{"id":1235,"date":"2026-10-14T08:23:50","date_gmt":"2026-10-14T08:23:50","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/?p=1235"},"modified":"2026-10-14T08:23:52","modified_gmt":"2026-10-14T08:23:52","slug":"terraform-lab-azure-hands-on-terraform-modules","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/terraform-lab-azure-hands-on-terraform-modules\/","title":{"rendered":"Terraform Lab \u2013 Azure Hands-On \u2013\u00a0Terraform Modules"},"content":{"rendered":"\n

Course level:<\/strong> Beginner \u2192 Intermediate
Course type:<\/strong> Tutorial + runnable hands-on exercises + instructor checkpoints
Updated:<\/strong> 14 October 2026
Terraform:<\/strong> >= 1.15.0, < 2.0.0<\/code> (lab baseline: 1.15.9)
AzureRM provider:<\/strong> ~> 5.9.0<\/code> (root; child modules declare >= 5.9.0<\/code>)
Azure baseline:<\/strong> eastus<\/code>, Ubuntu Server 26.04 LTS, SSH-key login, private-only VM
Main goal:<\/strong> Learn Terraform modules<\/strong>, not complex Azure networking or security features.<\/p>\n\n\n\n

How to use this training<\/h2>\n\n\n\n

This is the master Markdown teaching document<\/strong>. It includes the explanation, step-by-step instructions, mini-assignments, Mermaid diagrams, and complete code for every exercise<\/strong> below. Identical files also exist as runnable .tf<\/code>, .tfvars.example<\/code>, and .tftest.hcl<\/code> files in the accompanying ZIP.<\/p>\n\n\n\n

The course adapts the user’s prior Azure Terraform Hands-On \u2014 Part 2: Input Variables (All Six Types)<\/em> reference: AzureRM 5.9.x<\/code>, Terraform 1.15.x<\/code>, Azure eastus<\/code>, the Ubuntu 26.04 LTS image, and familiar variable terminology. It intentionally does not carry over the old Windows VM, passwords, public IP addresses or 13-resource state<\/strong>. Those were useful for teaching variable types; here they would distract from modules. The new VM labs use SSH keys and no public IP addresses.<\/p>\n\n\n\n

\n

State safety \u2014 read before running:<\/strong> Each numbered lab is a standalone root\/state snapshot<\/strong> for teaching. These are progressive code examples<\/em>, not a set of in-place upgrades to the old Azure Lab 4 deployment. Do not apply any lab folder to the state from the prior 13-resource course. Optionally apply one isolated lab, verify, terraform destroy<\/code>, and move to the next. Only the explicitly labeled Bonus Lab 12 demonstrates an in-place state-preserving move.<\/p>\n<\/blockquote>\n\n\n\n

\n

Costs and networking:<\/strong> Creating Azure VMs may incur hourly compute\/disk charges. The VM exercises use a private-only NIC and no public IP. Azure VMs can be verified in the portal or via az vm show<\/code> but cannot be SSH-accessed directly from the public internet. No private key or password is included in the ZIP.<\/p>\n<\/blockquote>\n\n\n\n

Learning outcomes<\/h2>\n\n\n\n

After completing the course, learners can explain root vs child modules; create and call a local module; pass required\/optional, validated and sensitive inputs; expose and chain outputs; reuse a VM module across instances\/environments; compose modules; select local, Git, and Registry sources; pin\/upgrade module versions; and test\/maintain modules without unnecessarily deploying cloud resources.<\/p>\n\n\n\n

Curriculum and code progression<\/h2>\n\n\n\n
Course module<\/th>Covered concepts<\/th>Progressive labs<\/th>Azure resources per applied lab<\/th><\/tr><\/thead>
1. Introduction<\/strong><\/td>Modules, root vs child, purpose and trade-offs<\/td>01<\/td>1 resource group<\/td><\/tr>
2. Your first module<\/strong><\/td>Module folder, source<\/code>, first module call, Terraform workflow<\/td>02<\/td>1 resource group<\/td><\/tr>
3. Inputs and outputs<\/strong><\/td>Required\/optional values, defaults, outputs, validation, sensitive data<\/td>03\u201304<\/td>1 resource group each<\/td><\/tr>
4. Reusability<\/strong><\/td>Linux VM module, two calls, dev\/prod, nesting\/composition<\/td>05\u201308<\/td>5 \/ 7 \/ 5 per env \/ 5 resources<\/td><\/tr>
5. Sources and versioning<\/strong><\/td>Git tag, Registry sources, version pins, Azure Verified Modules<\/td>09\u201310<\/td>Git naming: random provider; AVM: RG + VNet\/subnet + ancillary providers<\/td><\/tr>
6. Best practices<\/strong><\/td>Providers, tests, docs, design and state-safe migration<\/td>11 + Bonus 12<\/td>11: none (mock tests); 12: 1 RG<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The repository intentionally repeats a few short blocks between standalone<\/strong> labs so students can open any lab by itself. The actual Linux VM child module stays essentially identical across the VM exercises, which is the central lesson.<\/p>\n\n\n\n

Architecture at a glance<\/h2>\n\n\n\n
flowchart LR\n    Student[\"Student \/ Terraform CLI\"] --> Root[\"Root module\"]\n    Root -->|\"source + input arguments\"| Child[\"Child module\"]\n    Child -->|\"AzureRM \/ AzAPI provider\"| Azure[\"Azure resources\"]\n    Child -->|\"output values\"| Root\n    Root -->|\"display outputs\"| Student\n<\/code><\/pre>\n\n\n\n
Prerequisites \u2014 do once<\/h2>\n\n\n\n
    \n
  1. Install Terraform 1.15.x (or a compatible supported version satisfying\u00a0required_version<\/code>), Azure CLI and Git. Have an Azure subscription where you can create resource groups, networks and VMs. Check any organization policies and quotas first.<\/li>\n\n\n\n
  2. Authenticate and select the intended lab subscription:<\/li>\n<\/ol>\n\n\n\n
    terraform version\naz version\naz login\naz account set --subscription \"YOUR_SUBSCRIPTION_ID\"\nexport ARM_SUBSCRIPTION_ID=\"$(az account show --query id -o tsv)\"\n<\/code><\/pre>\n\n\n\n
      \n
    1. For VM labs 05\u201308 and each environment of Lab 07, create an SSH key\u00a0only if you do not already have one<\/strong>:<\/li>\n<\/ol>\n\n\n\n
      ls -l ~\/.ssh\/id_ed25519.pub\n# If the public key does not exist:<\/em>\nssh-keygen -t ed25519 -f ~\/.ssh\/id_ed25519\n<\/code><\/pre>\n\n\n\n
      Use a passphrase and protect ~\/.ssh\/id_ed25519<\/code>. Terraform reads only the .pub<\/code> file. Students with existing keys should not overwrite them<\/strong>.<\/p>\n\n\n\n
        \n
      1. Check the chosen Ubuntu image and VM size in your target subscription\/region. The course retains the exact image reference from the previous Azure exercise for continuity:<\/li>\n<\/ol>\n\n\n\n
        az vm image show --location eastus --urn Canonical:ubuntu-26_04-lts:server:latest\naz vm list-skus --location eastus --resource-type virtualMachines --size Standard_B2s_v2 -o table\n<\/code><\/pre>\n\n\n\n
        Availability varies by subscription, region, policy and quota. If a check fails, choose a permitted equivalent and edit the shared VM module<\/strong> deliberately rather than inventing resources. Terraform configuration can validate without guaranteeing deployment will succeed in a particular Azure subscription.<\/p>\n\n\n\n
        The repeatable student workflow<\/h2>\n\n\n\n
        Run these inside the correct root folder<\/strong>, never inside modules\/linux-vm<\/code> or another child directory:<\/p>\n\n\n\n
        terraform init\nterraform fmt -recursive\nterraform validate\nterraform plan -out=tfplan\n# Carefully check any destructive\/replacement actions before you run:<\/em>\nterraform apply tfplan\nterraform output\nterraform state list\nterraform destroy  # Only for this isolated training state, when finished<\/em>\n<\/code><\/pre>\n\n\n\n
        For labs with terraform.tfvars.example<\/code>, first copy it to terraform.tfvars<\/code> in the root<\/strong>. terraform.tfvars<\/code> auto-loads; .example<\/code> does not. For Lab 04, also set its disposable environment variable. Lab 11 prefers terraform test<\/code> rather than apply. Lab 12 documents a different, intentional state-migration procedure. terraform init -upgrade<\/code> is introduced later, not a default part of each run. Never blindly apply a plan with unexpected -\/+<\/code> replacements or resource deletion.<\/p>\n\n\n\n
        Why no PIP\/NSG in VM labs?<\/strong> Those features are already covered in the earlier Azure lessons. The point here is the module boundary. Replacing VM images or adding public SSH exposure would distract from it.<\/p>\n\n\n\n
        \n\n\n\n
        Module 1 \u2014 Introduction to Terraform Modules<\/h2>\n\n\n\n
        A Terraform module<\/strong> is a directory containing Terraform configuration files. The directory where you invoke Terraform is the root module<\/strong>; a module loaded from module { source = \"...\" }<\/code> is a child module<\/strong>. main.tf<\/code>, variables.tf<\/code>, and outputs.tf<\/code> are common conventions, not mandatory filenames<\/strong>; Terraform loads the .tf<\/code> files in one module directory together.<\/p>\n\n\n\n
        Think of a module as a small reusable building block: it accepts inputs<\/strong>, manages resources\/other modules, and exposes outputs<\/strong>. Benefits include avoiding copy-paste, setting consistent standards and making changes easier. Costs include more layers, more interfaces to maintain, version coordination and hidden complexity. A module is worthwhile when a useful boundary or reuse need exists\u2014not simply because every resource can<\/em> be wrapped in one.<\/p>\n\n\n\n
        flowchart TB\n    Root[\"root\/ (Terraform execution directory)\"]\n    Root --> Files[\"main.tf + variables.tf + outputs.tf\"]\n    Root --> Call[\"module rg (source = local path)\"]\n    Call --> Child[\"modules\/resource-group\/ (child directory)\"]\n    Child --> Actual[\"azurerm_resource_group.this\"]\n<\/code><\/pre>\n\n\n\n
        Lab 01 \u2014 Root module: no module<\/code> block yet<\/h3>\n\n\n\n
        Goal.<\/strong> Recognize that any working Terraform directory is a module, even when it only has one resource<\/code> block. Begin with the simplest possible Azure object: a resource group.<\/p>\n\n\n\n
          \n
        1. Enter\u00a0labs\/01-root-module<\/code>\u00a0and open\u00a0main.tf<\/code>.<\/li>\n\n\n\n
        2. Identify the resource\u00a0type<\/em>\u00a0azurerm_resource_group<\/code>, local label\u00a0lab<\/code>, and arguments\u00a0name<\/code>\/location<\/code>.<\/li>\n\n\n\n
        3. Run\u00a0terraform init<\/code>,\u00a0terraform validate<\/code>,\u00a0terraform plan<\/code>. Optionally apply, then run\u00a0terraform state list<\/code>.<\/li>\n\n\n\n
        4. Find the state address\u00a0azurerm_resource_group.lab<\/code>. Destroy before creating the next isolated exercise.<\/li>\n<\/ol>\n\n\n\n
          Checkpoint:<\/strong> Explain why a directory with only main.tf<\/code> and versions.tf<\/code> is called the root module<\/em>.<\/p>\n\n\n\n
          Mini-assignment:<\/strong> Rename the Terraform local label lab<\/code> to training<\/code> before applying<\/strong> and predict the changed state address; do not change an already-applied lab without assessing state effects.<\/p>\n\n\n\n
          Complete code for this lab<\/h4>\n\n\n\n
          All paths below are relative to labs\/01-root-module\/<\/code>. The ZIP contains the identical ready-to-edit files.<\/p>\n\n\n\n
          main.tf<\/code><\/strong><\/p>\n\n\n\n
          resource \"azurerm_resource_group\" \"lab\" {\n  name     = \"rg-tfmod-01\"\n  location = \"eastus\"\n}\n<\/code><\/pre>\n\n\n\n
          versions.tf<\/code><\/strong><\/p>\n\n\n\n
          terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \"~> 5.9.0\"\n    }\n  }\n}\n\nprovider \"azurerm\" {\n  features {}\n}\n<\/code><\/pre>\n\n\n\n
          Run this lab<\/h4>\n\n\n\n
          cd labs\/01-root-module\nterraform init\nterraform fmt -recursive\nterraform validate\nterraform plan\n# Optional after reviewing the plan: terraform apply<\/em>\n# When done: terraform destroy<\/em>\n<\/code><\/pre>\n\n\n\n
          \n\n\n\n
          Module 2 \u2014 Creating Your First Module<\/h2>\n\n\n\n
          A child module looks like any other Terraform directory: .tf<\/code> files, normally with resource declarations, variable declarations and outputs. The root’s module<\/code> block selects a source. Terraform obtains local\/remote modules during terraform init<\/code>, then combines the graph when planning. Module names are Terraform addresses, not Azure names.<\/p>\n\n\n\n
          Module call pattern:<\/strong><\/p>\n\n\n\n
          module \"example\" {\n  source = \".\/modules\/resource-group\"\n}\n<\/code><\/pre>\n\n\n\n
          Our first module deliberately has no variable or output yet. Those are the next<\/strong> lesson\u2014not prerequisites for making a module.<\/p>\n\n\n\n
          Lab 02 \u2014 Create your first local child module<\/h3>\n\n\n\n
          What changed from Lab 01:<\/strong> The root no longer declares the resource. It delegates to module \"rg\"<\/code>. The child directory owns the actual azurerm_resource_group<\/code> block. This is a new lab with its own state<\/strong>; it is not an in-place migration from Lab 01.<\/p>\n\n\n\n
            \n
          1. Open\u00a0main.tf<\/code>\u00a0in the root; read the tiny\u00a0module<\/code>\u00a0call and its\u00a0source<\/code>\u00a0path.<\/li>\n\n\n\n
          2. Open\u00a0modules\/resource-group\/main.tf<\/code>. This directory is the child module.<\/li>\n\n\n\n
          3. Run the standard workflow. If applied,\u00a0terraform state list<\/code>\u00a0should show\u00a0module.rg.azurerm_resource_group.this<\/code>.<\/li>\n\n\n\n
          4. Notice that the child declares\u00a0required_providers<\/code>, but\u00a0provider \"azurerm\"<\/code>\u00a0is only configured in the root.<\/li>\n<\/ol>\n\n\n\n
            Checkpoint:<\/strong> Distinguish between module.rg<\/code> (module instance) and azurerm_resource_group.this<\/code> (resource inside the module).<\/p>\n\n\n\n
            Mini-assignment:<\/strong> Count the number of Azure resources: one<\/strong>, not two.<\/p>\n\n\n\n
            Complete code for this lab<\/h4>\n\n\n\n
            All paths below are relative to labs\/02-first-child\/<\/code>. The ZIP contains the identical ready-to-edit files.<\/p>\n\n\n\n
            main.tf<\/code><\/strong><\/p>\n\n\n\n
            module \"rg\" {\n  source = \".\/modules\/resource-group\"\n}\n<\/code><\/pre>\n\n\n\n
            versions.tf<\/code><\/strong><\/p>\n\n\n\n
            terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \"~> 5.9.0\"\n    }\n  }\n}\n\nprovider \"azurerm\" {\n  features {}\n}\n<\/code><\/pre>\n\n\n\n
            modules\/resource-group\/main.tf<\/code><\/strong><\/p>\n\n\n\n
            resource \"azurerm_resource_group\" \"this\" {\n  name     = \"rg-tfmod-02\"\n  location = \"eastus\"\n}\n<\/code><\/pre>\n\n\n\n
            modules\/resource-group\/versions.tf<\/code><\/strong><\/p>\n\n\n\n
            terraform {\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \">= 5.9.0\"\n    }\n  }\n}\n<\/code><\/pre>\n\n\n\n
            Run this lab<\/h4>\n\n\n\n
            cd labs\/02-first-child\nterraform init\nterraform fmt -recursive\nterraform validate\nterraform plan\n# Optional after reviewing the plan: terraform apply<\/em>\n# When done: terraform destroy<\/em>\n<\/code><\/pre>\n\n\n\n
            \n\n\n\n
            Module 3 \u2014 Inputs, Outputs and Configuration<\/h2>\n\n\n\n
            Modules become reusable when callers choose settings without changing child resource code. An input without default<\/code> is required<\/strong>; an input with default<\/code> is optional<\/strong>. Inputs belong in the child variable<\/code> blocks; the root chooses values in its module<\/code> arguments. Child output<\/code> values are read through module.<label>.<output_name><\/code>.<\/p>\n\n\n\n
            HCL feature<\/th>Short meaning<\/th>This course<\/th><\/tr><\/thead>
            type = string<\/code><\/td>single text input<\/td>Resource group name, region<\/td><\/tr>
            type = map(string)<\/code><\/td>named text values<\/td>Optional resource tags<\/td><\/tr>
            default = ...<\/code><\/td>optional input<\/td>region and tags<\/td><\/tr>
            validation {}<\/code><\/td>reject invalid values<\/td>rg-<\/code> name prefix<\/td><\/tr>
            sensitive = true<\/code><\/td>hide normal CLI display<\/td>disposable example secret<\/td><\/tr>
            output { value = ... }<\/code><\/td>exported module result<\/td>RG name\/ID<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
            Important:<\/strong> Sensitive Terraform values may still enter state\/plan files. Use secure state storage and a real secret-management process for production. SSH public keys are not<\/em> passwords and do not need to be marked sensitive.<\/p>\n\n\n\n
            Lab 03 \u2014 Pass variables in; expose outputs out<\/h3>\n\n\n\n
            What changed:<\/strong> Lab 02 had hard-coded values inside the child. Lab 03 accepts the resource-group name and region as module inputs and returns the name and ID as outputs.<\/p>\n\n\n\n
              \n
            1. Copy\u00a0terraform.tfvars.example<\/code>\u00a0to\u00a0terraform.tfvars<\/code>. Terraform auto-loads\u00a0terraform.tfvars<\/code>\u00a0in the root<\/strong>.<\/li>\n\n\n\n
            2. Study root\u00a0var.rg_name<\/code>\u00a0and module arguments\u00a0name = var.rg_name<\/code>,\u00a0location = var.azure_region<\/code>.<\/li>\n\n\n\n
            3. Study child\u00a0variables.tf<\/code>:\u00a0name<\/code>\/location<\/code>\u00a0are required;\u00a0tags<\/code>\u00a0is optional and has a default.<\/li>\n\n\n\n
            4. Study child\u00a0outputs.tf<\/code>; root output\u00a0module.rg.id<\/code>\u00a0passes a value outside the module boundary.<\/li>\n\n\n\n
            5. Run the workflow.\u00a0After<\/strong>\u00a0applying, run\u00a0terraform output rg_name<\/code>\u00a0and\u00a0terraform output rg_id<\/code>.<\/li>\n<\/ol>\n\n\n\n
              Checkpoint:<\/strong> Root variables and child variables are different declarations; values cross the boundary through the module<\/code> block.<\/p>\n\n\n\n
              Mini-assignment:<\/strong> Change rg_name<\/code> before applying<\/em> to rg-tfmod-03-demo<\/code> and predict the output. Keep azure_region<\/code> absent to use its default.<\/p>\n\n\n\n
              Complete code for this lab<\/h4>\n\n\n\n
              All paths below are relative to labs\/03-inputs-outputs\/<\/code>. The ZIP contains the identical ready-to-edit files.<\/p>\n\n\n\n
              main.tf<\/code><\/strong><\/p>\n\n\n\n
              module \"rg\" {\n  source   = \".\/modules\/resource-group\"\n  name     = var.rg_name\n  location = var.azure_region\n}\n<\/code><\/pre>\n\n\n\n
              outputs.tf<\/code><\/strong><\/p>\n\n\n\n
              output \"rg_name\" {\n  value = module.rg.name\n}\n\noutput \"rg_id\" {\n  value = module.rg.id\n}\n<\/code><\/pre>\n\n\n\n
              terraform.tfvars.example<\/code><\/strong><\/p>\n\n\n\n
              rg_name = \"rg-tfmod-03\"\n# azure_region is optional; defaults to eastus.\n<\/code><\/pre>\n\n\n\n
              variables.tf<\/code><\/strong><\/p>\n\n\n\n
              variable \"rg_name\" {\n  type = string\n}\n\nvariable \"azure_region\" {\n  type    = string\n  default = \"eastus\"\n}\n<\/code><\/pre>\n\n\n\n
              versions.tf<\/code><\/strong><\/p>\n\n\n\n
              terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \"~> 5.9.0\"\n    }\n  }\n}\n\nprovider \"azurerm\" {\n  features {}\n}\n<\/code><\/pre>\n\n\n\n
              modules\/resource-group\/main.tf<\/code><\/strong><\/p>\n\n\n\n
              resource \"azurerm_resource_group\" \"this\" {\n  name     = var.name\n  location = var.location\n  tags     = var.tags\n}\n<\/code><\/pre>\n\n\n\n
              modules\/resource-group\/outputs.tf<\/code><\/strong><\/p>\n\n\n\n
              output \"name\" {\n  description = \"Name created by the module.\"\n  value       = azurerm_resource_group.this.name\n}\n\noutput \"id\" {\n  description = \"Azure resource group ID.\"\n  value       = azurerm_resource_group.this.id\n}\n<\/code><\/pre>\n\n\n\n
              modules\/resource-group\/variables.tf<\/code><\/strong><\/p>\n\n\n\n
              variable \"name\" {\n  description = \"Resource group name.\"\n  type        = string\n}\n\nvariable \"location\" {\n  description = \"Azure region.\"\n  type        = string\n}\n\nvariable \"tags\" {\n  description = \"Optional resource tags.\"\n  type        = map(string)\n  default     = { course = \"terraform-modules\" }\n}\n<\/code><\/pre>\n\n\n\n
              modules\/resource-group\/versions.tf<\/code><\/strong><\/p>\n\n\n\n
              terraform {\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \">= 5.9.0\"\n    }\n  }\n}\n<\/code><\/pre>\n\n\n\n
              Run this lab<\/h4>\n\n\n\n
              cd labs\/03-inputs-outputs\ncp terraform.tfvars.example terraform.tfvars\nterraform init\nterraform fmt -recursive\nterraform validate\nterraform plan\n# Optional after reviewing the plan: terraform apply<\/em>\n# When done: terraform destroy<\/em>\n<\/code><\/pre>\n\n\n\n
              \n\n\n\n
              Lab 04 \u2014 Add validation and understand sensitive outputs<\/h3>\n\n\n\n
              What changed:<\/strong> We validate rg_name<\/code> and send a disposable demonstration secret<\/strong> through a tiny child module. The Azure resource group never receives that secret.<\/p>\n\n\n\n
                \n
              1. Copy\u00a0terraform.tfvars.example<\/code>\u00a0to\u00a0terraform.tfvars<\/code>.<\/li>\n\n\n\n
              2. Set\u00a0export TF_VAR_training_secret=\"throwaway-training-value\"<\/code>\u00a0in your shell. Do not use a real password.<\/li>\n\n\n\n
              3. Observe\u00a0validation<\/code>\u00a0on\u00a0rg_name<\/code>\u00a0and\u00a0sensitive = true<\/code>\u00a0in root, child input and child output.<\/li>\n\n\n\n
              4. Run\u00a0terraform init<\/code>,\u00a0terraform validate<\/code>,\u00a0terraform plan<\/code>\u00a0and, if desired,\u00a0terraform apply<\/code>.<\/li>\n\n\n\n
              5. After apply,\u00a0terraform output<\/code>\u00a0shows\u00a0(sensitive value)<\/code>\u00a0while\u00a0terraform output -raw redacted_demo<\/code>\u00a0explicitly prints the disposable demo value<\/strong>.<\/li>\n\n\n\n
              6. Try a failed plan with\u00a0terraform plan -var='rg_name=wrong-name'<\/code>; restore the original value afterwards.<\/li>\n<\/ol>\n\n\n\n
                Checkpoint:<\/strong> Marking a value sensitive<\/code> hides default CLI rendering; it does not<\/strong> encrypt or guarantee omission from local\/remote state or saved plan files.<\/p>\n\n\n\n
                Mini-assignment:<\/strong> Explain why passing real secrets in .tfvars<\/code> committed to Git is unsafe.<\/p>\n\n\n\n
                Complete code for this lab<\/h4>\n\n\n\n
                All paths below are relative to labs\/04-validation-sensitive\/<\/code>. The ZIP contains the identical ready-to-edit files.<\/p>\n\n\n\n
                main.tf<\/code><\/strong><\/p>\n\n\n\n
                module \"rg\" {\n  source   = \".\/modules\/resource-group\"\n  name     = var.rg_name\n  location = var.azure_region\n}\n\nmodule \"secret_example\" {\n  source = \".\/modules\/secret-example\"\n  value  = var.training_secret\n}\n<\/code><\/pre>\n\n\n\n
                outputs.tf<\/code><\/strong><\/p>\n\n\n\n
                output \"rg_name\" {\n  value = module.rg.name\n}\n\noutput \"redacted_demo\" {\n  description = \"Sensitive is redacted in normal output, NOT encrypted in state.\"\n  value       = module.secret_example.value\n  sensitive   = true\n}\n<\/code><\/pre>\n\n\n\n
                terraform.tfvars.example<\/code><\/strong><\/p>\n\n\n\n
                rg_name = \"rg-tfmod-04\"\n<\/code><\/pre>\n\n\n\n
                variables.tf<\/code><\/strong><\/p>\n\n\n\n
                variable \"rg_name\" {\n  type = string\n\n  validation {\n    condition     = startswith(var.rg_name, \"rg-\")\n    error_message = \"The resource group name must start with rg-.\"\n  }\n}\n\nvariable \"azure_region\" {\n  type    = string\n  default = \"eastus\"\n}\n\nvariable \"training_secret\" {\n  description = \"Disposable demo-only text; never use a real password.\"\n  type        = string\n  sensitive   = true\n}\n<\/code><\/pre>\n\n\n\n
                versions.tf<\/code><\/strong><\/p>\n\n\n\n
                terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \"~> 5.9.0\"\n    }\n  }\n}\n\nprovider \"azurerm\" {\n  features {}\n}\n<\/code><\/pre>\n\n\n\n
                modules\/resource-group\/main.tf<\/code><\/strong><\/p>\n\n\n\n
                resource \"azurerm_resource_group\" \"this\" {\n  name     = var.name\n  location = var.location\n  tags     = var.tags\n}\n<\/code><\/pre>\n\n\n\n
                modules\/resource-group\/outputs.tf<\/code><\/strong><\/p>\n\n\n\n
                output \"name\" {\n  description = \"Name created by the module.\"\n  value       = azurerm_resource_group.this.name\n}\n\noutput \"id\" {\n  description = \"Azure resource group ID.\"\n  value       = azurerm_resource_group.this.id\n}\n<\/code><\/pre>\n\n\n\n
                modules\/resource-group\/variables.tf<\/code><\/strong><\/p>\n\n\n\n
                variable \"name\" {\n  description = \"Resource group name.\"\n  type        = string\n  validation {\n    condition     = startswith(var.name, \"rg-\")\n    error_message = \"Resource group names in this course must start with rg-.\"\n  }\n}\n\nvariable \"location\" {\n  description = \"Azure region.\"\n  type        = string\n}\n\nvariable \"tags\" {\n  description = \"Optional resource tags.\"\n  type        = map(string)\n  default     = { course = \"terraform-modules\" }\n}\n<\/code><\/pre>\n\n\n\n
                modules\/resource-group\/versions.tf<\/code><\/strong><\/p>\n\n\n\n
                terraform {\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \">= 5.9.0\"\n    }\n  }\n}\n<\/code><\/pre>\n\n\n\n
                modules\/secret-example\/outputs.tf<\/code><\/strong><\/p>\n\n\n\n
                output \"value\" {\n  value     = var.value\n  sensitive = true\n}\n<\/code><\/pre>\n\n\n\n
                modules\/secret-example\/variables.tf<\/code><\/strong><\/p>\n\n\n\n
                variable \"value\" {\n  type      = string\n  sensitive = true\n}\n<\/code><\/pre>\n\n\n\n
                Run and validate the sensitive-value demo<\/h4>\n\n\n\n
                cd labs\/04-validation-sensitive\ncp terraform.tfvars.example terraform.tfvars\nexport TF_VAR_training_secret=\"throwaway-training-value\"\nterraform init && terraform validate && terraform plan\n# After optional terraform apply:<\/em>\nterraform output redacted_demo\nterraform output -raw redacted_demo # Explicitly prints ONLY disposable demo data.<\/em>\n<\/code><\/pre>\n\n\n\n
                \n\n\n\n
                Module 4 \u2014 Reusable Modules in Practice<\/h2>\n\n\n\n
                This module uses a tiny, realistic Ubuntu Linux VM child module: one network interface plus one VM<\/strong>. All required Azure networking is provisioned in the calling root or in a separate small network<\/code> module. In the first exercise, resource_group + VNet + subnet = 3<\/code> root resources, and NIC + VM = 2<\/code> child resources. We reuse the exact same child design, first twice, then across two roots, and finally as a submodule of a stack.<\/p>\n\n\n\n
                flowchart LR\n    Root[\"Root module\"] --> RG[\"Azure Resource Group\"]\n    Root --> VNET[\"VNet + Subnet\"]\n    Root --> VMCall[\"module.linux_vm\"]\n    VNET -->|\"subnet_id\"| VMCall\n    RG -->|\"name\/location\"| VMCall\n    VMCall --> NIC[\"NIC\"]\n    VMCall --> VM[\"Ubuntu VM (private only)\"]\n    NIC --> VM\n<\/code><\/pre>\n\n\n\n
                Resource outputs passed as arguments create implicit Terraform dependencies. There is no need to introduce explicit depends_on<\/code> for the simple examples.<\/p>\n\n\n\n
                Lab 05 \u2014 Build your own reusable Ubuntu VM module<\/h3>\n\n\n\n
                What changed:<\/strong> We graduate from a one-resource module to a practical, two-resource<\/strong> Linux VM module. The root owns the prerequisite resource group, VNet and subnet; the child owns only the NIC and VM.<\/p>\n\n\n\n
                  \n
                1. Create an Ed25519 SSH key if\u00a0~\/.ssh\/id_ed25519.pub<\/code>\u00a0does not exist (setup section). The module consumes its\u00a0public<\/strong>\u00a0key, not your private key.<\/li>\n\n\n\n
                2. Open\u00a0main.tf<\/code>: find three root resource blocks, then one module call with the subnet ID and public key.<\/li>\n\n\n\n
                3. Open\u00a0modules\/linux-vm\/main.tf<\/code>: count the two resources (NIC and Linux VM). The Ubuntu image matches the uploaded previous lab’s 26.04 LTS image reference.<\/li>\n\n\n\n
                4. Run\u00a0terraform init<\/code>,\u00a0terraform validate<\/code>,\u00a0terraform plan<\/code>; inspect the five total resources. Apply only if subscription quota\/image availability are confirmed.<\/li>\n\n\n\n
                5. After apply, run\u00a0terraform output private_ip<\/code>, then\u00a0az vm show -g rg-tfmod-05 -n vm-tfmod-05 --query provisioningState -o tsv<\/code>.<\/li>\n<\/ol>\n\n\n\n
                  Checkpoint:<\/strong> This VM has no public IP<\/strong>. A private IP is not directly SSH-reachable from the public internet. Connecting requires an approved private path (VPN\/Bastion\/private network), deliberately outside module basics.<\/p>\n\n\n\n
                  Mini-assignment:<\/strong> Change the module argument vm_size<\/code> via the root variable and read the plan before<\/strong> applying.<\/p>\n\n\n\n
                  Complete code for this lab<\/h4>\n\n\n\n
                  All paths below are relative to labs\/05-linux-vm\/<\/code>. The ZIP contains the identical ready-to-edit files.<\/p>\n\n\n\n
                  main.tf<\/code><\/strong><\/p>\n\n\n\n
                  resource \"azurerm_resource_group\" \"lab\" {\n  name     = \"rg-tfmod-05\"\n  location = var.azure_region\n}\n\nresource \"azurerm_virtual_network\" \"lab\" {\n  name                = \"vnet-tfmod-05\"\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  address_space       = [\"10.50.0.0\/16\"]\n}\n\nresource \"azurerm_subnet\" \"vm\" {\n  name                 = \"snet-vm\"\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n  address_prefixes     = [\"10.50.1.0\/24\"]\n}\n\nmodule \"linux_vm\" {\n  source              = \".\/modules\/linux-vm\"\n  name                = \"vm-tfmod-05\"\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  subnet_id           = azurerm_subnet.vm.id\n  ssh_public_key      = file(pathexpand(\"~\/.ssh\/id_ed25519.pub\"))\n  vm_size             = var.vm_size\n}\n<\/code><\/pre>\n\n\n\n
                  outputs.tf<\/code><\/strong><\/p>\n\n\n\n
                  output \"vm_id\" {\n  value = module.linux_vm.vm_id\n}\n\noutput \"private_ip\" {\n  value = module.linux_vm.private_ip\n}\n<\/code><\/pre>\n\n\n\n
                  variables.tf<\/code><\/strong><\/p>\n\n\n\n
                  variable \"azure_region\" {\n  type    = string\n  default = \"eastus\"\n}\n\nvariable \"vm_size\" {\n  type    = string\n  default = \"Standard_B2s_v2\"\n}\n<\/code><\/pre>\n\n\n\n
                  versions.tf<\/code><\/strong><\/p>\n\n\n\n
                  terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \"~> 5.9.0\"\n    }\n  }\n}\n\nprovider \"azurerm\" {\n  features {}\n}\n<\/code><\/pre>\n\n\n\n
                  modules\/linux-vm\/main.tf<\/code><\/strong><\/p>\n\n\n\n
                  resource \"azurerm_network_interface\" \"this\" {\n  name                = \"nic-${var.name}\"\n  location            = var.location\n  resource_group_name = var.resource_group_name\n\n  ip_configuration {\n    name                          = \"internal\"\n    subnet_id                     = var.subnet_id\n    private_ip_address_allocation = \"Dynamic\"\n  }\n}\n\nresource \"azurerm_linux_virtual_machine\" \"this\" {\n  name                = var.name\n  location            = var.location\n  resource_group_name = var.resource_group_name\n  size                  = var.vm_size\n  admin_username        = var.admin_username\n  network_interface_ids = [azurerm_network_interface.this.id]\n\n  admin_ssh_key {\n    username   = var.admin_username\n    public_key = var.ssh_public_key\n  }\n\n  os_disk {\n    caching              = \"ReadWrite\"\n    storage_account_type = \"Standard_LRS\"\n  }\n\n  source_image_reference {\n    publisher = \"Canonical\"\n    offer     = \"ubuntu-26_04-lts\"\n    sku       = \"server\"\n    version   = \"latest\"\n  }\n}\n<\/code><\/pre>\n\n\n\n
                  modules\/linux-vm\/outputs.tf<\/code><\/strong><\/p>\n\n\n\n
                  output \"vm_id\" {\n  value = azurerm_linux_virtual_machine.this.id\n}\n\noutput \"vm_name\" {\n  value = azurerm_linux_virtual_machine.this.name\n}\n\noutput \"private_ip\" {\n  value = azurerm_network_interface.this.private_ip_address\n}\n<\/code><\/pre>\n\n\n\n
                  modules\/linux-vm\/variables.tf<\/code><\/strong><\/p>\n\n\n\n
                  variable \"name\"                { type = string }\nvariable \"location\"            { type = string }\nvariable \"resource_group_name\" { type = string }\nvariable \"subnet_id\"           { type = string }\nvariable \"ssh_public_key\"      { type = string }\n\nvariable \"vm_size\" {\n  type    = string\n  default = \"Standard_B2s_v2\"\n}\n\nvariable \"admin_username\" {\n  type    = string\n  default = \"labadmin\"\n}\n<\/code><\/pre>\n\n\n\n
                  modules\/linux-vm\/versions.tf<\/code><\/strong><\/p>\n\n\n\n
                  terraform {\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \">= 5.9.0\"\n    }\n  }\n}\n<\/code><\/pre>\n\n\n\n
                  Run this lab<\/h4>\n\n\n\n
                  cd labs\/05-linux-vm\nterraform init\nterraform fmt -recursive\nterraform validate\nterraform plan\n# Optional after reviewing the plan: terraform apply<\/em>\n# When done: terraform destroy<\/em>\n<\/code><\/pre>\n\n\n\n
                  \n\n\n\n
                  Lab 06 \u2014 Reuse the same module with two different instances<\/h3>\n\n\n\n
                  What changed:<\/strong> Instead of writing a second VM resource and NIC resource manually, the root calls .\/modules\/linux-vm<\/code> twice as module.app<\/code> and module.worker<\/code>.<\/p>\n\n\n\n
                    \n
                  1. Compare Lab 05 and Lab 06. The child module stays the same; only two independent module calls and root outputs change.<\/li>\n\n\n\n
                  2. Run the workflow, and check that the plan creates three shared network resources plus two resources inside\u00a0each<\/strong>\u00a0VM module:\u00a0seven Azure resources<\/strong>\u00a0total.<\/li>\n\n\n\n
                  3. After apply, run\u00a0terraform output vm_names<\/code>\u00a0and\u00a0terraform output private_ips<\/code>.<\/li>\n\n\n\n
                  4. Check state addresses under\u00a0module.app.*<\/code>\u00a0and\u00a0module.worker.*<\/code>.<\/li>\n<\/ol>\n\n\n\n
                    Checkpoint:<\/strong> Two module instances<\/em> can reuse identical source code while owning separate state addresses and distinct Azure objects.<\/p>\n\n\n\n
                    Mini-assignment:<\/strong> Predict the effect of accidentally using the same Azure VM name for both module instances within the same resource group. This is an Azure naming conflict, not a Terraform-module limitation.<\/p>\n\n\n\n
                    Cost note:<\/strong> This lab creates two VMs. Skip apply if you only want to study the module concept; destroy when finished.<\/p>\n\n\n\n
                    Complete code for this lab<\/h4>\n\n\n\n
                    All paths below are relative to labs\/06-two-vms\/<\/code>. The ZIP contains the identical ready-to-edit files.<\/p>\n\n\n\n
                    main.tf<\/code><\/strong><\/p>\n\n\n\n
                    resource \"azurerm_resource_group\" \"lab\" {\n  name     = \"rg-tfmod-06\"\n  location = var.azure_region\n}\n\nresource \"azurerm_virtual_network\" \"lab\" {\n  name                = \"vnet-tfmod-06\"\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  address_space       = [\"10.60.0.0\/16\"]\n}\n\nresource \"azurerm_subnet\" \"vm\" {\n  name                 = \"snet-vm\"\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n  address_prefixes     = [\"10.60.1.0\/24\"]\n}\n\nmodule \"app\" {\n  source              = \".\/modules\/linux-vm\"\n  name                = \"vm-tfmod-06-app\"\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  subnet_id           = azurerm_subnet.vm.id\n  ssh_public_key      = file(pathexpand(\"~\/.ssh\/id_ed25519.pub\"))\n  vm_size             = var.vm_size\n}\n\nmodule \"worker\" {\n  source              = \".\/modules\/linux-vm\"\n  name                = \"vm-tfmod-06-worker\"\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  subnet_id           = azurerm_subnet.vm.id\n  ssh_public_key      = file(pathexpand(\"~\/.ssh\/id_ed25519.pub\"))\n  vm_size             = var.vm_size\n}\n<\/code><\/pre>\n\n\n\n
                    outputs.tf<\/code><\/strong><\/p>\n\n\n\n
                    output \"vm_names\" {\n  value = [module.app.vm_name, module.worker.vm_name]\n}\n\noutput \"private_ips\" {\n  value = [module.app.private_ip, module.worker.private_ip]\n}\n<\/code><\/pre>\n\n\n\n
                    variables.tf<\/code><\/strong><\/p>\n\n\n\n
                    variable \"azure_region\" {\n  type    = string\n  default = \"eastus\"\n}\n\nvariable \"vm_size\" {\n  type    = string\n  default = \"Standard_B2s_v2\"\n}\n<\/code><\/pre>\n\n\n\n
                    versions.tf<\/code><\/strong><\/p>\n\n\n\n
                    terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \"~> 5.9.0\"\n    }\n  }\n}\n\nprovider \"azurerm\" {\n  features {}\n}\n<\/code><\/pre>\n\n\n\n
                    modules\/linux-vm\/main.tf<\/code><\/strong><\/p>\n\n\n\n
                    resource \"azurerm_network_interface\" \"this\" {\n  name                = \"nic-${var.name}\"\n  location            = var.location\n  resource_group_name = var.resource_group_name\n\n  ip_configuration {\n    name                          = \"internal\"\n    subnet_id                     = var.subnet_id\n    private_ip_address_allocation = \"Dynamic\"\n  }\n}\n\nresource \"azurerm_linux_virtual_machine\" \"this\" {\n  name                = var.name\n  location            = var.location\n  resource_group_name = var.resource_group_name\n  size                  = var.vm_size\n  admin_username        = var.admin_username\n  network_interface_ids = [azurerm_network_interface.this.id]\n\n  admin_ssh_key {\n    username   = var.admin_username\n    public_key = var.ssh_public_key\n  }\n\n  os_disk {\n    caching              = \"ReadWrite\"\n    storage_account_type = \"Standard_LRS\"\n  }\n\n  source_image_reference {\n    publisher = \"Canonical\"\n    offer     = \"ubuntu-26_04-lts\"\n    sku       = \"server\"\n    version   = \"latest\"\n  }\n}\n<\/code><\/pre>\n\n\n\n
                    modules\/linux-vm\/outputs.tf<\/code><\/strong><\/p>\n\n\n\n
                    output \"vm_id\" {\n  value = azurerm_linux_virtual_machine.this.id\n}\n\noutput \"vm_name\" {\n  value = azurerm_linux_virtual_machine.this.name\n}\n\noutput \"private_ip\" {\n  value = azurerm_network_interface.this.private_ip_address\n}\n<\/code><\/pre>\n\n\n\n
                    modules\/linux-vm\/variables.tf<\/code><\/strong><\/p>\n\n\n\n
                    variable \"name\"                { type = string }\nvariable \"location\"            { type = string }\nvariable \"resource_group_name\" { type = string }\nvariable \"subnet_id\"           { type = string }\nvariable \"ssh_public_key\"      { type = string }\n\nvariable \"vm_size\" {\n  type    = string\n  default = \"Standard_B2s_v2\"\n}\n\nvariable \"admin_username\" {\n  type    = string\n  default = \"labadmin\"\n}\n<\/code><\/pre>\n\n\n\n
                    modules\/linux-vm\/versions.tf<\/code><\/strong><\/p>\n\n\n\n
                    terraform {\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \">= 5.9.0\"\n    }\n  }\n}\n<\/code><\/pre>\n\n\n\n
                    Run this lab<\/h4>\n\n\n\n
                    cd labs\/06-two-vms\nterraform init\nterraform fmt -recursive\nterraform validate\nterraform plan\n# Optional after reviewing the plan: terraform apply<\/em>\n# When done: terraform destroy<\/em>\n<\/code><\/pre>\n\n\n\n
                    \n\n\n\n
                    Lab 07 \u2014 Use one child module from dev and prod roots<\/h3>\n\n\n\n
                    What changed:<\/strong> One shared module under labs\/07-environments\/modules\/linux-vm<\/code> serves two root configurations<\/strong>, environments\/dev<\/code> and environments\/prod<\/code>. Each root has its own terraform.tfvars<\/code>, Terraform state and naming\/CIDR values.<\/p>\n\n\n\n
                      \n
                    1. Start in\u00a0labs\/07-environments\/environments\/dev<\/code>\u00a0and copy\u00a0terraform.tfvars.example<\/code>\u00a0to\u00a0terraform.tfvars<\/code>.<\/li>\n\n\n\n
                    2. Run the standard workflow\u00a0from dev\/<\/strong>; observe\u00a0rg-tfmod-dev<\/code>\u00a0and\u00a0vm-tfmod-dev<\/code>.<\/li>\n\n\n\n
                    3. Independently change into\u00a0..\/prod<\/code>; copy its\u00a0.example<\/code>\u00a0file and run its own\u00a0init<\/code>\u00a0and\u00a0plan<\/code>.<\/li>\n\n\n\n
                    4. Compare the distinct environment names, address spaces, module\u00a0source = \"..\/..\/modules\/linux-vm\"<\/code>, and separate state paths.<\/li>\n\n\n\n
                    5. If you applied either root, destroy\u00a0that root<\/strong>\u00a0individually. Do not run Terraform from\u00a0labs\/07-environments\/<\/code>\u00a0itself.<\/li>\n<\/ol>\n\n\n\n
                      Checkpoint:<\/strong> Changing one .tfvars<\/code> value in a single shared root\/state<\/em> does not give you isolated dev\/prod environments. It typically changes\/replaces what that state already manages.<\/p>\n\n\n\n
                      Mini-assignment:<\/strong> Set a different vm_size<\/code> in the prod root’s .tfvars<\/code> and confirm only its plan reflects the difference.<\/p>\n\n\n\n
                      Production note:<\/strong> The prod<\/code> folder is a teaching simulation<\/strong>, not a production-grade security\/HA deployment.<\/p>\n\n\n\n
                      Complete code for this lab<\/h4>\n\n\n\n
                      All paths below are relative to labs\/07-environments\/<\/code>. The ZIP contains the identical ready-to-edit files.<\/p>\n\n\n\n
                      environments\/dev\/main.tf<\/code><\/strong><\/p>\n\n\n\n
                      resource \"azurerm_resource_group\" \"lab\" {\n  name     = \"rg-tfmod-${var.environment}\"\n  location = var.azure_region\n}\n\nresource \"azurerm_virtual_network\" \"lab\" {\n  name                = \"vnet-tfmod-${var.environment}\"\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  address_space       = [var.vnet_cidr]\n}\n\nresource \"azurerm_subnet\" \"vm\" {\n  name                 = \"snet-vm\"\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n  address_prefixes     = [var.subnet_cidr]\n}\n\nmodule \"linux_vm\" {\n  source              = \"..\/..\/modules\/linux-vm\"\n  name                = \"vm-tfmod-${var.environment}\"\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  subnet_id           = azurerm_subnet.vm.id\n  ssh_public_key      = file(pathexpand(\"~\/.ssh\/id_ed25519.pub\"))\n  vm_size             = var.vm_size\n}\n<\/code><\/pre>\n\n\n\n
                      environments\/dev\/outputs.tf<\/code><\/strong><\/p>\n\n\n\n
                      output \"vm_name\" {\n  value = module.linux_vm.vm_name\n}\n<\/code><\/pre>\n\n\n\n
                      environments\/dev\/terraform.tfvars.example<\/code><\/strong><\/p>\n\n\n\n
                      environment = \"dev\"\nazure_region = \"eastus\"\nvm_size      = \"Standard_B2s_v2\"\nvnet_cidr    = \"10.70.0.0\/16\"\nsubnet_cidr  = \"10.70.1.0\/24\"\n<\/code><\/pre>\n\n\n\n
                      environments\/dev\/variables.tf<\/code><\/strong><\/p>\n\n\n\n
                      variable \"environment\" { type = string }\nvariable \"azure_region\" { type = string }\nvariable \"vm_size\"     { type = string }\nvariable \"vnet_cidr\"   { type = string }\nvariable \"subnet_cidr\" { type = string }\n<\/code><\/pre>\n\n\n\n
                      environments\/dev\/versions.tf<\/code><\/strong><\/p>\n\n\n\n
                      terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \"~> 5.9.0\"\n    }\n  }\n}\n\nprovider \"azurerm\" {\n  features {}\n}\n<\/code><\/pre>\n\n\n\n
                      environments\/prod\/main.tf<\/code><\/strong><\/p>\n\n\n\n
                      resource \"azurerm_resource_group\" \"lab\" {\n  name     = \"rg-tfmod-${var.environment}\"\n  location = var.azure_region\n}\n\nresource \"azurerm_virtual_network\" \"lab\" {\n  name                = \"vnet-tfmod-${var.environment}\"\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  address_space       = [var.vnet_cidr]\n}\n\nresource \"azurerm_subnet\" \"vm\" {\n  name                 = \"snet-vm\"\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n  address_prefixes     = [var.subnet_cidr]\n}\n\nmodule \"linux_vm\" {\n  source              = \"..\/..\/modules\/linux-vm\"\n  name                = \"vm-tfmod-${var.environment}\"\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  subnet_id           = azurerm_subnet.vm.id\n  ssh_public_key      = file(pathexpand(\"~\/.ssh\/id_ed25519.pub\"))\n  vm_size             = var.vm_size\n}\n<\/code><\/pre>\n\n\n\n
                      environments\/prod\/outputs.tf<\/code><\/strong><\/p>\n\n\n\n
                      output \"vm_name\" {\n  value = module.linux_vm.vm_name\n}\n<\/code><\/pre>\n\n\n\n
                      environments\/prod\/terraform.tfvars.example<\/code><\/strong><\/p>\n\n\n\n
                      environment = \"prod\"\nazure_region = \"eastus\"\nvm_size      = \"Standard_B2s_v2\"\nvnet_cidr    = \"10.80.0.0\/16\"\nsubnet_cidr  = \"10.80.1.0\/24\"\n<\/code><\/pre>\n\n\n\n
                      environments\/prod\/variables.tf<\/code><\/strong><\/p>\n\n\n\n
                      variable \"environment\" { type = string }\nvariable \"azure_region\" { type = string }\nvariable \"vm_size\"     { type = string }\nvariable \"vnet_cidr\"   { type = string }\nvariable \"subnet_cidr\" { type = string }\n<\/code><\/pre>\n\n\n\n
                      environments\/prod\/versions.tf<\/code><\/strong><\/p>\n\n\n\n
                      terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \"~> 5.9.0\"\n    }\n  }\n}\n\nprovider \"azurerm\" {\n  features {}\n}\n<\/code><\/pre>\n\n\n\n
                      modules\/linux-vm\/main.tf<\/code><\/strong><\/p>\n\n\n\n
                      resource \"azurerm_network_interface\" \"this\" {\n  name                = \"nic-${var.name}\"\n  location            = var.location\n  resource_group_name = var.resource_group_name\n\n  ip_configuration {\n    name                          = \"internal\"\n    subnet_id                     = var.subnet_id\n    private_ip_address_allocation = \"Dynamic\"\n  }\n}\n\nresource \"azurerm_linux_virtual_machine\" \"this\" {\n  name                = var.name\n  location            = var.location\n  resource_group_name = var.resource_group_name\n  size                  = var.vm_size\n  admin_username        = var.admin_username\n  network_interface_ids = [azurerm_network_interface.this.id]\n\n  admin_ssh_key {\n    username   = var.admin_username\n    public_key = var.ssh_public_key\n  }\n\n  os_disk {\n    caching              = \"ReadWrite\"\n    storage_account_type = \"Standard_LRS\"\n  }\n\n  source_image_reference {\n    publisher = \"Canonical\"\n    offer     = \"ubuntu-26_04-lts\"\n    sku       = \"server\"\n    version   = \"latest\"\n  }\n}\n<\/code><\/pre>\n\n\n\n
                      modules\/linux-vm\/outputs.tf<\/code><\/strong><\/p>\n\n\n\n
                      output \"vm_id\" {\n  value = azurerm_linux_virtual_machine.this.id\n}\n\noutput \"vm_name\" {\n  value = azurerm_linux_virtual_machine.this.name\n}\n\noutput \"private_ip\" {\n  value = azurerm_network_interface.this.private_ip_address\n}\n<\/code><\/pre>\n\n\n\n
                      modules\/linux-vm\/variables.tf<\/code><\/strong><\/p>\n\n\n\n
                      variable \"name\"                { type = string }\nvariable \"location\"            { type = string }\nvariable \"resource_group_name\" { type = string }\nvariable \"subnet_id\"           { type = string }\nvariable \"ssh_public_key\"      { type = string }\n\nvariable \"vm_size\" {\n  type    = string\n  default = \"Standard_B2s_v2\"\n}\n\nvariable \"admin_username\" {\n  type    = string\n  default = \"labadmin\"\n}\n<\/code><\/pre>\n\n\n\n
                      modules\/linux-vm\/versions.tf<\/code><\/strong><\/p>\n\n\n\n
                      terraform {\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \">= 5.9.0\"\n    }\n  }\n}\n<\/code><\/pre>\n\n\n\n
                      Run each environment independently<\/h4>\n\n\n\n
                      cd labs\/07-environments\/environments\/dev\ncp terraform.tfvars.example terraform.tfvars\nterraform init && terraform validate && terraform plan\n# Optional: terraform apply, then terraform output vm_name; terraform destroy<\/em>\ncd ..\/prod\ncp terraform.tfvars.example terraform.tfvars\nterraform init && terraform validate && terraform plan\n<\/code><\/pre>\n\n\n\n
                      \n\n\n\n
                      Lab 08 \u2014 Compose a stack module from two child modules<\/h3>\n\n\n\n
                      What changed:<\/strong> The root calls only module \"stack\"<\/code>. Inside modules\/stack<\/code>, the stack calls module \"network\"<\/code> and module \"linux_vm\"<\/code>. The network output subnet_id<\/code> becomes an input to the VM child.<\/p>\n\n\n\n
                        \n
                      1. Read root\u00a0main.tf<\/code>: one top-level\u00a0module \"stack\"<\/code>\u00a0call.<\/li>\n\n\n\n
                      2. Read\u00a0modules\/stack\/main.tf<\/code>. Find\u00a0module.network.subnet_id<\/code>\u00a0passed as\u00a0subnet_id<\/code>\u00a0to\u00a0module.linux_vm<\/code>.<\/li>\n\n\n\n
                      3. Trace the actual Azure resources in\u00a0modules\/network<\/code>\u00a0(RG, VNet, subnet) and\u00a0modules\/linux-vm<\/code>\u00a0(NIC, VM).<\/li>\n\n\n\n
                      4. Run\u00a0terraform init<\/code>,\u00a0terraform validate<\/code>,\u00a0terraform plan<\/code>\u00a0and inspect module nesting in the plan.<\/li>\n\n\n\n
                      5. Optionally apply and run\u00a0terraform output vm_name<\/code>.<\/li>\n<\/ol>\n\n\n\n
                        Checkpoint:<\/strong> The path module.stack.module.linux_vm.azurerm_linux_virtual_machine.this<\/code> is one resource within a composed module tree.<\/p>\n\n\n\n
                        Mini-assignment:<\/strong> Without changing the VM module, explain how a second stack could receive a different project<\/code> argument.<\/p>\n\n\n\n
                        Complete code for this lab<\/h4>\n\n\n\n
                        All paths below are relative to labs\/08-composition\/<\/code>. The ZIP contains the identical ready-to-edit files.<\/p>\n\n\n\n
                        main.tf<\/code><\/strong><\/p>\n\n\n\n
                        module \"stack\" {\n  source         = \".\/modules\/stack\"\n  project        = \"tfmod-08\"\n  location       = \"eastus\"\n  ssh_public_key = file(pathexpand(\"~\/.ssh\/id_ed25519.pub\"))\n}\n<\/code><\/pre>\n\n\n\n
                        outputs.tf<\/code><\/strong><\/p>\n\n\n\n
                        output \"vm_name\" {\n  value = module.stack.vm_name\n}\n\noutput \"resource_group_name\" {\n  value = module.stack.resource_group_name\n}\n<\/code><\/pre>\n\n\n\n
                        versions.tf<\/code><\/strong><\/p>\n\n\n\n
                        terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \"~> 5.9.0\"\n    }\n  }\n}\n\nprovider \"azurerm\" {\n  features {}\n}\n<\/code><\/pre>\n\n\n\n
                        modules\/linux-vm\/main.tf<\/code><\/strong><\/p>\n\n\n\n
                        resource \"azurerm_network_interface\" \"this\" {\n  name                = \"nic-${var.name}\"\n  location            = var.location\n  resource_group_name = var.resource_group_name\n\n  ip_configuration {\n    name                          = \"internal\"\n    subnet_id                     = var.subnet_id\n    private_ip_address_allocation = \"Dynamic\"\n  }\n}\n\nresource \"azurerm_linux_virtual_machine\" \"this\" {\n  name                = var.name\n  location            = var.location\n  resource_group_name = var.resource_group_name\n  size                  = var.vm_size\n  admin_username        = var.admin_username\n  network_interface_ids = [azurerm_network_interface.this.id]\n\n  admin_ssh_key {\n    username   = var.admin_username\n    public_key = var.ssh_public_key\n  }\n\n  os_disk {\n    caching              = \"ReadWrite\"\n    storage_account_type = \"Standard_LRS\"\n  }\n\n  source_image_reference {\n    publisher = \"Canonical\"\n    offer     = \"ubuntu-26_04-lts\"\n    sku       = \"server\"\n    version   = \"latest\"\n  }\n}\n<\/code><\/pre>\n\n\n\n
                        modules\/linux-vm\/outputs.tf<\/code><\/strong><\/p>\n\n\n\n
                        output \"vm_id\" {\n  value = azurerm_linux_virtual_machine.this.id\n}\n\noutput \"vm_name\" {\n  value = azurerm_linux_virtual_machine.this.name\n}\n\noutput \"private_ip\" {\n  value = azurerm_network_interface.this.private_ip_address\n}\n<\/code><\/pre>\n\n\n\n
                        modules\/linux-vm\/variables.tf<\/code><\/strong><\/p>\n\n\n\n
                        variable \"name\"                { type = string }\nvariable \"location\"            { type = string }\nvariable \"resource_group_name\" { type = string }\nvariable \"subnet_id\"           { type = string }\nvariable \"ssh_public_key\"      { type = string }\n\nvariable \"vm_size\" {\n  type    = string\n  default = \"Standard_B2s_v2\"\n}\n\nvariable \"admin_username\" {\n  type    = string\n  default = \"labadmin\"\n}\n<\/code><\/pre>\n\n\n\n
                        modules\/linux-vm\/versions.tf<\/code><\/strong><\/p>\n\n\n\n
                        terraform {\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \">= 5.9.0\"\n    }\n  }\n}\n<\/code><\/pre>\n\n\n\n
                        modules\/network\/main.tf<\/code><\/strong><\/p>\n\n\n\n
                        resource \"azurerm_resource_group\" \"this\" {\n  name     = \"rg-${var.project}\"\n  location = var.location\n}\n\nresource \"azurerm_virtual_network\" \"this\" {\n  name                = \"vnet-${var.project}\"\n  location            = var.location\n  resource_group_name = azurerm_resource_group.this.name\n  address_space       = [\"10.88.0.0\/16\"]\n}\n\nresource \"azurerm_subnet\" \"this\" {\n  name                 = \"snet-vm\"\n  resource_group_name  = azurerm_resource_group.this.name\n  virtual_network_name = azurerm_virtual_network.this.name\n  address_prefixes     = [\"10.88.1.0\/24\"]\n}\n<\/code><\/pre>\n\n\n\n
                        modules\/network\/outputs.tf<\/code><\/strong><\/p>\n\n\n\n
                        output \"resource_group_name\" {\n  value = azurerm_resource_group.this.name\n}\n\noutput \"subnet_id\" {\n  value = azurerm_subnet.this.id\n}\n<\/code><\/pre>\n\n\n\n
                        modules\/network\/variables.tf<\/code><\/strong><\/p>\n\n\n\n
                        variable \"project\"  { type = string }\nvariable \"location\" { type = string }\n<\/code><\/pre>\n\n\n\n
                        modules\/network\/versions.tf<\/code><\/strong><\/p>\n\n\n\n
                        terraform {\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \">= 5.9.0\"\n    }\n  }\n}\n<\/code><\/pre>\n\n\n\n
                        modules\/stack\/main.tf<\/code><\/strong><\/p>\n\n\n\n
                        module \"network\" {\n  source   = \"..\/network\"\n  project  = var.project\n  location = var.location\n}\n\nmodule \"linux_vm\" {\n  source              = \"..\/linux-vm\"\n  name                = \"vm-${var.project}\"\n  location            = var.location\n  resource_group_name = module.network.resource_group_name\n  subnet_id           = module.network.subnet_id\n  ssh_public_key      = var.ssh_public_key\n}\n<\/code><\/pre>\n\n\n\n
                        modules\/stack\/outputs.tf<\/code><\/strong><\/p>\n\n\n\n
                        output \"vm_name\" {\n  value = module.linux_vm.vm_name\n}\n\noutput \"resource_group_name\" {\n  value = module.network.resource_group_name\n}\n<\/code><\/pre>\n\n\n\n
                        modules\/stack\/variables.tf<\/code><\/strong><\/p>\n\n\n\n
                        variable \"project\"        { type = string }\nvariable \"location\"       { type = string }\nvariable \"ssh_public_key\" { type = string }\n<\/code><\/pre>\n\n\n\n
                        Run this lab<\/h4>\n\n\n\n
                        cd labs\/08-composition\nterraform init\nterraform fmt -recursive\nterraform validate\nterraform plan\n# Optional after reviewing the plan: terraform apply<\/em>\n# When done: terraform destroy<\/em>\n<\/code><\/pre>\n\n\n\n
                        \n\n\n\n
                        Module 5 \u2014 Module Sources and Versioning<\/h2>\n\n\n\n
                        Terraform can load a module from a local directory<\/strong>, a Git URL<\/strong> or the Terraform Registry<\/strong>. Local paths begin with .\/<\/code> or ..\/<\/code>; Git sources use git::...<\/code> and typically select a tag\/commit via ?ref=<\/code>; Registry sources use namespace\/name\/provider<\/code> and support a separate version<\/code> argument.<\/p>\n\n\n\n
                        Source<\/th>Example<\/th>How to select a release<\/th><\/tr><\/thead>
                        Local<\/td>.\/modules\/linux-vm<\/code><\/td>Files are part of the same repository\/working tree<\/td><\/tr>
                        Git<\/td>git::https:\/\/...repo.git?ref=0.4.3<\/code><\/td>?ref=<\/code> tag \/ commit hash \/ branch<\/td><\/tr>
                        Registry<\/td>Azure\/avm-res-resources-resourcegroup\/azurerm<\/code><\/td>version = \"0.4.0\"<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                        Use pinned<\/em> module releases for repeatable training\/production. When changing a module’s source<\/code> or selected release, run terraform init<\/code> again. terraform init -upgrade<\/code> requests the newest module\/provider dependencies allowed by your constraints<\/strong>; it cannot move an exact version = \"0.4.0\"<\/code> to 0.5.0<\/code> until you edit that constraint.<\/p>\n\n\n\n
                        Version-constraint experiment (do not run in an active deployment without reviewing the plan):<\/strong> Change one pinned Registry version = \"0.4.0\"<\/code> to version = \"~> 0.4.0\"<\/code>. This permits compatible 0.4.x<\/code> patches, not 0.5.0<\/code>. Then run terraform init -upgrade<\/code>, inspect the dependency selections and terraform plan<\/code>, and pin the selected release again for repeatable teaching. Provider .terraform.lock.hcl<\/code> changes and Registry module versions are related but not the same mechanism.<\/p>\n\n\n\n
                        Azure Verified Modules (AVM)<\/strong> are real published modules maintained against Azure guidance. Their short callers can still install multiple providers and create several implementation resources; review upstream requirements, security defaults, licenses, examples and release history before adoption.<\/p>\n\n\n\n
                        Lab 09 \u2014 Consume a Git module with a pinned tag<\/h3>\n\n\n\n
                        What changed:<\/strong> The module source<\/code> is no longer a .\/local-path<\/code>. It is a remote Git source, pinned with ?ref=0.4.3<\/code>. This exercise uses Azure’s naming module solely to teach Git-source syntax; this specific repository was archived on September 15, 2026<\/strong>, so it is not a recommendation for new long-lived production dependencies.<\/p>\n\n\n\n
                          \n
                        1. Open\u00a0main.tf<\/code>\u00a0and identify the\u00a0git::https:\/\/...git?ref=0.4.3<\/code>\u00a0source.<\/li>\n\n\n\n
                        2. Run\u00a0terraform init<\/code>; Terraform downloads the Git repository and its dependencies.<\/li>\n\n\n\n
                        3. Run\u00a0terraform validate<\/code>,\u00a0terraform plan<\/code>. After an optional\u00a0apply<\/code>, inspect\u00a0terraform output example_resource_group_name<\/code>.<\/li>\n\n\n\n
                        4. Change the tag\u00a0only after verifying a replacement release exists<\/strong>; rerun\u00a0terraform init<\/code>\u00a0to refresh the source.<\/li>\n<\/ol>\n\n\n\n
                          Checkpoint:<\/strong> Git modules use ?ref=<tag|commit|branch><\/code>; do not<\/strong> use a version<\/code> argument with an ordinary Git module source.<\/p>\n\n\n\n
                          Mini-assignment:<\/strong> Write, on paper, a Git source URL pinned to a commit SHA instead of a moving branch.<\/p>\n\n\n\n
                          Complete code for this lab<\/h4>\n\n\n\n
                          All paths below are relative to labs\/09-git-source\/<\/code>. The ZIP contains the identical ready-to-edit files.<\/p>\n\n\n\n
                          main.tf<\/code><\/strong><\/p>\n\n\n\n
                          terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n}\n\nmodule \"naming\" {\n  source = \"git::https:\/\/github.com\/Azure\/terraform-azurerm-naming.git?ref=0.4.3\"\n  suffix = [\"tfmod\", \"git\"]\n}\n\noutput \"example_resource_group_name\" {\n  value = module.naming.resource_group.name\n}\n<\/code><\/pre>\n\n\n\n
                          Run this lab<\/h4>\n\n\n\n
                          cd labs\/09-git-source\nterraform init\nterraform fmt -recursive\nterraform validate\nterraform plan\n# Optional after reviewing the plan: terraform apply<\/em>\n# When done: terraform destroy<\/em>\n<\/code><\/pre>\n\n\n\n
                          \n\n\n\n
                          Lab 10 \u2014 Use real Azure Registry\/AVM modules<\/h3>\n\n\n\n
                          What changed:<\/strong> We now consume the public Terraform Registry using exact source<\/code> and version<\/code> values. Three published modules demonstrate naming, resource-group provisioning, and VNet\/subnet provisioning without writing the long Azure resources yourself.<\/p>\n\n\n\n
                            \n
                          1. Read\u00a0module \"naming\"<\/code>\u00a0(Azure\/naming\/azurerm<\/code>\u00a00.4.3),\u00a0module \"rg\"<\/code>\u00a0(Azure Verified Resource Group 0.4.0),\u00a0module \"vnet\"<\/code>\u00a0(Azure Verified Virtual Network 0.22.2).<\/li>\n\n\n\n
                          2. Notice how\u00a0module.naming.resource_group.name<\/code>\u00a0flows into RG\u00a0name<\/code>, then\u00a0module.rg.resource_id<\/code>\u00a0flows into the VNet\u00a0parent_id<\/code>.<\/li>\n\n\n\n
                          3. Run\u00a0terraform init<\/code>\u00a0to download the external modules and required providers, including Azure AzAPI.<\/li>\n\n\n\n
                          4. Run\u00a0terraform validate<\/code>,\u00a0terraform plan<\/code>\u00a0and review the extra resources\/dependencies hidden by external modules. Apply optionally; then inspect\u00a0terraform output vnet_id<\/code>.<\/li>\n\n\n\n
                          5. Inspect\u00a0terraform providers<\/code>\u00a0and the upstream module’s examples\/README when investigating configuration or upgrades.<\/li>\n<\/ol>\n\n\n\n
                            Checkpoint:<\/strong> Registry modules use version = \"x.y.z\"<\/code>. An exact pin stays on that version even if you run terraform init -upgrade<\/code>; update the requested version intentionally.<\/p>\n\n\n\n
                            Mini-assignment:<\/strong> Compare the very short VNet call with the AzureRM resource blocks in Lab 05; describe the trade-off between code concision and dependency\/provider complexity.<\/p>\n\n\n\n
                            Note:<\/strong> The naming dependency is archived; for real long-lived projects, evaluate maintenance and alternatives before adopting a module. The AVM resource-group and VNet modules are separate projects.<\/p>\n\n\n\n
                            Complete code for this lab<\/h4>\n\n\n\n
                            All paths below are relative to labs\/10-registry-avm\/<\/code>. The ZIP contains the identical ready-to-edit files.<\/p>\n\n\n\n
                            main.tf<\/code><\/strong><\/p>\n\n\n\n
                            terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n\n  required_providers {\n    azapi = {\n      source  = \"Azure\/azapi\"\n      version = \"~> 2.4\"\n    }\n  }\n}\n\nprovider \"azapi\" {}\n\nmodule \"naming\" {\n  source  = \"Azure\/naming\/azurerm\"\n  version = \"0.4.3\"\n  suffix  = [\"tfmod\", \"10\"]\n}\n\nmodule \"rg\" {\n  source           = \"Azure\/avm-res-resources-resourcegroup\/azurerm\"\n  version          = \"0.4.0\"\n  name             = module.naming.resource_group.name\n  location         = \"eastus\"\n  enable_telemetry = false\n}\n\nmodule \"vnet\" {\n  source           = \"Azure\/avm-res-network-virtualnetwork\/azurerm\"\n  version          = \"0.22.2\"\n  name             = \"vnet-tfmod-10\"\n  location         = \"eastus\"\n  parent_id        = module.rg.resource_id\n  address_space    = [\"10.90.0.0\/16\"]\n  enable_telemetry = false\n\n  subnets = {\n    vm = {\n      name             = \"snet-vm\"\n      address_prefixes = [\"10.90.1.0\/24\"]\n    }\n  }\n}\n\noutput \"resource_group_id\" {\n  value = module.rg.resource_id\n}\n\noutput \"vnet_id\" {\n  value = module.vnet.resource_id\n}\n<\/code><\/pre>\n\n\n\n
                            Run this lab<\/h4>\n\n\n\n
                            cd labs\/10-registry-avm\nterraform init\nterraform fmt -recursive\nterraform validate\nterraform plan\n# Optional after reviewing the plan: terraform apply<\/em>\n# When done: terraform destroy<\/em>\n<\/code><\/pre>\n\n\n\n
                            \n\n\n\n
                            Module 6 \u2014 Best Practices and Real-World Design<\/h2>\n\n\n\n
                            Keep modules narrow but meaningful. A two-resource VM module is a good educational boundary; a separate custom module for every single argument would be overengineering. Modules should document a stable purpose, required\/optional inputs, outputs, provider constraints, supported Terraform versions and example call. At scale, add automated fmt\/validate\/test, protected state storage, CI checks and semantic releases.<\/p>\n\n\n\n
                            Provider rule:<\/strong> Configure real provider credentials and provider \"azurerm\" { features {} }<\/code> in the root<\/strong>. Reusable child modules declare required_providers<\/code>, normally with a minimum<\/strong> compatible version, and inherit the root provider configuration; they must not each configure their own provider. The root pins the provider to a tested version range and commits the generated .terraform.lock.hcl<\/code> in a real repository.<\/p>\n\n\n\n
                            Suggested code review checklist:<\/strong> Clear module purpose; no surprising hidden Azure resources; stable module\/source versions; explicit input names\/descriptions\/types; safe secret handling; no hardcoded credentials; outputs kept minimal; independent environment states; readme\/example\/test maintained; evaluated replacements for any resource address or name change.<\/p>\n\n\n\n
                            Simple module release flow:<\/strong> change code + docs \u2192 run terraform fmt -recursive<\/code> \u2192 terraform validate<\/code> and mock plan tests \u2192 review compatibility \u2192 tag release in Git (v1.0.0<\/code>) \u2192 publish to a Registry if needed \u2192 upgrade consumers intentionally and inspect plan. Avoid releasing breaking changes as a patch.<\/p>\n\n\n\n
                            Lab 11 \u2014 Test and document modules without creating Azure infrastructure<\/h3>\n\n\n\n
                            What changed:<\/strong> We return to the tiny Resource Group module to keep tests<\/strong> (not Azure plumbing) the teaching focus. The child declares required_providers<\/code>. A .tftest.hcl<\/code> uses mock_provider \"azurerm\" {}<\/code> and two plan tests.<\/p>\n\n\n\n
                              \n
                            1. Read the test file: the first test expects\u00a0rg-tfmod-11<\/code>; the second expects a failure when\u00a0rg_name<\/code>\u00a0lacks the required\u00a0rg-<\/code>\u00a0prefix.<\/li>\n\n\n\n
                            2. Run\u00a0terraform init<\/code>,\u00a0terraform fmt -recursive<\/code>,\u00a0terraform validate<\/code>, and\u00a0terraform test -verbose<\/code>.<\/li>\n\n\n\n
                            3. Confirm no Azure resources were deployed; do\u00a0not<\/strong>\u00a0run\u00a0terraform apply<\/code>\u00a0unless intentionally testing a real cloud deployment.<\/li>\n\n\n\n
                            4. As a maintenance exercise, document inputs, outputs, provider requirements, supported versions, and release notes for the RG module.<\/li>\n<\/ol>\n\n\n\n
                              Checkpoint:<\/strong> Terraform test runs can create real resources by default. In this<\/strong> test file, command = plan<\/code> and mock_provider<\/code> are used to avoid them.<\/p>\n\n\n\n
                              Mini-assignment:<\/strong> Edit the success assertion to expect a wrong name and confirm that your test detects the error, then restore it.<\/p>\n\n\n\n
                              Complete code for this lab<\/h4>\n\n\n\n
                              All paths below are relative to labs\/11-tests-quality\/<\/code>. The ZIP contains the identical ready-to-edit files.<\/p>\n\n\n\n
                              main.tf<\/code><\/strong><\/p>\n\n\n\n
                              module \"rg\" {\n  source   = \".\/modules\/resource-group\"\n  name     = var.rg_name\n  location = \"eastus\"\n}\n<\/code><\/pre>\n\n\n\n
                              outputs.tf<\/code><\/strong><\/p>\n\n\n\n
                              output \"resource_group_name\" {\n  value = module.rg.name\n}\n<\/code><\/pre>\n\n\n\n
                              variables.tf<\/code><\/strong><\/p>\n\n\n\n
                              variable \"rg_name\" {\n  type    = string\n  default = \"rg-tfmod-11\"\n\n  validation {\n    condition     = startswith(var.rg_name, \"rg-\")\n    error_message = \"The resource group name must start with rg-.\"\n  }\n}\n<\/code><\/pre>\n\n\n\n
                              versions.tf<\/code><\/strong><\/p>\n\n\n\n
                              terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \"~> 5.9.0\"\n    }\n  }\n}\n\nprovider \"azurerm\" {\n  features {}\n}\n<\/code><\/pre>\n\n\n\n
                              tests\/module.tftest.hcl<\/code><\/strong><\/p>\n\n\n\n
                              # The provider is mocked: no Azure resources are created by this test.\nmock_provider \"azurerm\" {}\n\nrun \"accept_valid_resource_group_name\" {\n  command = plan\n\n  assert {\n    condition     = module.rg.name == \"rg-tfmod-11\"\n    error_message = \"The child module should preserve the requested name.\"\n  }\n}\n\nrun \"reject_invalid_resource_group_name\" {\n  command = plan\n\n  variables {\n    rg_name = \"bad-name\"\n  }\n\n  expect_failures = [var.rg_name]\n}\n<\/code><\/pre>\n\n\n\n
                              modules\/resource-group\/main.tf<\/code><\/strong><\/p>\n\n\n\n
                              resource \"azurerm_resource_group\" \"this\" {\n  name     = var.name\n  location = var.location\n  tags     = var.tags\n}\n<\/code><\/pre>\n\n\n\n
                              modules\/resource-group\/outputs.tf<\/code><\/strong><\/p>\n\n\n\n
                              output \"name\" {\n  description = \"Name created by the module.\"\n  value       = azurerm_resource_group.this.name\n}\n\noutput \"id\" {\n  description = \"Azure resource group ID.\"\n  value       = azurerm_resource_group.this.id\n}\n<\/code><\/pre>\n\n\n\n
                              modules\/resource-group\/variables.tf<\/code><\/strong><\/p>\n\n\n\n
                              variable \"name\" {\n  description = \"Resource group name.\"\n  type        = string\n}\n\nvariable \"location\" {\n  description = \"Azure region.\"\n  type        = string\n}\n\nvariable \"tags\" {\n  description = \"Optional resource tags.\"\n  type        = map(string)\n  default     = { course = \"terraform-modules\" }\n}\n<\/code><\/pre>\n\n\n\n
                              modules\/resource-group\/versions.tf<\/code><\/strong><\/p>\n\n\n\n
                              terraform {\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \">= 5.9.0\"\n    }\n  }\n}\n<\/code><\/pre>\n\n\n\n
                              modules\/resource-group\/README.md<\/code> \u2014 module documentation and example call<\/strong><\/p>\n\n\n\n
                              # Resource Group teaching module\n\nSmall module used for the test and maintenance lab. It creates **one**<\/strong> Azure Resource Group. Configure AzureRM only in the calling root; the child declares its `required_providers`.\n\n## Input interface\n\n| Name | Type | Required? | Description |\n|---|---|---|---|\n| `name` | `string` | Yes | Resource group name |\n| `location` | `string` | Yes | Azure region |\n| `tags` | `map(string)` | No | Default course tag provided |\n\n## Output interface\n\n| Name | Meaning |\n|---|---|\n| `name` | Azure resource group name |\n| `id` | Azure resource group resource ID |\n\n## Example root call\n\n```hcl\nmodule \"rg\" {\n  source   = \".\/modules\/resource-group\"\n  name     = \"rg-tfmod-11\"\n  location = \"eastus\"\n}\n```\n\n## Quality and release checklist\n\nRun `terraform fmt -recursive`, `terraform validate`, and `terraform test` (from the root). Review output\/variable interface compatibility before tagging a new module release. Use a provider minimum requirement in this module and a tested, bounded provider constraint in the root.\n<\/code><\/pre>\n\n\n\n
                              Run the mock tests (no Azure deployment)<\/h4>\n\n\n\n
                              cd labs\/11-tests-quality\nterraform init\nterraform fmt -recursive\nterraform validate\nterraform test -verbose\n<\/code><\/pre>\n\n\n\n
                              \n\n\n\n
                              Lab 12 \u2014 Safely move an existing resource into a child module<\/h3>\n\n\n\n
                              What changed:<\/strong> Unlike Labs 01\u201311, this advanced mini-lab intentionally preserves the same existing Terraform state<\/strong> while refactoring from a root resource to an identically configured resource inside a child module.<\/p>\n\n\n\n
                                \n
                              1. Enter\u00a0labs\/12-bonus-moved-block\/before<\/code>; run\u00a0terraform init<\/code>,\u00a0terraform plan<\/code>, and (if you can safely create a sample RG)\u00a0terraform apply<\/code>.<\/li>\n\n\n\n
                              2. Save a\u00a0private backup<\/strong>\u00a0of the Terraform state.<\/li>\n\n\n\n
                              3. From inside\u00a0that same\u00a0before<\/code>\u00a0directory<\/strong>, copy the configuration in\u00a0..\/after\/<\/code>\u00a0into the current directory with\u00a0cp -R ..\/after\/. .\/<\/code>.<\/li>\n\n\n\n
                              4. Run\u00a0terraform init<\/code>\u00a0and\u00a0terraform plan<\/code>. Look for wording that the address\u00a0azurerm_resource_group.lab<\/code>\u00a0has moved to<\/em>\u00a0module.rg.azurerm_resource_group.this<\/code>\u00a0rather than delete-and-create operations.<\/li>\n\n\n\n
                              5. Apply after inspection.\u00a0terraform state list<\/code>\u00a0now shows the child address. Destroy when done.<\/li>\n<\/ol>\n\n\n\n
                                Checkpoint:<\/strong> A moved<\/code> block changes Terraform’s address bookkeeping; it does not rewrite the actual Azure object. Matching real-world resource arguments is still necessary to avoid replacements.<\/p>\n\n\n\n
                                Mini-assignment:<\/strong> Explain why changing a resource name at the same time<\/strong> as moving its address can still cause replacement.<\/p>\n\n\n\n
                                Safety note:<\/strong> The user’s earlier 13-resource Windows\/Ubuntu lab needs a separately reviewed move plan for each<\/em> transferred resource; do not paste this one-resource demo into its active state and assume all 13 resources are migrated.<\/p>\n\n\n\n
                                Complete code for this lab<\/h4>\n\n\n\n
                                All paths below are relative to labs\/12-bonus-moved-block\/<\/code>. The ZIP contains the identical ready-to-edit files.<\/p>\n\n\n\n
                                after\/main.tf<\/code><\/strong><\/p>\n\n\n\n
                                module \"rg\" {\n  source = \".\/modules\/resource-group\"\n}\n<\/code><\/pre>\n\n\n\n
                                after\/moved.tf<\/code><\/strong><\/p>\n\n\n\n
                                moved {\n  from = azurerm_resource_group.lab\n  to   = module.rg.azurerm_resource_group.this\n}\n<\/code><\/pre>\n\n\n\n
                                after\/versions.tf<\/code><\/strong><\/p>\n\n\n\n
                                terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \"~> 5.9.0\"\n    }\n  }\n}\nprovider \"azurerm\" { features {} }\n<\/code><\/pre>\n\n\n\n
                                before\/main.tf<\/code><\/strong><\/p>\n\n\n\n
                                resource \"azurerm_resource_group\" \"lab\" {\n  name     = \"rg-tfmod-move\"\n  location = \"eastus\"\n}\n<\/code><\/pre>\n\n\n\n
                                before\/versions.tf<\/code><\/strong><\/p>\n\n\n\n
                                terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \"~> 5.9.0\"\n    }\n  }\n}\nprovider \"azurerm\" { features {} }\n<\/code><\/pre>\n\n\n\n
                                after\/modules\/resource-group\/main.tf<\/code><\/strong><\/p>\n\n\n\n
                                resource \"azurerm_resource_group\" \"this\" {\n  name     = \"rg-tfmod-move\"\n  location = \"eastus\"\n}\n<\/code><\/pre>\n\n\n\n
                                after\/modules\/resource-group\/versions.tf<\/code><\/strong><\/p>\n\n\n\n
                                terraform {\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \">= 5.9.0\"\n    }\n  }\n}\n<\/code><\/pre>\n\n\n\n
                                Important: execute inside the SAME state directory<\/h4>\n\n\n\n
                                cd labs\/12-bonus-moved-block\/before\nterraform init\nterraform apply    # creates initial RG after showing the plan<\/em>\n# Back up terraform.tfstate securely outside any shared\/public directory first.<\/em>\ncp -R ..\/after\/. .\/\nterraform init\nterraform plan     # expect an address move, not resource recreation<\/em>\nterraform apply    # review plan first<\/em>\nterraform state list\nterraform destroy\n<\/code><\/pre>\n\n\n\n
                                \n\n\n\n
                                Reference \u2014 common questions and troubleshooting<\/h2>\n\n\n\n
                                Question or symptom<\/th>Likely cause<\/th>Action<\/th><\/tr><\/thead>
                                Module not installed<\/code><\/td>New\/changed source<\/code> was not initialized<\/td>Run terraform init<\/code> from the root directory<\/td><\/tr>
                                No value for required variable<\/code><\/td>Missing root .tfvars<\/code> or module argument<\/td>Copy .tfvars.example<\/code> into the root and pass every required input<\/td><\/tr>
                                Unsupported argument<\/code> in a module<\/code> block<\/td>Caller uses a name not declared by child’s variable<\/code> blocks<\/td>Match input names exactly<\/td><\/tr>
                                Unsupported attribute<\/code> on module.xyz<\/code><\/td>Child has no matching output<\/code> block<\/td>Add an output in the child, then reference its name<\/td><\/tr>
                                Git ref<\/code> not found<\/td>Tag is misspelled or uses the wrong prefix (v<\/code> vs no v<\/code>)<\/td>Verify tags; Lab 09 uses 0.4.3<\/code><\/strong>, not v0.4.3<\/code><\/td><\/tr>
                                Registry module doesn’t accept a version<\/code> or cannot install<\/td>Source syntax\/version mismatch or missing internet<\/td>Use Registry namespace\/name\/provider<\/code>; rerun init<\/code>, check current module version<\/td><\/tr>
                                Azure authentication fails<\/td>Wrong subscription, CLI credentials, policy or missing ARM_SUBSCRIPTION_ID<\/code><\/td>az login<\/code>, az account set<\/code>, export subscription ID<\/td><\/tr>
                                SSH-key file not found<\/td>~\/.ssh\/id_ed25519.pub<\/code> doesn’t exist<\/td>Generate an Ed25519 key or update the file()<\/code> path to your existing public key<\/td><\/tr>
                                VM SKU\/image not found<\/td>Offer\/SKU not available in selected region\/subscription<\/td>Query Azure image & SKU catalogs; select approved equivalent<\/td><\/tr>
                                VM has no public IP<\/td>Intentional private-only module design<\/td>Verify with Azure CLI\/portal; use approved private connectivity for SSH<\/td><\/tr>
                                terraform test<\/code> unexpectedly deploys resources<\/td>Test uses default command = apply<\/code> without mocking<\/td>Use mock_provider<\/code> plus command = plan<\/code> as in Lab 11<\/td><\/tr>
                                Plan proposes unexpected destroy\/create after extracting a module<\/td>Terraform address moved, or a real resource setting changed<\/td>Use reviewed moved<\/code> blocks; match old resource configuration; don’t blindly apply<\/td><\/tr>
                                Environments overwrite each other<\/td>Reusing one root\/state for dev and prod<\/td>Use separate root directories and separate state\/backends<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                Instructor discussion: when should we not<\/em> create a module?<\/h2>\n\n\n\n
                                Use standalone resources when there is one small, context-specific object and no useful reused interface. Prefer a small in-repo module when a team repeats a coherent group of objects (for example, NIC + Linux VM) and the inputs\/outputs remain understandable. Prefer mature Registry\/AVM modules when their documented behavior aligns with the team’s needs and the operational benefits justify extra dependencies. Less code in the root is not automatically less complexity.<\/strong><\/p>\n\n\n\n
                                Optional module topics after this course<\/h2>\n\n\n\n
                                Once learners are comfortable, extend the same VM module with for_each<\/code> to create a map of named instances, tags, optional OS disk settings and explicit provider aliases across subscriptions. Treat these as next-course material<\/strong>\u2014they are intentionally excluded from the core labs so learners focus on module mechanics first. Remote state\/backends and CI\/CD for module publishing are separate follow-on lessons.<\/p>\n\n\n\n
                                Recommended assessment \u2014 short hands-on tasks<\/h2>\n\n\n\n
                                Assignment 1: First reusable module.<\/strong> Create a modules\/resource-group<\/code> child, accept name<\/code> and location<\/code>, and return id<\/code>. Call it from a root and show a successful terraform validate<\/code> and plan. Acceptance:<\/strong> no resource group defined directly in the root, inputs are passed through the module block, and the output references module.rg.id<\/code>.<\/p>\n\n\n\n
                                Assignment 2: Reuse the VM module.<\/strong> Use one Linux VM module twice with different names in a single VNet and subnet. Acceptance:<\/strong> two module calls, two separate VM state addresses, same module source, no public IP. Applying is optional; a valid, reviewed plan is sufficient for a classroom submission.<\/p>\n\n\n\n
                                Assignment 3: External modules.<\/strong> Compare a Git source using ?ref=<\/code> and a Registry source using version<\/code>. Explain terraform init -upgrade<\/code>, exact pinning and why external modules may have additional provider dependencies. Acceptance:<\/strong> learners can identify the pinning mechanism correctly and show successful init\/validate<\/code> for an example with network access.<\/p>\n\n\n\n
                                Assignment 4: Module quality.<\/strong> Add a mock Terraform test checking a resource-group naming rule. Acceptance:<\/strong> one passing configuration test and one expected failure test; no real Azure resource is created by the tests.<\/p>\n\n\n\n
                                Final review checklist<\/h2>\n\n\n\n