nic\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  ip_configuration {\n    name                          = \"internal\"<\/span>\n    subnet_id                     = azurerm_subnet.lab.id\n    private_ip_address_allocation = \"Dynamic\"<\/span>\n    public_ip_address_id          = azurerm_public_ip.app[each.key].id\n  }\n}\n\nresource \"azurerm_network_interface_security_group_association\"<\/span> \"app\"<\/span> {\n  for_each                  = local.enabled_applications\n  network_interface_id      = azurerm_network_interface.app[each.key].id\n  network_security_group_id = azurerm_network_security_group.lab.id\n}\n\nresource \"azurerm_linux_virtual_machine\"<\/span> \"app\"<\/span> {\n  for_each            = local.enabled_applications\n  name                = \"${local.prefix}-${each.key}-vm\"<\/span>\n  resource_group_name = azurerm_resource_group.lab.name\n  location            = azurerm_resource_group.lab.location\n  size                = each.value.size\n  admin_username      = var<\/span>.admin_username\n  network_interface_ids = [\n    azurerm_network_interface.app[each.key].id\n  ]\n  disable_password_authentication = true<\/span>\n\n  admin_ssh_key {\n    username   = var<\/span>.admin_username\n    public_key = var<\/span>.ssh_public_key\n  }\n\n  os_disk {\n    caching              = \"ReadWrite\"<\/span>\n    storage_account_type = \"Standard_LRS\"<\/span>\n  }\n\n  source_image_reference {\n    publisher = \"Canonical\"<\/span>\n    offer     = \"0001-com-ubuntu-server-jammy\"<\/span>\n    sku       = \"22_04-lts-gen2\"<\/span>\n    version   = \"latest\"<\/span>\n  }\n\n  tags = {\n    Application = each.key\n  }\n}\n\noutput \"created_vm_names\"<\/span> {\n  value = keys(azurerm_linux_virtual_machine.app)\n}\n\noutput \"public_ips\"<\/span> {\n  value = { for<\/span> name, ip in<\/span> azurerm_public_ip.app : name<\/span> =><\/span> ip.ip_address }\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Run:<\/p>\n\n\n
      terraform init\nterraform fmt\nterraform validate\nterraform plan \\\n  -var<\/span>=\"ssh_public_key=$(cat ~\/.ssh\/id_ed25519.pub)\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\nterraform apply \\\n  -var<\/span>=\"ssh_public_key=$(cat ~\/.ssh\/id_ed25519.pub)\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\nterraform output\nterraform destroy \\\n  -var<\/span>=\"ssh_public_key=$(cat ~\/.ssh\/id_ed25519.pub)\"<\/span> \\\n  -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      The default creates two VMs. Enabling or disabling an application changes only that keyed instance and its related networking resources.<\/p>\n\n\n\n
      \n\n\n\n
      8. Lab 5 — Conditional configuration using locals<\/h2>\n\n\n\n
      Concept<\/h3>\n\n\n\n
      A local<\/code> value can centralize decisions that are reused across resources. This makes configuration easier to read and reduces repeated expressions.<\/p>\n\n\n\n
      8A. AWS — environment-based sizing and tags<\/h3>\n\n\n
      terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    aws = {\n      source  = \"hashicorp\/aws\"<\/span>\n      version = \"~> 5.0\"<\/span>\n    }\n  }\n}\n\nprovider \"aws\"<\/span> {\n  region = var<\/span>.aws_region\n}\n\nvariable \"aws_region\"<\/span> {\n  type    = string\n  default<\/span> = \"ap-northeast-1\"<\/span>\n}\n\nvariable \"environment\"<\/span> {\n  type    = string\n  default<\/span> = \"dev\"<\/span>\n  validation {\n    condition     = contains([\"dev\"<\/span>, \"test\"<\/span>, \"prod\"<\/span>], var<\/span>.environment)\n    error_message = \"Use dev, test, or prod.\"<\/span>\n  }\n}\n\nvariable \"ami_id\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nlocals {\n  settings = {\n    dev  = { type = \"t3.micro\"<\/span>, monitoring = false<\/span> }\n    test = { type = \"t3.micro\"<\/span>, monitoring = false<\/span> }\n    prod = { type = \"t3.small\"<\/span>, monitoring = true<\/span> }\n  }\n\n  selected = local.settings[var<\/span>.environment]\n  name     = \"app-${var.environment}\"<\/span>\n}\n\nresource \"aws_security_group\"<\/span> \"lab\"<\/span> {\n  name_prefix = \"locals-lab-\"<\/span>\n\n  ingress {\n    from_port   = 22<\/span>\n    to_port     = 22<\/span>\n    protocol    = \"tcp\"<\/span>\n    cidr_blocks = [var<\/span>.ssh_cidr]\n  }\n\n  egress {\n    from_port   = 0<\/span>\n    to_port     = 0<\/span>\n    protocol    = \"-1\"<\/span>\n    cidr_blocks = [\"0.0.0.0\/0\"<\/span>]\n  }\n}\n\nresource \"aws_instance\"<\/span> \"lab\"<\/span> {\n  ami                    = var<\/span>.ami_id\n  instance_type          = local.selected.type\n  monitoring             = local.selected.monitoring\n  vpc_security_group_ids = [aws_security_group.lab.id]\n\n  tags = {\n    Name        = local.name\n    Environment = var<\/span>.environment\n  }\n}\n\noutput \"selected_settings\"<\/span> {\n  value = local.selected\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Run with environment=dev<\/code>, then environment=prod<\/code>. Observe the instance type and monitoring setting in terraform plan<\/code>.<\/p>\n\n\n\n
      8B. Azure — environment-based VM size and tags<\/h3>\n\n\n
      terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"<\/span>\n      version = \"~> 4.0\"<\/span>\n    }\n  }\n}\n\nprovider \"azurerm\"<\/span> {\n  features {}\n  resource_provider_registrations = \"none\"<\/span>\n}\n\nvariable \"location\"<\/span> {\n  type    = string\n  default<\/span> = \"Japan East\"<\/span>\n}\n\nvariable \"environment\"<\/span> {\n  type    = string\n  default<\/span> = \"dev\"<\/span>\n  validation {\n    condition     = contains([\"dev\"<\/span>, \"test\"<\/span>, \"prod\"<\/span>], var<\/span>.environment)\n    error_message = \"Use dev, test, or prod.\"<\/span>\n  }\n}\n\nvariable \"admin_username\"<\/span> {\n  type    = string\n  default<\/span> = \"azureuser\"<\/span>\n}\n\nvariable \"ssh_public_key\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nlocals {\n  settings = {\n    dev  = { size = \"Standard_B1s\"<\/span>, monitoring = \"basic\"<\/span> }\n    test = { size = \"Standard_B1s\"<\/span>, monitoring = \"basic\"<\/span> }\n    prod = { size = \"Standard_B2s\"<\/span>, monitoring = \"enhanced\"<\/span> }\n  }\n  selected = local.settings[var<\/span>.environment]\n  prefix   = \"tflocals-${var.environment}\"<\/span>\n}\n\nresource \"azurerm_resource_group\"<\/span> \"lab\"<\/span> {\n  name     = \"${local.prefix}-rg\"<\/span>\n  location = var<\/span>.location\n  tags = {\n    Environment = var<\/span>.environment\n    Monitoring  = local.selected.monitoring\n  }\n}\n\nresource \"azurerm_virtual_network\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-vnet\"<\/span>\n  address_space       = [\"10.60.0.0\/16\"<\/span>]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n}\n\nresource \"azurerm_subnet\"<\/span> \"lab\"<\/span> {\n  name                 = \"default\"<\/span>\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n  address_prefixes     = [\"10.60.1.0\/24\"<\/span>]\n}\n\nresource \"azurerm_public_ip\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-pip\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  allocation_method   = \"Static\"<\/span>\n  sku                 = \"Standard\"<\/span>\n}\n\nresource \"azurerm_network_security_group\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-nsg\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  security_rule {\n    name                       = \"AllowSSHFromMyIP\"<\/span>\n    priority                   = 100<\/span>\n    direction                  = \"Inbound\"<\/span>\n    access                     = \"Allow\"<\/span>\n    protocol                   = \"Tcp\"<\/span>\n    source_port_range          = \"*\"<\/span>\n    destination_port_range     = \"22\"<\/span>\n    source_address_prefix      = var<\/span>.ssh_cidr\n    destination_address_prefix = \"*\"<\/span>\n  }\n}\n\nresource \"azurerm_network_interface\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-nic\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  ip_configuration {\n    name                          = \"internal\"<\/span>\n    subnet_id                     = azurerm_subnet.lab.id\n    private_ip_address_allocation = \"Dynamic\"<\/span>\n    public_ip_address_id          = azurerm_public_ip.lab.id\n  }\n}\n\nresource \"azurerm_network_interface_security_group_association\"<\/span> \"lab\"<\/span> {\n  network_interface_id      = azurerm_network_interface.lab.id\n  network_security_group_id = azurerm_network_security_group.lab.id\n}\n\nresource \"azurerm_linux_virtual_machine\"<\/span> \"lab\"<\/span> {\n  name                = \"${local.prefix}-vm\"<\/span>\n  resource_group_name = azurerm_resource_group.lab.name\n  location            = azurerm_resource_group.lab.location\n  size                = local.selected.size\n  admin_username      = var<\/span>.admin_username\n  network_interface_ids = [azurerm_network_interface.lab.id]\n  disable_password_authentication = true<\/span>\n\n  admin_ssh_key {\n    username   = var<\/span>.admin_username\n    public_key = var<\/span>.ssh_public_key\n  }\n\n  os_disk {\n    caching              = \"ReadWrite\"<\/span>\n    storage_account_type = \"Standard_LRS\"<\/span>\n  }\n\n  source_image_reference {\n    publisher = \"Canonical\"<\/span>\n    offer     = \"0001-com-ubuntu-server-jammy\"<\/span>\n    sku       = \"22_04-lts-gen2\"<\/span>\n    version   = \"latest\"<\/span>\n  }\n\n  tags = {\n    Environment = var<\/span>.environment\n    Monitoring  = local.selected.monitoring\n  }\n}\n\noutput \"selected_settings\"<\/span> {\n  value = local.selected\n}\n\noutput \"public_ip\"<\/span> {\n  value = azurerm_public_ip.lab.ip_address\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Run using the Azure workflow from Lab 1, with the SSH public key and CIDR variables. Compare the plan for environment=dev<\/code> and environment=prod<\/code>.<\/p>\n\n\n\n
      \n\n\n\n
      9. Lab 6 — Dynamic blocks and optional nested rules<\/h2>\n\n\n\n
      Concept<\/h3>\n\n\n\n
      A dynamic<\/code> block generates nested blocks inside a resource. It is useful for a variable number of ingress rules or similar nested provider configuration. It does not create multiple top-level resources.<\/p>\n\n\n\n
      9A. AWS — dynamic ingress rules<\/h3>\n\n\n
      terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    aws = {\n      source  = \"hashicorp\/aws\"<\/span>\n      version = \"~> 5.0\"<\/span>\n    }\n  }\n}\n\nprovider \"aws\"<\/span> {\n  region = var<\/span>.aws_region\n}\n\nvariable \"aws_region\"<\/span> {\n  type    = string\n  default<\/span> = \"ap-northeast-1\"<\/span>\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nvariable \"enable_http\"<\/span> {\n  type    = bool\n  default<\/span> = true<\/span>\n}\n\nlocals {\n  base_rules = [\n    { name = \"ssh\"<\/span>,  port = 22<\/span>,  cidr = var<\/span>.ssh_cidr },\n  ]\n  http_rules = var<\/span>.enable_http ? [\n    { name = \"http\"<\/span>, port = 80<\/span>, cidr = \"10.0.0.0\/8\"<\/span> }\n  ] : []\n  ingress_rules = concat(local.base_rules, local.http_rules)\n}\n\nresource \"aws_security_group\"<\/span> \"lab\"<\/span> {\n  name_prefix = \"dynamic-lab-\"<\/span>\n  description = \"Dynamic ingress rule demonstration\"<\/span>\n\n  dynamic \"ingress\"<\/span> {\n    for_each = local.ingress_rules\n    iterator = rule\n    content {\n      description = rule.value.name\n      from_port   = rule.value.port\n      to_port     = rule.value.port\n      protocol    = \"tcp\"<\/span>\n      cidr_blocks = [rule.value.cidr]\n    }\n  }\n\n  egress {\n    from_port   = 0<\/span>\n    to_port     = 0<\/span>\n    protocol    = \"-1\"<\/span>\n    cidr_blocks = [\"0.0.0.0\/0\"<\/span>]\n  }\n\n  tags = {\n    Name = \"dynamic-lab-sg\"<\/span>\n  }\n}\n\noutput \"configured_ingress_rules\"<\/span> {\n  value = local.ingress_rules\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Run terraform init<\/code>, terraform validate<\/code>, and terraform plan<\/code>. Set -var=\"enable_http=false\"<\/code> to see the HTTP rule disappear from the plan. This lab creates only a security group, so it does not need an EC2 instance.<\/p>\n\n\n\n
      9B. Azure — optional SSH and HTTP security rules<\/h3>\n\n\n\n
      Azure NSG rules are separate resources, so use for_each<\/code> rather than a dynamic<\/code> nested block.<\/p>\n\n\n
      terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"<\/span>\n      version = \"~> 4.0\"<\/span>\n    }\n  }\n}\n\nprovider \"azurerm\"<\/span> {\n  features {}\n  resource_provider_registrations = \"none\"<\/span>\n}\n\nvariable \"location\"<\/span> {\n  type    = string\n  default<\/span> = \"Japan East\"<\/span>\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nvariable \"enable_http\"<\/span> {\n  type    = bool\n  default<\/span> = true<\/span>\n}\n\nlocals {\n  rules = merge(\n    {\n      ssh = {\n        priority = 100<\/span>\n        port     = \"22\"<\/span>\n        source   = var<\/span>.ssh_cidr\n      }\n    },\n    var<\/span>.enable_http ? {\n      http = {\n        priority = 110<\/span>\n        port     = \"80\"<\/span>\n        source   = \"10.0.0.0\/8\"<\/span>\n      }\n    } : {}\n  )\n}\n\nresource \"azurerm_resource_group\"<\/span> \"lab\"<\/span> {\n  name     = \"tfdynamic-rg\"<\/span>\n  location = var<\/span>.location\n}\n\nresource \"azurerm_network_security_group\"<\/span> \"lab\"<\/span> {\n  name                = \"tfdynamic-nsg\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n}\n\nresource \"azurerm_network_security_rule\"<\/span> \"rule\"<\/span> {\n  for_each                    = local.rules\n  name                        = \"Allow-${each.key}\"<\/span>\n  priority                    = each.value.priority\n  direction                   = \"Inbound\"<\/span>\n  access                      = \"Allow\"<\/span>\n  protocol                    = \"Tcp\"<\/span>\n  source_port_range           = \"*\"<\/span>\n  destination_port_range      = each.value.port\n  source_address_prefix       = each.value.source\n  destination_address_prefix  = \"*\"<\/span>\n  resource_group_name         = azurerm_resource_group.lab.name\n  network_security_group_name = azurerm_network_security_group.lab.name\n}\n\noutput \"created_rule_names\"<\/span> {\n  value = keys(azurerm_network_security_rule.rule)\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Run terraform plan<\/code>, then repeat with -var=\"enable_http=false\"<\/code>. This example intentionally shows the Azure-native pattern: separate NSG rules are managed with for_each<\/code>.<\/p>\n\n\n\n
      \n\n\n\n
      10. Lab 7 — Input variable validation<\/h2>\n\n\n\n
      Concept<\/h3>\n\n\n\n
      Variable validation checks user-provided values and stops planning with a helpful message when the value is invalid. Validation is suitable for allowed environment names, port ranges, naming rules, and other input constraints.<\/p>\n\n\n\n
      7A. AWS — validate environment and port<\/h3>\n\n\n
      terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    aws = {\n      source  = \"hashicorp\/aws\"<\/span>\n      version = \"~> 5.0\"<\/span>\n    }\n  }\n}\n\nprovider \"aws\"<\/span> {\n  region = var<\/span>.aws_region\n}\n\nvariable \"aws_region\"<\/span> {\n  type    = string\n  default<\/span> = \"ap-northeast-1\"<\/span>\n}\n\nvariable \"environment\"<\/span> {\n  type    = string\n  default<\/span> = \"dev\"<\/span>\n\n  validation {\n    condition     = contains([\"dev\"<\/span>, \"test\"<\/span>, \"prod\"<\/span>], var<\/span>.environment)\n    error_message = \"environment must be dev, test, or prod.\"<\/span>\n  }\n}\n\nvariable \"application_port\"<\/span> {\n  type    = number\n  default<\/span> = 8080<\/span>\n\n  validation {\n    condition     = var<\/span>.application_port >= 1<\/span> && var<\/span>.application_port <= 65535<\/span>\n    error_message = \"application_port must be between 1 and 65535.\"<\/span>\n  }\n}\n\nvariable \"ami_id\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nresource \"aws_security_group\"<\/span> \"lab\"<\/span> {\n  name_prefix = \"validation-lab-\"<\/span>\n\n  ingress {\n    from_port   = 22<\/span>\n    to_port     = 22<\/span>\n    protocol    = \"tcp\"<\/span>\n    cidr_blocks = [var<\/span>.ssh_cidr]\n  }\n\n  ingress {\n    from_port   = var<\/span>.application_port\n    to_port     = var<\/span>.application_port\n    protocol    = \"tcp\"<\/span>\n    cidr_blocks = [\"10.0.0.0\/8\"<\/span>]\n  }\n\n  egress {\n    from_port   = 0<\/span>\n    to_port     = 0<\/span>\n    protocol    = \"-1\"<\/span>\n    cidr_blocks = [\"0.0.0.0\/0\"<\/span>]\n  }\n}\n\nresource \"aws_instance\"<\/span> \"lab\"<\/span> {\n  ami                    = var<\/span>.ami_id\n  instance_type          = \"t3.micro\"<\/span>\n  vpc_security_group_ids = [aws_security_group.lab.id]\n  tags = {\n    Name        = \"validation-${var.environment}\"<\/span>\n    Environment = var<\/span>.environment\n  }\n}\n\noutput \"application_port\"<\/span> {\n  value = var<\/span>.application_port\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Test valid input, then invalid input:<\/p>\n\n\n
      terraform init\nterraform validate\nterraform plan -var<\/span>=\"ami_id=ami-REPLACE_WITH_VALID_AMI\"<\/span> -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span> -var<\/span>=\"environment=prod\"<\/span> -var<\/span>=\"application_port=8080\"<\/span>\nterraform plan -var<\/span>=\"ami_id=ami-REPLACE_WITH_VALID_AMI\"<\/span> -var<\/span>=\"ssh_cidr=YOUR_PUBLIC_IP\/32\"<\/span> -var<\/span>=\"application_port=70000\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      The second plan should fail variable validation before infrastructure is created.<\/p>\n\n\n\n
      7B. Azure — validate environment and SSH port concept<\/h3>\n\n\n
      terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"<\/span>\n      version = \"~> 4.0\"<\/span>\n    }\n  }\n}\n\nprovider \"azurerm\"<\/span> {\n  features {}\n  resource_provider_registrations = \"none\"<\/span>\n}\n\nvariable \"location\"<\/span> {\n  type    = string\n  default<\/span> = \"Japan East\"<\/span>\n}\n\nvariable \"environment\"<\/span> {\n  type    = string\n  default<\/span> = \"dev\"<\/span>\n  validation {\n    condition     = contains([\"dev\"<\/span>, \"test\"<\/span>, \"prod\"<\/span>], var<\/span>.environment)\n    error_message = \"environment must be dev, test, or prod.\"<\/span>\n  }\n}\n\nvariable \"ssh_port\"<\/span> {\n  type    = number\n  default<\/span> = 22<\/span>\n  validation {\n    condition     = var<\/span>.ssh_port >= 1<\/span> && var<\/span>.ssh_port <= 65535<\/span>\n    error_message = \"ssh_port must be between 1 and 65535.\"<\/span>\n  }\n}\n\nvariable \"admin_username\"<\/span> {\n  type    = string\n  default<\/span> = \"azureuser\"<\/span>\n}\n\nvariable \"ssh_public_key\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nresource \"azurerm_resource_group\"<\/span> \"lab\"<\/span> {\n  name     = \"tfvalidation-${var.environment}-rg\"<\/span>\n  location = var<\/span>.location\n}\n\nresource \"azurerm_virtual_network\"<\/span> \"lab\"<\/span> {\n  name                = \"tfvalidation-vnet\"<\/span>\n  address_space       = [\"10.70.0.0\/16\"<\/span>]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n}\n\nresource \"azurerm_subnet\"<\/span> \"lab\"<\/span> {\n  name                 = \"default\"<\/span>\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n  address_prefixes     = [\"10.70.1.0\/24\"<\/span>]\n}\n\nresource \"azurerm_public_ip\"<\/span> \"lab\"<\/span> {\n  name                = \"tfvalidation-pip\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  allocation_method   = \"Static\"<\/span>\n  sku                 = \"Standard\"<\/span>\n}\n\nresource \"azurerm_network_security_group\"<\/span> \"lab\"<\/span> {\n  name                = \"tfvalidation-nsg\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  security_rule {\n    name                       = \"AllowSSH\"<\/span>\n    priority                   = 100<\/span>\n    direction                  = \"Inbound\"<\/span>\n    access                     = \"Allow\"<\/span>\n    protocol                   = \"Tcp\"<\/span>\n    source_port_range          = \"*\"<\/span>\n    destination_port_range     = tostring(var<\/span>.ssh_port)\n    source_address_prefix      = var<\/span>.ssh_cidr\n    destination_address_prefix = \"*\"<\/span>\n  }\n}\n\nresource \"azurerm_network_interface\"<\/span> \"lab\"<\/span> {\n  name                = \"tfvalidation-nic\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  ip_configuration {\n    name                          = \"internal\"<\/span>\n    subnet_id                     = azurerm_subnet.lab.id\n    private_ip_address_allocation = \"Dynamic\"<\/span>\n    public_ip_address_id          = azurerm_public_ip.lab.id\n  }\n}\n\nresource \"azurerm_network_interface_security_group_association\"<\/span> \"lab\"<\/span> {\n  network_interface_id      = azurerm_network_interface.lab.id\n  network_security_group_id = azurerm_network_security_group.lab.id\n}\n\nresource \"azurerm_linux_virtual_machine\"<\/span> \"lab\"<\/span> {\n  name                = \"tfvalidation-vm\"<\/span>\n  resource_group_name = azurerm_resource_group.lab.name\n  location            = azurerm_resource_group.lab.location\n  size                = \"Standard_B1s\"<\/span>\n  admin_username      = var<\/span>.admin_username\n  network_interface_ids = [azurerm_network_interface.lab.id]\n  disable_password_authentication = true<\/span>\n\n  admin_ssh_key {\n    username   = var<\/span>.admin_username\n    public_key = var<\/span>.ssh_public_key\n  }\n\n  os_disk {\n    caching              = \"ReadWrite\"<\/span>\n    storage_account_type = \"Standard_LRS\"<\/span>\n  }\n\n  source_image_reference {\n    publisher = \"Canonical\"<\/span>\n    offer     = \"0001-com-ubuntu-server-jammy\"<\/span>\n    sku       = \"22_04-lts-gen2\"<\/span>\n    version   = \"latest\"<\/span>\n  }\n\n  tags = {\n    Environment = var<\/span>.environment\n  }\n}\n\noutput \"environment\"<\/span> {\n  value = var<\/span>.environment\n}\n\noutput \"public_ip\"<\/span> {\n  value = azurerm_public_ip.lab.ip_address\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Run with ssh_public_key<\/code> and ssh_cidr<\/code>. Try -var=\"ssh_port=70000\"<\/code>; validation should reject it. The example permits a custom SSH port to demonstrate numeric validation; the VM’s SSH daemon itself remains configured on port 22 unless separately changed, so keep ssh_port=22<\/code> for actual SSH access.<\/p>\n\n\n\n
      \n\n\n\n
      11. Lab 8 — Preconditions and postconditions<\/h2>\n\n\n\n
      Concept<\/h3>\n\n\n\n
        \n
      • Precondition:<\/strong>\u00a0verifies an assumption before Terraform proceeds with the relevant operation.<\/li>\n\n\n\n
      • Postcondition:<\/strong>\u00a0verifies a property of a resource after Terraform reads or creates it.<\/li>\n\n\n\n
      • Check block:<\/strong>\u00a0performs an assertion and reports a warning if it fails; it is not a substitute for blocking validation.<\/li>\n<\/ul>\n\n\n\n
        These constructs are useful for expressing requirements close to the resource or output they protect.<\/p>\n\n\n\n
        8A. AWS — enforce a production tag with a precondition<\/h3>\n\n\n
        terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    aws = {\n      source  = \"hashicorp\/aws\"<\/span>\n      version = \"~> 5.0\"<\/span>\n    }\n  }\n}\n\nprovider \"aws\"<\/span> {\n  region = var<\/span>.aws_region\n}\n\nvariable \"aws_region\"<\/span> {\n  type    = string\n  default<\/span> = \"ap-northeast-1\"<\/span>\n}\n\nvariable \"environment\"<\/span> {\n  type    = string\n  default<\/span> = \"prod\"<\/span>\n}\n\nvariable \"ami_id\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nresource \"aws_security_group\"<\/span> \"lab\"<\/span> {\n  name_prefix = \"condition-lab-\"<\/span>\n\n  ingress {\n    from_port   = 22<\/span>\n    to_port     = 22<\/span>\n    protocol    = \"tcp\"<\/span>\n    cidr_blocks = [var<\/span>.ssh_cidr]\n  }\n\n  egress {\n    from_port   = 0<\/span>\n    to_port     = 0<\/span>\n    protocol    = \"-1\"<\/span>\n    cidr_blocks = [\"0.0.0.0\/0\"<\/span>]\n  }\n}\n\nresource \"aws_instance\"<\/span> \"lab\"<\/span> {\n  ami                    = var<\/span>.ami_id\n  instance_type          = \"t3.micro\"<\/span>\n  vpc_security_group_ids = [aws_security_group.lab.id]\n\n  tags = {\n    Name        = \"precondition-lab\"<\/span>\n    Environment = var<\/span>.environment\n  }\n\n  lifecycle {\n    precondition {\n      condition     = contains([\"test\"<\/span>, \"prod\"<\/span>], var<\/span>.environment)\n      error_message = \"This lab permits only test or prod environments.\"<\/span>\n    }\n\n    postcondition {\n      condition     = self<\/span>.instance_type == \"t3.micro\"<\/span>\n      error_message = \"The instance type must remain t3.micro for this lab.\"<\/span>\n    }\n  }\n}\n\noutput \"instance_id\"<\/span> {\n  value = aws_instance.lab.id\n}\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
        Run with environment=prod<\/code> and then try environment=dev<\/code>. The latter should fail the precondition. This example’s postcondition checks the configured instance type; it demonstrates the syntax rather than a cloud health check.<\/p>\n\n\n\n
        8B. Azure — precondition on VM configuration<\/h3>\n\n\n
        terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"<\/span>\n      version = \"~> 4.0\"<\/span>\n    }\n  }\n}\n\nprovider \"azurerm\"<\/span> {\n  features {}\n  resource_provider_registrations = \"none\"<\/span>\n}\n\nvariable \"location\"<\/span> {\n  type    = string\n  default<\/span> = \"Japan East\"<\/span>\n}\n\nvariable \"environment\"<\/span> {\n  type    = string\n  default<\/span> = \"prod\"<\/span>\n}\n\nvariable \"admin_username\"<\/span> {\n  type    = string\n  default<\/span> = \"azureuser\"<\/span>\n}\n\nvariable \"ssh_public_key\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nlocals {\n  vm_size = \"Standard_B1s\"<\/span>\n}\n\nresource \"azurerm_resource_group\"<\/span> \"lab\"<\/span> {\n  name     = \"tfcondition-rg\"<\/span>\n  location = var<\/span>.location\n}\n\nresource \"azurerm_virtual_network\"<\/span> \"lab\"<\/span> {\n  name                = \"tfcondition-vnet\"<\/span>\n  address_space       = [\"10.80.0.0\/16\"<\/span>]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n}\n\nresource \"azurerm_subnet\"<\/span> \"lab\"<\/span> {\n  name                 = \"default\"<\/span>\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n  address_prefixes     = [\"10.80.1.0\/24\"<\/span>]\n}\n\nresource \"azurerm_public_ip\"<\/span> \"lab\"<\/span> {\n  name                = \"tfcondition-pip\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  allocation_method   = \"Static\"<\/span>\n  sku                 = \"Standard\"<\/span>\n}\n\nresource \"azurerm_network_security_group\"<\/span> \"lab\"<\/span> {\n  name                = \"tfcondition-nsg\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  security_rule {\n    name                       = \"AllowSSH\"<\/span>\n    priority                   = 100<\/span>\n    direction                  = \"Inbound\"<\/span>\n    access                     = \"Allow\"<\/span>\n    protocol                   = \"Tcp\"<\/span>\n    source_port_range          = \"*\"<\/span>\n    destination_port_range     = \"22\"<\/span>\n    source_address_prefix      = var<\/span>.ssh_cidr\n    destination_address_prefix = \"*\"<\/span>\n  }\n}\n\nresource \"azurerm_network_interface\"<\/span> \"lab\"<\/span> {\n  name                = \"tfcondition-nic\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  ip_configuration {\n    name                          = \"internal\"<\/span>\n    subnet_id                     = azurerm_subnet.lab.id\n    private_ip_address_allocation = \"Dynamic\"<\/span>\n    public_ip_address_id          = azurerm_public_ip.lab.id\n  }\n}\n\nresource \"azurerm_network_interface_security_group_association\"<\/span> \"lab\"<\/span> {\n  network_interface_id      = azurerm_network_interface.lab.id\n  network_security_group_id = azurerm_network_security_group.lab.id\n}\n\nresource \"azurerm_linux_virtual_machine\"<\/span> \"lab\"<\/span> {\n  name                = \"tfcondition-vm\"<\/span>\n  resource_group_name = azurerm_resource_group.lab.name\n  location            = azurerm_resource_group.lab.location\n  size                = local.vm_size\n  admin_username      = var<\/span>.admin_username\n  network_interface_ids = [azurerm_network_interface.lab.id]\n  disable_password_authentication = true<\/span>\n\n  admin_ssh_key {\n    username   = var<\/span>.admin_username\n    public_key = var<\/span>.ssh_public_key\n  }\n\n  os_disk {\n    caching              = \"ReadWrite\"<\/span>\n    storage_account_type = \"Standard_LRS\"<\/span>\n  }\n\n  source_image_reference {\n    publisher = \"Canonical\"<\/span>\n    offer     = \"0001-com-ubuntu-server-jammy\"<\/span>\n    sku       = \"22_04-lts-gen2\"<\/span>\n    version   = \"latest\"<\/span>\n  }\n\n  lifecycle {\n    precondition {\n      condition     = contains([\"test\"<\/span>, \"prod\"<\/span>], var<\/span>.environment)\n      error_message = \"This lab permits only test or prod environments.\"<\/span>\n    }\n\n    postcondition {\n      condition     = self<\/span>.size == local.vm_size\n      error_message = \"The VM size does not match the selected configuration.\"<\/span>\n    }\n  }\n\n  tags = {\n    Environment = var<\/span>.environment\n  }\n}\n\noutput \"vm_id\"<\/span> {\n  value = azurerm_linux_virtual_machine.lab.id\n}\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
        Run with environment=prod<\/code>, then try environment=dev<\/code> and inspect the validation failure. Use the same Azure key\/CIDR inputs and cleanup procedure as earlier Azure labs.<\/p>\n\n\n\n
        \n\n\n\n
        12. Lab 9 — try(), can(), lookup(), and coalesce()<\/h2>\n\n\n\n
        Concept<\/h3>\n\n\n\n
        These functions are often used alongside conditions, but they are not all conditional expressions.<\/p>\n\n\n\n
          \n
        • try(a, b)<\/code>\u00a0returns the first expression that does not produce an error.<\/li>\n\n\n\n
        • can(expression)<\/code>\u00a0returns\u00a0true<\/code>\u00a0if the expression can be evaluated without an error.<\/li>\n\n\n\n
        • lookup(map, key, default)<\/code>\u00a0returns a map value or a fallback.<\/li>\n\n\n\n
        • coalesce(a, b, ...)<\/code>\u00a0returns the first non-null, non-empty-string value.<\/li>\n\n\n\n
        • contains(list, value)<\/code>\u00a0tests membership.<\/li>\n<\/ul>\n\n\n\n
          Do not use these functions to hide errors that should be fixed directly.<\/p>\n\n\n\n
          9A. AWS — safe defaults and conditional configuration<\/h3>\n\n\n
          terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    aws = {\n      source  = \"hashicorp\/aws\"<\/span>\n      version = \"~> 5.0\"<\/span>\n    }\n  }\n}\n\nprovider \"aws\"<\/span> {\n  region = var<\/span>.aws_region\n}\n\nvariable \"aws_region\"<\/span> {\n  type    = string\n  default<\/span> = \"ap-northeast-1\"<\/span>\n}\n\nvariable \"environment\"<\/span> {\n  type    = string\n  default<\/span> = \"dev\"<\/span>\n}\n\nvariable \"custom_instance_type\"<\/span> {\n  type    = string\n  default<\/span> = \"\"<\/span>\n}\n\nvariable \"ami_id\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nlocals {\n  instance_types = {\n    dev  = \"t3.micro\"<\/span>\n    test = \"t3.micro\"<\/span>\n    prod = \"t3.small\"<\/span>\n  }\n\n  default_type = lookup(local.instance_types, var<\/span>.environment, \"t3.micro\"<\/span>)\n  chosen_type  = coalesce(var<\/span>.custom_instance_type, local.default_type)\n  environment_is_known = contains(keys(local.instance_types), var<\/span>.environment)\n  parsed_number_is_valid = can(tonumber(\"123\"<\/span>))\n  safe_environment = try<\/span>(trimspace(var<\/span>.environment), \"dev\"<\/span>)\n}\n\nresource \"aws_security_group\"<\/span> \"lab\"<\/span> {\n  name_prefix = \"functions-lab-\"<\/span>\n\n  ingress {\n    from_port   = 22<\/span>\n    to_port     = 22<\/span>\n    protocol    = \"tcp\"<\/span>\n    cidr_blocks = [var<\/span>.ssh_cidr]\n  }\n\n  egress {\n    from_port   = 0<\/span>\n    to_port     = 0<\/span>\n    protocol    = \"-1\"<\/span>\n    cidr_blocks = [\"0.0.0.0\/0\"<\/span>]\n  }\n}\n\nresource \"aws_instance\"<\/span> \"lab\"<\/span> {\n  ami                    = var<\/span>.ami_id\n  instance_type          = local.chosen_type\n  vpc_security_group_ids = [aws_security_group.lab.id]\n  tags = {\n    Name        = \"functions-lab\"<\/span>\n    Environment = local.safe_environment\n  }\n}\n\noutput \"selected_instance_type\"<\/span> {\n  value = local.chosen_type\n}\n\noutput \"environment_is_known\"<\/span> {\n  value = local.environment_is_known\n}\n\noutput \"parsed_number_is_valid\"<\/span> {\n  value = local.parsed_number_is_valid\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Run with the usual AWS commands and required inputs. Try -var=\"environment=prod\"<\/code> and then -var=\"custom_instance_type=t3.small\"<\/code>. The explicit custom value takes precedence. The example uses can()<\/code> and try()<\/code> to illustrate safe expression evaluation; they do not verify that an instance type is available in your account or region.<\/p>\n\n\n\n
          9B. Azure — lookup and coalesce for VM size and name<\/h3>\n\n\n
          terraform {\n  required_version = \">= 1.3.0\"<\/span>\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"<\/span>\n      version = \"~> 4.0\"<\/span>\n    }\n  }\n}\n\nprovider \"azurerm\"<\/span> {\n  features {}\n  resource_provider_registrations = \"none\"<\/span>\n}\n\nvariable \"location\"<\/span> {\n  type    = string\n  default<\/span> = \"Japan East\"<\/span>\n}\n\nvariable \"environment\"<\/span> {\n  type    = string\n  default<\/span> = \"dev\"<\/span>\n}\n\nvariable \"custom_vm_size\"<\/span> {\n  type    = string\n  default<\/span> = \"\"<\/span>\n}\n\nvariable \"custom_name\"<\/span> {\n  type    = string\n  default<\/span> = \"\"<\/span>\n}\n\nvariable \"admin_username\"<\/span> {\n  type    = string\n  default<\/span> = \"azureuser\"<\/span>\n}\n\nvariable \"ssh_public_key\"<\/span> {\n  type = string\n}\n\nvariable \"ssh_cidr\"<\/span> {\n  type = string\n}\n\nlocals {\n  vm_sizes = {\n    dev  = \"Standard_B1s\"<\/span>\n    test = \"Standard_B1s\"<\/span>\n    prod = \"Standard_B2s\"<\/span>\n  }\n  default_size = lookup(local.vm_sizes, var<\/span>.environment, \"Standard_B1s\"<\/span>)\n  vm_size      = coalesce(var<\/span>.custom_vm_size, local.default_size)\n  vm_name      = coalesce(var<\/span>.custom_name, \"tf-functions-${var.environment}-vm\"<\/span>)\n  environment_is_known = contains(keys(local.vm_sizes), var<\/span>.environment)\n  number_parse_works   = can(tonumber(\"123\"<\/span>))\n  safe_environment     = try<\/span>(trimspace(var<\/span>.environment), \"dev\"<\/span>)\n}\n\nresource \"azurerm_resource_group\"<\/span> \"lab\"<\/span> {\n  name     = \"tffunctions-rg\"<\/span>\n  location = var<\/span>.location\n}\n\nresource \"azurerm_virtual_network\"<\/span> \"lab\"<\/span> {\n  name                = \"tffunctions-vnet\"<\/span>\n  address_space       = [\"10.90.0.0\/16\"<\/span>]\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n}\n\nresource \"azurerm_subnet\"<\/span> \"lab\"<\/span> {\n  name                 = \"default\"<\/span>\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n  address_prefixes     = [\"10.90.1.0\/24\"<\/span>]\n}\n\nresource \"azurerm_public_ip\"<\/span> \"lab\"<\/span> {\n  name                = \"tffunctions-pip\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  allocation_method   = \"Static\"<\/span>\n  sku                 = \"Standard\"<\/span>\n}\n\nresource \"azurerm_network_security_group\"<\/span> \"lab\"<\/span> {\n  name                = \"tffunctions-nsg\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  security_rule {\n    name                       = \"AllowSSH\"<\/span>\n    priority                   = 100<\/span>\n    direction                  = \"Inbound\"<\/span>\n    access                     = \"Allow\"<\/span>\n    protocol                   = \"Tcp\"<\/span>\n    source_port_range          = \"*\"<\/span>\n    destination_port_range     = \"22\"<\/span>\n    source_address_prefix      = var<\/span>.ssh_cidr\n    destination_address_prefix = \"*\"<\/span>\n  }\n}\n\nresource \"azurerm_network_interface\"<\/span> \"lab\"<\/span> {\n  name                = \"tffunctions-nic\"<\/span>\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  ip_configuration {\n    name                          = \"internal\"<\/span>\n    subnet_id                     = azurerm_subnet.lab.id\n    private_ip_address_allocation = \"Dynamic\"<\/span>\n    public_ip_address_id          = azurerm_public_ip.lab.id\n  }\n}\n\nresource \"azurerm_network_interface_security_group_association\"<\/span> \"lab\"<\/span> {\n  network_interface_id      = azurerm_network_interface.lab.id\n  network_security_group_id = azurerm_network_security_group.lab.id\n}\n\nresource \"azurerm_linux_virtual_machine\"<\/span> \"lab\"<\/span> {\n  name                = local.vm_name\n  resource_group_name = azurerm_resource_group.lab.name\n  location            = azurerm_resource_group.lab.location\n  size                = local.vm_size\n  admin_username      = var<\/span>.admin_username\n  network_interface_ids = [azurerm_network_interface.lab.id]\n  disable_password_authentication = true<\/span>\n\n  admin_ssh_key {\n    username   = var<\/span>.admin_username\n    public_key = var<\/span>.ssh_public_key\n  }\n\n  os_disk {\n    caching              = \"ReadWrite\"<\/span>\n    storage_account_type = \"Standard_LRS\"<\/span>\n  }\n\n  source_image_reference {\n    publisher = \"Canonical\"<\/span>\n    offer     = \"0001-com-ubuntu-server-jammy\"<\/span>\n    sku       = \"22_04-lts-gen2\"<\/span>\n    version   = \"latest\"<\/span>\n  }\n\n  tags = {\n    Environment = local.safe_environment\n  }\n}\n\noutput \"selected_vm_size\"<\/span> {\n  value = local.vm_size\n}\n\noutput \"vm_name\"<\/span> {\n  value = local.vm_name\n}\n\noutput \"environment_is_known\"<\/span> {\n  value = local.environment_is_known\n}\n\noutput \"number_parse_works\"<\/span> {\n  value = local.number_parse_works\n}\n\noutput \"public_ip\"<\/span> {\n  value = azurerm_public_ip.lab.ip_address\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Run with the standard Azure workflow. Try -var=\"environment=prod\"<\/code> and -var=\"custom_vm_size=Standard_B1s\"<\/code>. coalesce<\/code> chooses the non-empty custom value when supplied. Confirm the chosen size is available before applying.<\/p>\n\n\n\n
          \n\n\n\n
          13. Lab 10 — Conditional module instances<\/h2>\n\n\n\n
          Concept<\/h3>\n\n\n\n
          Modules can use count<\/code> or for_each<\/code>, just like resources. When using count<\/code>, outputs from the module become a list of module instances. A module using for_each<\/code> is addressed by its keys.<\/p>\n\n\n\n
          This lab is deliberately a small local module example so it can be tested without creating cloud resources. It demonstrates Terraform language behavior; cloud-specific modules can use the same pattern.<\/p>\n\n\n\n
          Create this directory layout:<\/p>\n\n\n
          conditional-module<\/span>-lab\/\n\u251c\u2500\u2500 main.tf\n\u2514\u2500\u2500 modules\/\n    \u2514\u2500\u2500 label\/\n        \u2514\u2500\u2500 main.tf\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Root main.tf<\/code>:<\/p>\n\n\n
          terraform {\n  required_version = \">= 1.3.0\"<\/span>\n}\n\nvariable \"create_label\"<\/span> {\n  type    = bool\n  default<\/span> = true<\/span>\n}\n\nmodule<\/span> \"label\"<\/span> {\n  source = \".\/modules\/label\"<\/span>\n  count  = var<\/span>.create_label ? 1<\/span> : 0<\/span>\n\n  label = \"demo\"<\/span>\n}\n\noutput \"label_value\"<\/span> {\n  value = var<\/span>.create_label ? module<\/span>.label[0<\/span>].value : null<\/span>\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          modules\/label\/main.tf<\/code>:<\/p>\n\n\n
          variable \"label\"<\/span> {\n  type = string\n}\n\noutput \"value\"<\/span> {\n  value = upper(var<\/span>.label)\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Run:<\/p>\n\n\n
          terraform init\nterraform validate\nterraform plan\nterraform apply\nterraform output\nterraform plan -var<\/span>=\"create_label=false\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          This demonstrates conditional module instantiation. No cloud infrastructure is created.<\/p>\n\n\n\n
          \n\n\n\n
          14. Important patterns and gotchas<\/h2>\n\n\n\n
          count<\/code> versus for_each<\/code><\/h3>\n\n\n\n
          \n\n\n\n
          Feature count<\/code> for_each<\/code><\/p>\n\n\n\n
          \n\n\n\n
          Input Non-negative integer Map or set of strings<\/p>\n\n\n\n
          Address Numeric index, Key, e.g. [0]<\/code> e.g. [\"frontend\"]<\/code><\/p>\n\n\n\n
          Best for Fixed number or simple Named resources with on\/off stable identity<\/p>\n\n\n\n
          Main risk Removing an element Renaming a key changes from a list can shift the resource address indexes<\/h2>\n\n\n\n
          Conditional expressions must have compatible result types<\/h3>\n\n\n\n
          Good:<\/p>\n\n\n
          var<\/span>.enabled ? \"enabled\"<\/span> : \"disabled\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Potentially problematic if the branches have incompatible types:<\/p>\n\n\n
          var<\/span>.enabled ? 1<\/span> : \"no\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Keep both branches the same type where possible.<\/p>\n\n\n\n
          Do not use count<\/code> to make a resource depend on an unknown result<\/h3>\n\n\n\n
          Terraform must know count<\/code> and for_each<\/code> instance keys during planning. If the condition depends on an attribute that is unknown until apply, Terraform may not be able to determine the instance count. Base instance selection on known input variables or known configuration whenever possible.<\/p>\n\n\n\n
          Resource references change when count<\/code> or for_each<\/code> is used<\/h3>\n\n\n\n
          Without count<\/code>:<\/p>\n\n\n
          aws_instance<\/span>.web<\/span>.id<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
          With count<\/code>:<\/p>\n\n\n
          aws_instance<\/span>.web<\/span>[0]<\/span>.id<\/span>\naws_instance<\/span>.web<\/span>[*]<\/span>.id<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
          With for_each<\/code>:<\/p>\n\n\n
          aws_instance<\/span>.web<\/span>[\"frontend\"<\/span>]<\/span>.id<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
          null<\/code> is not the same as false<\/code><\/h3>\n\n\n\n
            \n
          • false<\/code>\u00a0is a Boolean value.<\/li>\n\n\n\n
          • null<\/code>\u00a0means absence of a value and can omit an optional argument.<\/li>\n\n\n\n
          • An empty string (\"\"<\/code>) is still a string.<\/li>\n\n\n\n
          • An empty list ([]<\/code>) is a collection with zero elements.<\/li>\n<\/ul>\n\n\n\n
            dynamic<\/code> is for nested blocks<\/h3>\n\n\n\n
            Use for_each<\/code> on a resource or module to repeat top-level instances. Use dynamic<\/code> when you need repeated nested blocks within one resource.<\/p>\n\n\n\n
            Azure NSG rules and AWS security group rules differ<\/h3>\n\n\n\n
            The AWS provider supports inline ingress<\/code>\/egress<\/code> blocks, including dynamic<\/code> blocks in supported resource schemas. Azure NSG rules are commonly represented as separate azurerm_network_security_rule<\/code> resources, making for_each<\/code> the natural pattern.<\/p>\n\n\n\n
            try()<\/code> and can()<\/code> are not generic exception handling<\/h3>\n\n\n\n
            Use them for expressions that might be absent or invalid, especially when normalizing external or loosely structured data. Do not wrap every expression in try()<\/code> to conceal configuration mistakes.<\/p>\n\n\n\n
            Precondition, postcondition, and check are different<\/h3>\n\n\n\n
              \n
            • Preconditions and postconditions can block an operation when their assertions fail.<\/li>\n\n\n\n
            • check<\/code>\u00a0blocks are designed for ongoing checks and generally report warnings rather than blocking the operation.<\/li>\n\n\n\n
            • Variable validation is usually the clearest choice for invalid user inputs.<\/li>\n<\/ul>\n\n\n\n
              \n\n\n\n
              15. Troubleshooting<\/h2>\n\n\n\n
              Error: Invalid for_each argument<\/h3>\n\n\n\n
              Common cause:<\/strong> The keys or set members cannot be determined until apply, or the value is not a map\/set of strings.<\/p>\n\n\n\n
              Fix:<\/strong> Use stable keys known during planning. For maps of objects, keep the keys independent of computed cloud resource IDs.<\/p>\n\n\n\n
              Error: Invalid count argument<\/h3>\n\n\n\n
              Common cause:<\/strong> Terraform cannot determine the count during planning.<\/p>\n\n\n\n
              Fix:<\/strong> Use a Boolean input variable or another value known before apply.<\/p>\n\n\n\n
              Error: Invalid index<\/h3>\n\n\n\n
              Common cause:<\/strong> Referencing resource.example[0]<\/code> when count = 0<\/code>.<\/p>\n\n\n\n
              Fix:<\/strong> Guard the reference with a condition, or use a splat expression such as resource.example[*].id<\/code>.<\/p>\n\n\n\n
              Azure VM size or quota errors<\/h3>\n\n\n\n
              Common cause:<\/strong> The selected VM size is unavailable in the region, restricted by policy, or exceeds quota.<\/p>\n\n\n\n
              Fix:<\/strong> Check Azure regional availability, subscription quota, and policy. Choose a size permitted by the subscription; changing a Terraform condition cannot grant quota.<\/p>\n\n\n\n
              AWS AMI not found<\/h3>\n\n\n\n
              Common cause:<\/strong> AMI IDs are regional, stale, or incorrect.<\/p>\n\n\n\n
              Fix:<\/strong> Look up a valid image in the configured AWS region and pass its ID to ami_id<\/code>.<\/p>\n\n\n\n
              SSH connection fails<\/h3>\n\n\n\n
              Check: – ssh_cidr<\/code> matches your current public IPv4 address in CIDR notation (often \/32<\/code>). – You supplied the public<\/strong> key, not the private key, to Azure. – The matching private key is available locally. – The cloud resource has finished provisioning. – The selected region, route, security rules, and OS image are correct. – For Azure, if you changed the NSG destination port, the Linux SSH daemon must also be configured for that port.<\/p>\n\n\n\n
              Provider version or registration issues<\/h3>\n\n\n\n
              Run:<\/p>\n\n\n
              terraform init -upgrade\nterraform providers\nterraform validate\n<\/code><\/span><\/pre>\n\n\n
              Review provider constraints and your organization’s Azure provider-registration policy. Do not run init -upgrade<\/code> blindly in production without reviewing the provider version changes.<\/p>\n\n\n\n
              \n\n\n\n
              16. Best practices<\/h2>\n\n\n\n
                \n
              1. Prefer\u00a0for_each<\/code>\u00a0for named resources where stable keys matter.<\/li>\n\n\n\n
              2. Use\u00a0count<\/code>\u00a0for simple on\/off resources or truly interchangeable instances.<\/li>\n\n\n\n
              3. Put complex decisions in\u00a0locals<\/code>\u00a0and give them descriptive names.<\/li>\n\n\n\n
              4. Validate inputs early with variable\u00a0validation<\/code>\u00a0blocks.<\/li>\n\n\n\n
              5. Use preconditions and postconditions for assumptions tied to resources.<\/li>\n\n\n\n
              6. Keep environment settings in a map\/object instead of deeply nested ternaries.<\/li>\n\n\n\n
              7. Keep security rules restrictive. Never expose SSH publicly just to simplify a lab.<\/li>\n\n\n\n
              8. Pin provider major versions and review upgrades.<\/li>\n\n\n\n
              9. Inspect\u00a0terraform plan<\/code>\u00a0before every apply.<\/li>\n\n\n\n
              10. Use separate directories or isolated state for each hands-on lab.<\/li>\n\n\n\n
              11. Destroy temporary lab resources to avoid ongoing costs.<\/li>\n\n\n\n
              12. Avoid changing\u00a0for_each<\/code>\u00a0keys or\u00a0count<\/code>\u00a0list order in existing production state without understanding the resulting resource address changes.<\/li>\n\n\n\n
              13. Keep secrets out of\u00a0.tf<\/code>\u00a0files and source control.<\/li>\n\n\n\n
              14. Test conditions by changing one input at a time and comparing plans.<\/li>\n<\/ol>\n\n\n\n
                \n\n\n\n
                17. Quick reference<\/h2>\n\n\n\n
                \n\n\n\n
                Need Recommended technique<\/p>\n\n\n\n
                \n\n\n\n
                Choose one value or another condition ? a : b<\/code><\/p>\n\n\n\n
                Combine Boolean requirements &&<\/code>, ||<\/code>, !<\/code><\/p>\n\n\n\n
                Create a resource only when enabled count = var.enabled ? 1 : 0<\/code><\/p>\n\n\n\n
                Create named resources from a for_each<\/code> map\/set<\/p>\n\n\n\n
                Filter a list or map for ... if ...<\/code><\/p>\n\n\n\n
                Transform a collection for<\/code> expression<\/p>\n\n\n\n
                Repeat nested provider blocks dynamic<\/code><\/p>\n\n\n\n
                Reject invalid input Variable validation<\/code><\/p>\n\n\n\n
                Enforce an assumption before\/after precondition<\/code> \/ postcondition<\/code> a resource operation<\/p>\n\n\n\n
                Report an ongoing assertion warning check<\/code> block<\/p>\n\n\n\n
                Safely attempt an expression try()<\/code><\/p>\n\n\n\n
                Test if an expression evaluates can()<\/code> without error<\/p>\n\n\n\n
                Get a map value with a fallback lookup()<\/code><\/p>\n\n\n\n
                Choose first non-null\/non-empty coalesce()<\/code> string<\/p>\n\n\n\n
                Check whether a collection contains contains()<\/code> a value<\/p>\n\n\n\n
                Provide optional argument absence null<\/code><\/h2>\n\n\n\n
                \n\n\n\n
                18. Exercises and answers<\/h2>\n\n\n\n
                Exercise 1<\/h3>\n\n\n\n
                Choose t3.small<\/code> only if environment<\/code> is prod<\/code>; otherwise choose t3.micro<\/code>.<\/p>\n\n\n\n
                Answer:<\/strong><\/p>\n\n\n
                locals {\n  instance_type = var<\/span>.environment == \"prod\"<\/span> ? \"t3.small\"<\/span> : \"t3.micro\"<\/span>\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                Exercise 2<\/h3>\n\n\n\n
                Create an EC2 instance only if create_instance<\/code> is true.<\/p>\n\n\n\n
                Answer:<\/strong><\/p>\n\n\n
                resource \"aws_instance\"<\/span> \"optional\"<\/span> {\n  count = var<\/span>.create_instance ? 1<\/span> : 0<\/span>\n  # Include the required AMI, instance type, and other settings.<\/span>\n}\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                Exercise 3<\/h3>\n\n\n\n
                Filter a map of applications to keep only enabled applications.<\/p>\n\n\n\n
                Answer:<\/strong><\/p>\n\n\n
                locals {\n  enabled_applications = {\n    for<\/span> name, app in<\/span> var<\/span>.applications : name<\/span> =><\/span> app\n    if<\/span> app.enabled\n  }\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                Exercise 4<\/h3>\n\n\n\n
                Allow only dev<\/code>, test<\/code>, or prod<\/code>.<\/p>\n\n\n\n
                Answer:<\/strong><\/p>\n\n\n
                variable \"environment\"<\/span> {\n  type = string\n\n  validation {\n    condition     = contains([\"dev\"<\/span>, \"test\"<\/span>, \"prod\"<\/span>], var<\/span>.environment)\n    error_message = \"Use dev, test, or prod.\"<\/span>\n  }\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                Exercise 5<\/h3>\n\n\n\n
                What is the difference between dynamic<\/code> and for_each<\/code>?<\/p>\n\n\n\n
                Answer:<\/strong> for_each<\/code> repeats resource or module instances. A dynamic<\/code> block generates repeated nested blocks inside a resource.<\/p>\n\n\n\n
                Exercise 6<\/h3>\n\n\n\n
                Why might Terraform reject a count<\/code> expression?<\/p>\n\n\n\n
                Answer:<\/strong> Terraform must know how many instances to plan. If the count depends on a value that is unknown until apply, Terraform may not be able to calculate it.<\/p>\n\n\n\n
                \n\n\n\n
                19. Glossary<\/h2>\n\n\n\n
                  \n
                • Conditional expression:<\/strong>\u00a0Selects a value based on a Boolean condition.<\/li>\n\n\n\n
                • Boolean:<\/strong>\u00a0A value that is either\u00a0true<\/code>\u00a0or\u00a0false<\/code>.<\/li>\n\n\n\n
                • Meta-argument:<\/strong>\u00a0A special argument such as\u00a0count<\/code>,\u00a0for_each<\/code>, or\u00a0depends_on<\/code>\u00a0that changes Terraform’s resource\/module behavior.<\/li>\n\n\n\n
                • Collection:<\/strong>\u00a0A list, tuple, set, map, or object.<\/li>\n\n\n\n
                • Iteration:<\/strong>\u00a0Processing or creating configuration for multiple elements.<\/li>\n\n\n\n
                • Filtering:<\/strong>\u00a0Selecting only collection elements that meet a condition.<\/li>\n\n\n\n
                • Dynamic block:<\/strong>\u00a0A construct that generates nested blocks from a collection.<\/li>\n\n\n\n
                • Precondition:<\/strong>\u00a0An assertion that must hold before a relevant operation can proceed.<\/li>\n\n\n\n
                • Postcondition:<\/strong>\u00a0An assertion evaluated after a resource operation\/read.<\/li>\n\n\n\n
                • Plan:<\/strong>\u00a0Terraform’s preview of proposed infrastructure changes.<\/li>\n\n\n\n
                • State:<\/strong>\u00a0Terraform’s record of managed infrastructure objects.<\/li>\n<\/ul>\n\n\n\n
                  \n\n\n\n
                  Final checklist<\/h2>\n\n\n\n
                  Before finishing a lab, verify:<\/p>\n\n\n\n
                    \n
                  • [ ]\u00a0terraform fmt<\/code>\u00a0completed.<\/li>\n\n\n\n
                  • [ ]\u00a0terraform validate<\/code>\u00a0passed.<\/li>\n\n\n\n
                  • [ ] The plan matches the condition you intended to test.<\/li>\n\n\n\n
                  • [ ] Outputs show the expected value or number of instances.<\/li>\n\n\n\n
                  • [ ] You inspected the cloud console or CLI where appropriate.<\/li>\n\n\n\n
                  • [ ] You ran\u00a0terraform destroy<\/code>\u00a0for temporary infrastructure.<\/li>\n\n\n\n
                  • [ ] You checked that no lab resources remain.<\/li>\n<\/ul>\n\n\n\n
                    Remember:<\/strong> Terraform conditions decide values and desired configuration. Terraform then compares that configuration with state and real infrastructure to calculate a plan. Always review the plan before applying it.<\/p>\n","protected":false},"excerpt":{"rendered":"
                    Terraform Conditional Expressions and Logic \u2014 Summary Table # Concept Purpose Example Creates Resources? 1 Ternary operator Choose between two values var.env == “prod” ? “t3.large” :… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[5129],"tags":[],"class_list":["post-12956","post","type-post","status-publish","format-standard","hentry","category-terraform"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/12956","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=12956"}],"version-history":[{"count":11,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/12956\/revisions"}],"predecessor-version":[{"id":79121,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/12956\/revisions\/79121"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=12956"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=12956"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=12956"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}