Validated baseline<\/strong><\/td>| 5 September 2026<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Rule for this manual: understand the tool, run the smallest useful exercise, verify the result, then move on.<\/em><\/p>\n\n\n\nHow to Use This Lab Manual<\/h1>\n\n\n\nGOAL<\/strong><\/td>Each lab is deliberately small. Students should be able to explain the tool in one minute and demonstrate its core value with one exercise.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nRecommended learning path<\/h2>\n\n\n\nVS Code \/ Terraform Extension -> terraform-ls -> Terraform MCP -> tenv -> Terraform CLI
-> terraform test -> TFLint -> Trivy -> terraform-docs -> Infracost
-> pre-commit -> Git -> GitHub Actions \/ GitLab CI -> HCP Terraform
-> optional scale\/governance tools: Terragrunt, Checkov, OPA\/Conftest, Sentinel, Atlantis, Renovate, tfupdate<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nLab rules<\/h2>\n\n\n\n\n- Run commands from the lab workspace unless the lab says otherwise.<\/li>\n\n\n\n
- Do not paste cloud access keys into Terraform files, shell history, Git, CI variables, or screenshots.<\/li>\n\n\n\n
- Never run terraform apply inside security-demo\/ or cost-demo\/. Those folders exist only for scanning and cost exercises.<\/li>\n\n\n\n
- For hosted tools, use a training\/sandbox organization and follow instructor-provided access.<\/li>\n\n\n\n
- If a command is unavailable, run <tool> –help and verify your installed version before assuming the lab is wrong.<\/li>\n<\/ul>\n\n\n\n
Prerequisites<\/h2>\n\n\n\nRequirement<\/strong><\/td>Minimum<\/strong><\/td>Check<\/strong><\/td><\/tr>| Terminal + shell<\/td> | bash\/zsh\/PowerShell<\/td> | echo $SHELL<\/td><\/tr> | | Git<\/td> | Recent stable<\/td> | git –version<\/td><\/tr> | | VS Code<\/td> | Recent stable<\/td> | code –version<\/td><\/tr> | | Homebrew<\/td> | Recommended for this manual<\/td> | brew –version<\/td><\/tr> | | Docker<\/td> | Optional: Terraform MCP lab<\/td> | docker –version<\/td><\/tr> | | GitHub\/GitLab account<\/td> | Optional: CI lab<\/td> | Sign in<\/td><\/tr> | | HCP Terraform account<\/td> | Optional: HCP lab<\/td> | Sign in<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nFoundation Lab – Build the Safe Student Workspace<\/h1>\n\n\n\nWHY<\/strong><\/td>Every later lab reuses this tiny project. It creates only local resources, so students can practice Terraform without an AWS\/Azure\/GCP account.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n1. Create the folders<\/h2>\n\n\n\nmkdir -p terraform-toolchain-lab\/tests
mkdir -p terraform-toolchain-lab\/security-demo
mkdir -p terraform-toolchain-lab\/cost-demo
cd terraform-toolchain-lab<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n2. Create versions.tf<\/h2>\n\n\n\nterraform {
required_version = “>= 1.7.0, < 2.0.0”
required_providers {
random = {
source = “hashicorp\/random”
version = “~> 3.7”
}
local = {
source = “hashicorp\/local”
version = “~> 2.5”
}
}
}<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n3. Create main.tf<\/h2>\n\n\n\nvariable “environment” {
type = string
default = “dev”
validation {
condition = contains([“dev”, “staging”, “prod”], var.environment)
error_message = “environment must be dev, staging, or prod”
}
}
locals {
app_name = “training-${var.environment}”
}
resource “random_pet” “suffix” {
length = 2
}
resource “local_file” “summary” {
filename = “${path.module}\/generated.txt”
content = “app=${local.app_name}\\nsuffix=${random_pet.suffix.id}\\n”
}
output “app_name” {
value = local.app_name
}
output “generated_file” {
value = local_file.summary.filename
}<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n4. Create tests\/basic.tftest.hcl<\/h2>\n\n\n\nmock_provider “random” {}
mock_provider “local” {}
run “naming_is_correct” {
command = plan
variables {
environment = “staging”
}
assert {
condition = output.app_name == “training-staging”
error_message = “Unexpected application name”
}
}<\/td> | <\/td><\/tr> | PASS<\/strong><\/td>| The folder contains versions.tf, main.tf, and tests\/basic.tftest.hcl. No cloud credentials are required.<\/td><\/tr> | | <\/td> | <\/td> | <\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nFoundation – Terraform CLI + Git<\/h1>\n\n\n\n5W1H Quick View<\/h2>\n\n\n\nWhat?<\/strong><\/td>| Terraform CLI is the IaC execution engine; Git records and reviews code changes.<\/td><\/tr> | Why?<\/strong><\/td>| Every tool in this manual either improves Terraform authoring, checks Terraform, or automates its Git workflow.<\/td><\/tr> | When?<\/strong><\/td>| Use Terraform CLI throughout development; use Git for every team change.<\/td><\/tr> | Install?<\/strong><\/td>| Terraform is installed through tenv in Lab 08. Git is normally preinstalled or available through your OS package manager.<\/td><\/tr> | How?<\/strong><\/td>Initialize, format, validate, plan, then apply only in the approved context. Commit source and .terraform.lock.hcl – never state files.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nTerraform – Top 5 Commands<\/h2>\n\n\n\nCommand \/ Action<\/strong><\/td>Purpose<\/strong><\/td><\/tr><\/thead>| terraform init<\/td> | Download providers\/modules and initialize the working directory.<\/td><\/tr> | | terraform fmt -recursive<\/td> | Apply canonical Terraform formatting.<\/td><\/tr> | | terraform validate<\/td> | Check configuration validity.<\/td><\/tr> | | terraform plan<\/td> | Preview proposed changes.<\/td><\/tr> | | terraform apply<\/td> | Execute an approved plan; in this manual only the local training project.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nGit – Top 5 Commands<\/h2>\n\n\n\nCommand \/ Action<\/strong><\/td>Purpose<\/strong><\/td><\/tr><\/thead>| git status<\/td> | See changed\/untracked files.<\/td><\/tr> | | git diff<\/td> | Review your changes before commit.<\/td><\/tr> | | git add .<\/td> | Stage intended changes.<\/td><\/tr> | | git commit -m “…”<\/td> | Create a reviewable change.<\/td><\/tr> | | git push<\/td> | Send the branch to the remote repository.<\/td><\/tr> | SECURITY<\/strong><\/td>| Never commit *.tfstate, .terraform\/, saved plan files, credentials, tokens, or sensitive *.tfvars.<\/td> | <\/td><\/tr> | | <\/td> | <\/td> | <\/td> | <\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nLab 01 – VS Code + HashiCorp Terraform Extension<\/h1>\n\n\n\nTerraform-aware editing: syntax, completion, formatting, navigation and diagnostics.<\/em><\/p>\n\n\n\nPriority:<\/strong> 5\/5<\/td>Lab mode:<\/strong> Hands-on<\/td>Outcome:<\/strong> Run + verify<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n5W1H Quick View<\/h2>\n\n\n\nWhat?<\/strong><\/td>| The official Terraform extension turns VS Code into a Terraform-aware editor and uses the Terraform language server.<\/td><\/tr> | Why?<\/strong><\/td>| It catches simple mistakes while you type and makes provider\/module code easier to navigate.<\/td><\/tr> | When?<\/strong><\/td>| Use it whenever authoring or reviewing .tf, .tfvars, .tftest.hcl, Terraform Stacks\/Search\/Policy files.<\/td><\/tr> | Install?<\/strong><\/td>| VS Code Extensions -> search “HashiCorp Terraform”, or run: code –install-extension HashiCorp.terraform<\/td><\/tr> | How?<\/strong><\/td>Open the project folder, edit main.tf, use autocomplete, Format Document, Go to Definition, and the Problems panel.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nTop 5 Commands \/ Actions<\/h2>\n\n\n\nCommand \/ Action<\/strong><\/td>Purpose<\/strong><\/td><\/tr><\/thead>| code –install-extension HashiCorp.terraform<\/td> | Install the official extension.<\/td><\/tr> | | code .<\/td> | Open the current Terraform project.<\/td><\/tr> | | Format Document<\/td> | Run terraform-aware formatting from the editor.<\/td><\/tr> | | F12 – Go to Definition<\/td> | Jump to variables, modules, resources, outputs.<\/td><\/tr> | | Problems panel<\/td> | Review syntax\/diagnostic issues from the language server.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nStudent Exercise<\/h2>\n\n\n\n1. Install the extension and open terraform-toolchain-lab as a folder.<\/p>\n\n\n\n 2. Open main.tf and type “var.” inside a temporary local expression; confirm autocomplete suggests environment.<\/p>\n\n\n\n 3. Intentionally misalign an attribute, run Format Document, and confirm formatting changes.<\/p>\n\n\n\n 4. Use F12 on var.environment or local.app_name.<\/p>\n\n\n\n 5. Remove the temporary edit and save the file.<\/p>\n\n\n\n PASS –<\/strong> Expected: Terraform files have syntax highlighting and autocomplete; formatting and navigation work from the editor. Pass when: You can demonstrate autocomplete + Format Document + Go to Definition without using a terminal command.<\/p>\n\n\n\nLab 02 – terraform-ls<\/h1>\n\n\n\nLanguage Server Protocol backend behind Terraform IDE intelligence.<\/em><\/p>\n\n\n\nPriority:<\/strong> 5\/5<\/td>Lab mode:<\/strong> Hands-on \/ background service<\/td>Outcome:<\/strong> Run + verify<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n5W1H Quick View<\/h2>\n\n\n\nWhat?<\/strong><\/td>| HashiCorp’s Terraform language server provides completion, diagnostics, hover and navigation through LSP.<\/td><\/tr> | Why?<\/strong><\/td>| Editors need a project-aware process that understands Terraform configuration and schemas.<\/td><\/tr> | When?<\/strong><\/td>| Normally every time the Terraform editor extension is active.<\/td><\/tr> | Install?<\/strong><\/td>| VS Code normally bundles a compatible terraform-ls. Manual install is mainly for other LSP-capable editors: brew install hashicorp\/tap\/terraform-ls<\/td><\/tr> | How?<\/strong><\/td>Usually let the editor start it automatically. Manual users run terraform-ls serve.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nTop 5 Commands \/ Actions<\/h2>\n\n\n\nCommand \/ Action<\/strong><\/td>Purpose<\/strong><\/td><\/tr><\/thead>| terraform-ls version<\/td> | Show the installed language-server version.<\/td><\/tr> | | terraform-ls serve<\/td> | Start the LSP server manually.<\/td><\/tr> | | which terraform-ls<\/td> | Find the binary on macOS\/Linux.<\/td><\/tr> | | code .<\/td> | Open a project so the extension can start\/index the server.<\/td><\/tr> | | View -> Output -> HashiCorp Terraform<\/td> | Inspect language-server startup and diagnostics.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nStudent Exercise<\/h2>\n\n\n\n1. In VS Code, open View -> Output and select HashiCorp Terraform.<\/p>\n\n\n\n 2. Confirm the output shows a language server starting for the workspace.<\/p>\n\n\n\n 3. If you installed terraform-ls separately, run terraform-ls version.<\/p>\n\n\n\n 4. Open main.tf and confirm hover\/completion\/navigation still work.<\/p>\n\n\n\n PASS –<\/strong> Expected: The editor launches terraform-ls automatically; manual installation is not required for normal VS Code usage. Pass when: You can explain that terraform-ls is a background service, not a replacement for terraform CLI.<\/p>\n\n\n\nLab 03 – TFLint<\/h1>\n\n\n\nLint Terraform and detect provider-specific mistakes, deprecated patterns and quality issues.<\/em><\/p>\n\n\n\nPriority:<\/strong> 5\/5<\/td>Lab mode:<\/strong> Hands-on<\/td>Outcome:<\/strong> Run + verify<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n5W1H Quick View<\/h2>\n\n\n\nWhat?<\/strong><\/td>| TFLint is a pluggable Terraform linter with Terraform and cloud-provider rulesets.<\/td><\/tr> | Why?<\/strong><\/td>| terraform validate checks validity; TFLint catches additional suspicious or non-standard configuration.<\/td><\/tr> | |
| |
| | |
| | |
| | | | | |
| | |
| | |
| | | | | |
| | |
| | | |
| | |
| | | | | |
| |
|
|
|
| |
| | | |
|
| |
|