{"id":1237,"date":"2026-10-14T12:44:00","date_gmt":"2026-10-14T12:44:00","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/?p=1237"},"modified":"2026-10-14T12:44:02","modified_gmt":"2026-10-14T12:44:02","slug":"terraform-lab-azure-hands-on-terraform-template","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/terraform-lab-azure-hands-on-terraform-template\/","title":{"rendered":"Terraform Lab \u2013 Azure Hands-On \u2013\u00a0Terraform Template"},"content":{"rendered":"\n

Level:<\/strong> Beginner to Intermediate
Format:<\/strong> Tutorial + concept guide + practical lab workbook
Modules:<\/strong> 6 | Labs:<\/strong> 12 | Cloud emphasis:<\/strong> Azure Linux VM, AWS EC2 comparison
Baseline:<\/strong> Terraform 1.15.9+ (within 1.x); AzureRM 5.9.x; AWS provider 6.x
Updated:<\/strong> 14 October 2026
Focus:<\/strong> Learn Terraform string templates and templatefile()<\/code><\/strong>, not Terraform module development or general cloud networking.<\/p>\n\n\n\n

\n

Connection to your previous Azure exercises:<\/strong> Your earlier Labs 1\u20134 \/ six-variable lesson used AzureRM 5.9.x, an Ubuntu 26.04 VM, a VNet\/subnet\/NIC and a larger 13-resource Windows+Ubuntu setup. This course reuses those familiar concepts but intentionally reduces the cloud portion to five Azure resources and one Linux VM<\/strong>. These are fresh standalone labs with independent Terraform state<\/strong>, not drop-in replacements for the earlier applied state. Do not overwrite your previous labs’ main.tf<\/code> or state.<\/p>\n<\/blockquote>\n\n\n\n

Learning outcomes<\/h2>\n\n\n\n

By completion, a learner can explain template scope, render strings and files, use conditional and loop directives, control whitespace, escape Terraform sequences, encode structured data safely, generate and inspect Linux shell scripts and cloud-init, attach a rendered template to an Azure VM, distinguish Azure custom_data<\/code> from AWS user_data<\/code>, and validate generated artifacts before deployment.<\/p>\n\n\n\n

Requirements and setup<\/h2>\n\n\n\n
    \n
  • Terraform CLI. The guide targets the user-provided\u00a0Terraform 1.15.9<\/strong>\u00a0baseline. Check\u00a0terraform version<\/code>.<\/li>\n\n\n\n
  • Text editor; Bash or POSIX shell;\u00a0python3<\/code>\u00a0for an optional JSON syntax check.<\/li>\n\n\n\n
  • Labs 01\u201309 need\u00a0no cloud provider, credentials or paid resources<\/strong>.<\/li>\n\n\n\n
  • Azure Labs 10 and 12: Azure CLI, a permitted subscription, AzureRM 5.9.x provider access, an existing local SSH\u00a0public key<\/strong>, quota for the selected VM, and permissions to deploy five resources.<\/li>\n\n\n\n
  • Optional AWS Lab 11: AWS CLI\/credentials, an existing subnet, a matching Linux AMI and permission to create EC2 instances.<\/li>\n\n\n\n
  • Both cloud deployments incur cost until\u00a0terraform destroy<\/code>. Review the plan before any\u00a0apply<\/code>.<\/li>\n<\/ul>\n\n\n\n

    One-time setup<\/strong> (macOS\/Linux):<\/p>\n\n\n\n

    terraform version\n# For Azure labs only:<\/em>\naz login\naz account set --subscription \"YOUR_SUBSCRIPTION_ID\"\nexport ARM_SUBSCRIPTION_ID=\"$(az account show --query id -o tsv)\"\n# Check your public key before running Azure labs:<\/em>\nls -l \"$HOME\/.ssh\/id_ed25519.pub\" || true\n# Generate a new key only when neither file already exists:<\/em>\nif [ ! -e \"$HOME\/.ssh\/id_ed25519\" ] && [ ! -e \"$HOME\/.ssh\/id_ed25519.pub\" ]; then\n  ssh-keygen -t ed25519 -f \"$HOME\/.ssh\/id_ed25519\"\nfi\n# Confirm there is a usable public key. If not, use a different existing key.<\/em>\ntest -f \"$HOME\/.ssh\/id_ed25519.pub\"\n<\/code><\/pre>\n\n\n\n
    \n
    Skip ssh-keygen<\/code> when the public key already exists. If your organization uses a different key, pass -var='ssh_public_key_path=\/absolute\/path\/to\/key.pub'<\/code>. We never<\/strong> put passwords, private keys, tokens or secrets inside example templates.<\/p>\n<\/blockquote>\n\n\n\n
    Training architecture<\/h2>\n\n\n\n
    flowchart TB\n    A[Input variables \/ HCL data] --> B[templatefile path + vars object]\n    T[templates\/*.tftpl] --> B\n    B --> C[Rendered UTF-8 text]\n    C --> D[\"Outputs and local previews<br\/>Labs 01-09\"]\n    C --> E[\"Azure VM custom_data<br\/>base64encode Lab 10\/12\"]\n    C --> F[\"AWS EC2 user_data<br\/>plain text Lab 11\"]\n    E --> G[cloud-init at first boot]\n    F --> H[User-data script at first boot]\n<\/code><\/pre>\n\n\n\n
    Progressive lab map<\/h3>\n\n\n\n
    Lab<\/th>Module<\/th>Adds one main concept<\/th>Run environment<\/th><\/tr><\/thead>
    01<\/td>1<\/td>Inline string interpolation<\/td>Local, free<\/td><\/tr>
    02<\/td>2<\/td>.tftpl<\/code> and templatefile()<\/code><\/td>Local, free<\/td><\/tr>
    03<\/td>2<\/td>Expressions and nested object scope<\/td>Local, free<\/td><\/tr>
    04<\/td>3<\/td>%{ if }<\/code>, %{ else }<\/code>, %{ endif }<\/code><\/td>Local, free<\/td><\/tr>
    05<\/td>3<\/td>%{ for }<\/code> over a list<\/td>Local, free<\/td><\/tr>
    06<\/td>3<\/td>Map iteration and ~<\/code> whitespace<\/td>Local, free<\/td><\/tr>
    07<\/td>4<\/td>jsonencode()<\/code> and template debugging<\/td>Local, free<\/td><\/tr>
    08<\/td>5<\/td>Linux shell startup script + escaping<\/td>Local, free<\/td><\/tr>
    09<\/td>5<\/td>Cloud-init YAML preview<\/td>Local, free<\/td><\/tr>
    10<\/td>5<\/td>Azure VM custom_data<\/code><\/td>Azure (billable)<\/td><\/tr>
    11<\/td>5<\/td>AWS EC2 user_data<\/code><\/td>AWS (optional; billable)<\/td><\/tr>
    12<\/td>6<\/td>Composition, maintainability, end-to-end verification<\/td>Azure (billable)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    How to use the ZIP:<\/strong> Every lab is a self-contained snapshot, complete with its own main.tf<\/code>, template files and README.md<\/code>. Start Lab 01, then move to the next lab and compare code. You can run Labs 01\u201309 independently; cloud labs have their own isolated states and distinct Azure resource prefixes. Do not apply both Azure labs unless you intend to pay for two VMs. For a real-world stateful upgrade, use one working folder and first inspect terraform plan<\/code>\u2014changing VM custom data usually requires VM replacement.<\/p>\n\n\n\n
    \n\n\n\n
    Module 1 \u2014 Introduction to Terraform Templates<\/h1>\n\n\n\n
    1.1 What is a Terraform template?<\/h2>\n\n\n\n
    A Terraform template is text containing Terraform interpolation or template directives<\/strong> that Terraform evaluates to produce text. You can place a small template in a quoted\/heredoc string, or put a larger one in a UTF-8 .tftpl<\/code> file and render it with templatefile()<\/code>.<\/p>\n\n\n\n
    A template is not a Terraform module.<\/strong> A module groups Terraform configuration that defines infrastructure. A template is a way to generate text<\/em> such as application config, shell scripts, HTML, cloud-init or EC2 user data. Generating a string alone creates no cloud resources.<\/p>\n\n\n\n
    Item<\/th>Role<\/th>Example<\/th><\/tr><\/thead>
    Variable<\/td>Holds typed input<\/td>var.environment = \"dev\"<\/code><\/td><\/tr>
    Interpolation<\/td>Inserts a value<\/td>\"server-${var.environment}\"<\/code><\/td><\/tr>
    .tftpl<\/code> file<\/td>Holds reusable formatted text<\/td>templates\/app.conf.tftpl<\/code><\/td><\/tr>
    templatefile()<\/code><\/td>Renders an external template with supplied values<\/td>templatefile(\"...\", { environment = var.environment })<\/code><\/td><\/tr>
    Terraform module<\/td>Groups infrastructure configuration<\/td>module \"network\" { ... }<\/code> \u2014 not taught here<\/strong><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    When not to use a template:<\/strong> A single string is often clearer as \"prefix-${var.name}\"<\/code>. For JSON\/YAML, prefer jsonencode<\/code>\/yamlencode<\/code> over hand-building escaped strings. Use an external .tftpl<\/code> file when it makes a longer output easier to read and review.<\/p>\n\n\n\n
    1.2 Your first result<\/h2>\n\n\n\n
    Below we start without providers, backend setup, resources or credentials. You can run the first nine labs anywhere the Terraform CLI is installed.<\/p>\n\n\n\n
    Lab 01 \u2014 First template: inline interpolation<\/h2>\n\n\n\n
    Estimated classroom slot:<\/strong> 10 min
    Execution:<\/strong> Local only \u2014 no cloud costs<\/strong><\/p>\n\n\n\n
    Objective:<\/strong> Learn that Terraform string expressions can render a changing message without any cloud provider.<\/p>\n\n\n\n
    What changed from the previous lab:<\/strong> Starting point. Two input variables and one output; no resources or templates directory.<\/p>\n\n\n\n
    Step 1 \u2014 Understand the folder<\/h3>\n\n\n\n
    labs\/01-inline-interpolation\/\n  main.tf\n  README.md\n<\/code><\/pre>\n\n\n\n
    Step 2 \u2014 Create\/review each file<\/h3>\n\n\n\n
    main.tf<\/code><\/strong><\/p>\n\n\n\n
    terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n}\n\nvariable \"app_name\" {\n  type    = string\n  default = \"demoapp\"\n}\n\nvariable \"environment\" {\n  type    = string\n  default = \"dev\"\n}\n\noutput \"message\" {\n  value = \"App ${upper(var.app_name)} runs in ${var.environment}\"\n}\n<\/code><\/pre>\n\n\n\n
    Step 3 \u2014 Run and inspect<\/h3>\n\n\n\n
    From the lab folder, use the following commands. Replace placeholder IDs for cloud labs.<\/p>\n\n\n\n
    terraform init -backend=false\nterraform validate\nterraform apply -auto-approve\nterraform output -raw message\n<\/code><\/pre>\n\n\n\n
    Expected:<\/strong> App DEMOAPP runs in dev<\/p>\n\n\n\n
    Step 4 \u2014 Student practice<\/h3>\n\n\n\n
    Run terraform apply -auto-approve -var=\"environment=stage\"<\/code>. Confirm the message changes without provisioning anything.<\/p>\n\n\n\n
    \n\n\n\n
    Module 2 \u2014 Template Fundamentals<\/h1>\n\n\n\n
    Core syntax to remember<\/h2>\n\n\n\n
    An interpolation ${expression}<\/code> inserts the value of an expression, like ${app.name}<\/code> or ${upper(app.name)}<\/code>. A template file is normally named *.tftpl<\/code> and does not create resources by itself.<\/p>\n\n\n\n
    output \"result\" {\n  value = templatefile(\"${path.module}\/templates\/message.tftpl\", {\n    app_name = var.app_name\n  })\n}\n<\/code><\/pre>\n\n\n\n
    Scope rule:<\/strong> var.app_name<\/code> is available in the parent .tf<\/code>; inside the external file it is available only as app_name<\/code> because that is the key passed in the second argument. path.module<\/code> makes the template path relative to the running configuration directory, not your terminal’s current working directory.<\/p>\n\n\n\n
    Lab 02 \u2014 Extract a reusable .tftpl<\/code> file<\/h2>\n\n\n\n
    Estimated classroom slot:<\/strong> 10 min
    Execution:<\/strong> Local only \u2014 no cloud costs<\/strong><\/p>\n\n\n\n
    Objective:<\/strong> Move the text outside the Terraform configuration and pass exactly two named values to templatefile()<\/code>.<\/p>\n\n\n\n
    What changed from the previous lab:<\/strong> Retains the two variables from Lab 01. Replaces the inline output string with an external template.<\/p>\n\n\n\n
    Step 1 \u2014 Understand the folder<\/h3>\n\n\n\n
    labs\/02-first-templatefile\/\n  main.tf\n  templates\/message.tftpl\n  README.md\n<\/code><\/pre>\n\n\n\n
    Step 2 \u2014 Create\/review each file<\/h3>\n\n\n\n
    main.tf<\/code><\/strong><\/p>\n\n\n\n
    terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n}\n\nvariable \"app_name\" {\n  type    = string\n  default = \"demoapp\"\n}\n\nvariable \"environment\" {\n  type    = string\n  default = \"dev\"\n}\n\noutput \"message\" {\n  value = templatefile(\"${path.module}\/templates\/message.tftpl\", {\n    app_name    = var.app_name\n    environment = var.environment\n  })\n}\n<\/code><\/pre>\n\n\n\n
    templates\/message.tftpl<\/code><\/strong><\/p>\n\n\n\n
    App ${upper(app_name)} runs in ${environment}\n<\/code><\/pre>\n\n\n\n
    Step 3 \u2014 Run and inspect<\/h3>\n\n\n\n
    From the lab folder, use the following commands. Replace placeholder IDs for cloud labs.<\/p>\n\n\n\n
    terraform init -backend=false\nterraform validate\nterraform apply -auto-approve\nterraform output -raw message\n<\/code><\/pre>\n\n\n\n
    Expected:<\/strong> App DEMOAPP runs in dev<\/p>\n\n\n\n
    Step 4 \u2014 Student practice<\/h3>\n\n\n\n
    Change templates\/message.tftpl<\/code> to add Welcome to ${environment}<\/code> and confirm that terraform output -raw message<\/code> changes after terraform apply<\/code>.<\/p>\n\n\n\n
    Lab 03 \u2014 Expressions, objects, and template scope<\/h2>\n\n\n\n
    Estimated classroom slot:<\/strong> 10 min
    Execution:<\/strong> Local only \u2014 no cloud costs<\/strong><\/p>\n\n\n\n
    Objective:<\/strong> Pass an object into a template and access its fields. Practice a function and a number inside interpolation.<\/p>\n\n\n\n
    What changed from the previous lab:<\/strong> The two scalar variables become one app<\/code> object. Inside the template the object is named app<\/code>, not var.app<\/code>.<\/p>\n\n\n\n
    Step 1 \u2014 Understand the folder<\/h3>\n\n\n\n
    labs\/03-objects-and-scope\/\n  main.tf\n  templates\/message.tftpl\n  README.md\n<\/code><\/pre>\n\n\n\n
    Step 2 \u2014 Create\/review each file<\/h3>\n\n\n\n
    main.tf<\/code><\/strong><\/p>\n\n\n\n
    terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n}\n\nvariable \"app\" {\n  type = object({\n    name        = string\n    environment = string\n    port        = number\n  })\n  default = {\n    name        = \"demoapp\"\n    environment = \"dev\"\n    port        = 8080\n  }\n}\n\noutput \"message\" {\n  value = templatefile(\"${path.module}\/templates\/message.tftpl\", {\n    app = var.app\n  })\n}\n<\/code><\/pre>\n\n\n\n
    templates\/message.tftpl<\/code><\/strong><\/p>\n\n\n\n
    App ${upper(app.name)} (${app.environment}) listens on ${app.port}\n<\/code><\/pre>\n\n\n\n
    Step 3 \u2014 Run and inspect<\/h3>\n\n\n\n
    From the lab folder, use the following commands. Replace placeholder IDs for cloud labs.<\/p>\n\n\n\n
    terraform init -backend=false\nterraform validate\nterraform apply -auto-approve\nterraform output -raw message\n<\/code><\/pre>\n\n\n\n
    Expected:<\/strong> App DEMOAPP (dev) listens on 8080<\/p>\n\n\n\n
    Step 4 \u2014 Student practice<\/h3>\n\n\n\n
    Change app.port<\/code> to 9090<\/code> in the default object and inspect the newly rendered output.<\/p>\n\n\n\n
    \n\n\n\n
    Module 3 \u2014 Template Directives<\/h1>\n\n\n\n
    Directives choose or repeat whole text sections. They are not Terraform resource loops<\/strong> and they do not deploy any infrastructure.<\/p>\n\n\n\n
    %{ if enable_logging ~}\nlogging=enabled\n%{ else ~}\nlogging=disabled\n%{ endif ~}\n%{ for item in items ~}\nitem=${item}\n%{ endfor ~}\n<\/code><\/pre>\n\n\n\n
      \n
    • %{ if condition }<\/code>\u00a0begins a conditional;\u00a0%{ else }<\/code>\u00a0is optional;\u00a0%{ endif }<\/code>\u00a0closes it.<\/li>\n\n\n\n
    • %{ for item in items }<\/code>\u00a0iterates over a collection;\u00a0%{ endfor }<\/code>\u00a0closes it.<\/li>\n\n\n\n
    • %{ for key, value in settings }<\/code>\u00a0iterates through map entries.<\/li>\n\n\n\n
    • The\u00a0~<\/code>\u00a0immediately before\u00a0}<\/code>\u00a0consumes whitespace\u00a0after<\/strong>\u00a0the sequence. A\u00a0~<\/code>\u00a0immediately after\u00a0%{<\/code>\u00a0consumes whitespace\u00a0before<\/strong>\u00a0the sequence. Both can help remove directive-only blank lines.<\/li>\n\n\n\n
    • Do not confuse template directives with\u00a0for_each<\/code>,\u00a0count<\/code>, or dynamic resource blocks.<\/li>\n<\/ul>\n\n\n\n
      Lab 04 \u2014 Conditional %{ if }<\/code> and %{ else }<\/code><\/h2>\n\n\n\n
      Estimated classroom slot:<\/strong> 15 min
      Execution:<\/strong> Local only \u2014 no cloud costs<\/strong><\/p>\n\n\n\n
      Objective:<\/strong> Render exactly one of two configuration lines based on a boolean input.<\/p>\n\n\n\n
      What changed from the previous lab:<\/strong> Keeps the Lab 03 app<\/code> object and adds enable_logging<\/code> with %{ if }<\/code>, %{ else }<\/code>, and %{ endif }<\/code>.<\/p>\n\n\n\n
      Step 1 \u2014 Understand the folder<\/h3>\n\n\n\n
      labs\/04-if-else-directives\/\n  main.tf\n  templates\/app.conf.tftpl\n  README.md\n<\/code><\/pre>\n\n\n\n
      Step 2 \u2014 Create\/review each file<\/h3>\n\n\n\n
      main.tf<\/code><\/strong><\/p>\n\n\n\n
      terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n}\n\nvariable \"app\" {\n  type = object({ name = string, environment = string })\n  default = { name = \"demoapp\", environment = \"dev\" }\n}\n\nvariable \"enable_logging\" {\n  type    = bool\n  default = true\n}\n\noutput \"config\" {\n  value = templatefile(\"${path.module}\/templates\/app.conf.tftpl\", {\n    app            = var.app\n    enable_logging = var.enable_logging\n  })\n}\n<\/code><\/pre>\n\n\n\n
      templates\/app.conf.tftpl<\/code><\/strong><\/p>\n\n\n\n
      name=${app.name}\nenvironment=${app.environment}\n%{ if enable_logging ~}\nlogging=enabled\n%{ else ~}\nlogging=disabled\n%{ endif ~}\n<\/code><\/pre>\n\n\n\n
      Step 3 \u2014 Run and inspect<\/h3>\n\n\n\n
      From the lab folder, use the following commands. Replace placeholder IDs for cloud labs.<\/p>\n\n\n\n
      terraform init -backend=false\nterraform validate\nterraform apply -auto-approve\nterraform output -raw config\n<\/code><\/pre>\n\n\n\n
      Expected:<\/strong> name=demoapp; env=dev; logging=enabled (on separate lines)<\/p>\n\n\n\n
      Step 4 \u2014 Student practice<\/h3>\n\n\n\n
      Set -var=\"enable_logging=false\"<\/code>, apply, and confirm the template produces logging=disabled<\/code> instead.<\/p>\n\n\n\n
      Lab 05 \u2014 Generate repeated lines with %{ for }<\/code><\/h2>\n\n\n\n
      Estimated classroom slot:<\/strong> 15 min
      Execution:<\/strong> Local only \u2014 no cloud costs<\/strong><\/p>\n\n\n\n
      Objective:<\/strong> Use a list to render a package entry for every item instead of repeating code.<\/p>\n\n\n\n
      What changed from the previous lab:<\/strong> The conditional configuration from Lab 04 stays. Add packages<\/code> and one %{ for package in packages }<\/code> directive.<\/p>\n\n\n\n
      Step 1 \u2014 Understand the folder<\/h3>\n\n\n\n
      labs\/05-for-list-directive\/\n  main.tf\n  templates\/app.conf.tftpl\n  README.md\n<\/code><\/pre>\n\n\n\n
      Step 2 \u2014 Create\/review each file<\/h3>\n\n\n\n
      main.tf<\/code><\/strong><\/p>\n\n\n\n
      terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n}\n\nvariable \"app\" {\n  type = object({ name = string, environment = string })\n  default = { name = \"demoapp\", environment = \"dev\" }\n}\n\nvariable \"enable_logging\" {\n  type    = bool\n  default = true\n}\n\nvariable \"packages\" {\n  type    = list(string)\n  default = [\"nginx\", \"curl\"]\n}\n\noutput \"config\" {\n  value = templatefile(\"${path.module}\/templates\/app.conf.tftpl\", {\n    app            = var.app\n    enable_logging = var.enable_logging\n    packages       = var.packages\n  })\n}\n<\/code><\/pre>\n\n\n\n
      templates\/app.conf.tftpl<\/code><\/strong><\/p>\n\n\n\n
      name=${app.name}\nenvironment=${app.environment}\n%{ if enable_logging ~}\nlogging=enabled\n%{ else ~}\nlogging=disabled\n%{ endif ~}\n%{ for package in packages ~}\npackage=${package}\n%{ endfor ~}\n<\/code><\/pre>\n\n\n\n
      Step 3 \u2014 Run and inspect<\/h3>\n\n\n\n
      From the lab folder, use the following commands. Replace placeholder IDs for cloud labs.<\/p>\n\n\n\n
      terraform init -backend=false\nterraform validate\nterraform apply -auto-approve\nterraform output -raw config\n<\/code><\/pre>\n\n\n\n
      Expected:<\/strong> Includes package=nginx<\/code> and package=curl<\/code>, one item per line.<\/p>\n\n\n\n
      Step 4 \u2014 Student practice<\/h3>\n\n\n\n
      Add \"git\"<\/code> to packages<\/code>, rerun the lab, and verify exactly three package=<\/code> entries.<\/p>\n\n\n\n
      Lab 06 \u2014 Loop through a map and control whitespace<\/h2>\n\n\n\n
      Estimated classroom slot:<\/strong> 15 min
      Execution:<\/strong> Local only \u2014 no cloud costs<\/strong><\/p>\n\n\n\n
      Objective:<\/strong> Add key\/value pairs and remove extra blank lines using ~<\/code> without changing the configuration design.<\/p>\n\n\n\n
      What changed from the previous lab:<\/strong> The previous list loop stays. Add settings = map(string)<\/code> and %{ for key, value in settings ~}<\/code>.<\/p>\n\n\n\n
      Step 1 \u2014 Understand the folder<\/h3>\n\n\n\n
      labs\/06-maps-and-whitespace\/\n  main.tf\n  templates\/app.conf.tftpl\n  README.md\n<\/code><\/pre>\n\n\n\n
      Step 2 \u2014 Create\/review each file<\/h3>\n\n\n\n
      main.tf<\/code><\/strong><\/p>\n\n\n\n
      terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n}\n\nvariable \"app\" {\n  type = object({ name = string, environment = string })\n  default = { name = \"demoapp\", environment = \"dev\" }\n}\n\nvariable \"enable_logging\" {\n  type    = bool\n  default = true\n}\n\nvariable \"packages\" {\n  type    = list(string)\n  default = [\"nginx\", \"curl\"]\n}\n\nvariable \"settings\" {\n  type = map(string)\n  default = { log_level = \"info\", workers = \"2\" }\n}\n\noutput \"config\" {\n  value = templatefile(\"${path.module}\/templates\/app.conf.tftpl\", {\n    app            = var.app\n    enable_logging = var.enable_logging\n    packages       = var.packages\n    settings       = var.settings\n  })\n}\n<\/code><\/pre>\n\n\n\n
      templates\/app.conf.tftpl<\/code><\/strong><\/p>\n\n\n\n
      name=${app.name}\nenvironment=${app.environment}\n%{ if enable_logging ~}\nlogging=enabled\n%{ else ~}\nlogging=disabled\n%{ endif ~}\n%{ for package in packages ~}\npackage=${package}\n%{ endfor ~}\n%{ for key, value in settings ~}\n${key}=${value}\n%{ endfor ~}\n<\/code><\/pre>\n\n\n\n
      Step 3 \u2014 Run and inspect<\/h3>\n\n\n\n
      From the lab folder, use the following commands. Replace placeholder IDs for cloud labs.<\/p>\n\n\n\n
      terraform init -backend=false\nterraform validate\nterraform apply -auto-approve\nterraform output -raw config\n<\/code><\/pre>\n\n\n\n
      Expected:<\/strong> Includes log_level=info<\/code>, workers=2<\/code>, and no blank line created by directive-only lines.<\/p>\n\n\n\n
      Step 4 \u2014 Student practice<\/h3>\n\n\n\n
      Remove ~<\/code> from the for<\/code> line and apply. Compare the output; then restore it.<\/p>\n\n\n\n
      Instructor note:<\/strong> Map keys are traversed in lexical order for Terraform map\/object values. Do not use a set when output order is a requirement.<\/p>\n\n\n\n
      \n\n\n\n
      Module 4 \u2014 templatefile()<\/code> in Depth<\/h1>\n\n\n\n
      API, files, and constraints<\/h2>\n\n\n\n
      templatefile(path, vars)\n<\/code><\/pre>\n\n\n\n
        \n
      • path<\/code>\u00a0is an existing local UTF-8 text file, typically referenced using\u00a0${path.module}\/templates\/...<\/code>.<\/li>\n\n\n\n
      • vars<\/code>\u00a0is an object\/map.\u00a0Only its top-level keys<\/strong>\u00a0are in scope in the\u00a0.tftpl<\/code>\u00a0file; their values can be nested objects, lists and maps.<\/li>\n\n\n\n
      • Template keys must start with a letter, then contain only letters, digits or underscores.<\/li>\n\n\n\n
      • templatefile()<\/code>\u00a0cannot call itself recursively and it cannot read a file created later during the same Terraform run. It is not a cloud service or a Terraform resource.<\/li>\n\n\n\n
      • file(path)<\/code>\u00a0reads literal text unchanged, while\u00a0templatefile()<\/code>\u00a0renders template expressions. If you need a literal\u00a0${...}<\/code>\u00a0in a rendered template, write\u00a0$${...}<\/code>\u00a0in the source; for literal\u00a0%{...}<\/code>, write\u00a0%%{...}<\/code>.<\/li>\n\n\n\n
      • Avoid the legacy<\/strong>\u00a0data \"template_file\"<\/code>\u00a0from the archived\u00a0hashicorp\/template<\/code>\u00a0provider. Modern Terraform has a built-in\u00a0templatefile()<\/code>\u00a0function, requiring no extra template provider.<\/li>\n<\/ul>\n\n\n\n
        Troubleshooting table<\/strong><\/p>\n\n\n\n
        Error \/ symptom<\/th>Why<\/th>Fix<\/th><\/tr><\/thead>
        Invalid value for \"path\"<\/code><\/td>File missing or wrong relative directory<\/td>Use ${path.module}<\/code> and verify location<\/td><\/tr>
        vars map does not contain key ...<\/code><\/td>Template references a key you did not pass<\/td>Add it to the vars<\/code> object or fix its spelling<\/td><\/tr>
        vars map does not contain key \"var\"<\/code><\/td>Wrote ${var.environment}<\/code> inside .tftpl<\/code><\/td>Pass environment = var.environment<\/code> and refer to ${environment}<\/code><\/td><\/tr>
        Invalid function argument<\/code> or malformed content<\/td>Invalid UTF-8, function use or interpolated value<\/td>Validate source encoding and expression syntax<\/td><\/tr>
        Output literally contains unexpected $${...}<\/code><\/td>Escaped one extra level<\/td>Distinguish Terraform interpolation from shell interpolation<\/td><\/tr>
        JSON\/YAML syntax invalid<\/td>Manually interpolated strings without escaping<\/td>Use jsonencode<\/code> \/ yamlencode<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
        Preflight habit:<\/strong> terraform fmt<\/code>, terraform validate<\/code>, and terraform console<\/code>; then plan\/apply only when necessary. For JSON results, pipe terraform output -raw<\/code> into python3 -m json.tool<\/code>.<\/p>\n\n\n\n
        Lab 07 \u2014 Render JSON safely and debug templatefile()<\/code><\/h2>\n\n\n\n
        Estimated classroom slot:<\/strong> 15 min
        Execution:<\/strong> Local only \u2014 no cloud costs<\/strong><\/p>\n\n\n\n
        Objective:<\/strong> Pass objects and lists through the vars<\/code> map while using jsonencode()<\/code> for correct quoting and escaping.<\/p>\n\n\n\n
        What changed from the previous lab:<\/strong> Switches output format from ad hoc text to JSON. This is a new format, not a new provider or resource.<\/p>\n\n\n\n
        Step 1 \u2014 Understand the folder<\/h3>\n\n\n\n
        labs\/07-json-and-debugging\/\n  main.tf\n  templates\/app.json.tftpl\n  README.md\n<\/code><\/pre>\n\n\n\n
        Step 2 \u2014 Create\/review each file<\/h3>\n\n\n\n
        main.tf<\/code><\/strong><\/p>\n\n\n\n
        terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n}\n\nvariable \"app\" {\n  type = object({ name = string, environment = string, port = number })\n  default = { name = \"demoapp\", environment = \"dev\", port = 8080 }\n}\n\nvariable \"features\" {\n  type    = list(string)\n  default = [\"metrics\", \"healthcheck\"]\n}\n\nvariable \"settings\" {\n  type    = map(string)\n  default = { workers = \"2\", log_level = \"info\" }\n}\n\noutput \"config_json\" {\n  value = templatefile(\"${path.module}\/templates\/app.json.tftpl\", {\n    app      = var.app\n    features = var.features\n    settings = var.settings\n  })\n}\n<\/code><\/pre>\n\n\n\n
        templates\/app.json.tftpl<\/code><\/strong><\/p>\n\n\n\n
        ${jsonencode({\n  name        = app.name\n  environment = app.environment\n  port        = app.port\n  features    = features\n  settings    = settings\n})}\n<\/code><\/pre>\n\n\n\n
        Step 3 \u2014 Run and inspect<\/h3>\n\n\n\n
        From the lab folder, use the following commands. Replace placeholder IDs for cloud labs.<\/p>\n\n\n\n
        terraform init -backend=false\nterraform validate\nterraform apply -auto-approve\nterraform output -raw config_json | python3 -m json.tool\n<\/code><\/pre>\n\n\n\n
        Expected:<\/strong> Valid formatted JSON with name, environment, port, features<\/code> array, and settings<\/code> object.<\/p>\n\n\n\n
        Step 4 \u2014 Student practice<\/h3>\n\n\n\n
        Change the app name to demo \"quoted\"<\/code>; validate the result using python3 -m json.tool<\/code> rather than inserting quotes manually.<\/p>\n\n\n\n
        Instructor note:<\/strong> jsonencode()<\/code> handles quote and newline escaping. Inside the template only the keys passed to templatefile<\/code> exist; root-level var.app<\/code> is not in scope.<\/p>\n\n\n\n
        \n\n\n\n
        Module 5 \u2014 Templates for Cloud Automation<\/h1>\n\n\n\n
        Three formats, one concept<\/h2>\n\n\n\n
        Content<\/th>Typical source<\/th>How attached<\/th>Execution moment<\/th><\/tr><\/thead>
        Linux shell script<\/td>startup.sh.tftpl<\/code><\/td>AWS user_data = templatefile(...)<\/code><\/td>Usually first boot<\/td><\/tr>
        Cloud-init YAML<\/td>cloud-init.tftpl<\/code><\/td>Azure custom_data = base64encode(templatefile(...))<\/code><\/td>Usually first boot<\/td><\/tr>
        App\/server config<\/td>app.conf.tftpl<\/code><\/td>Embedded inside cloud-init write_files<\/code><\/td>At VM initialization<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
        Key difference:<\/strong> AzureRM azurerm_linux_virtual_machine.custom_data<\/code> expects Base64-encoded text. AWS Terraform aws_instance.user_data<\/code> accepts ordinary script text; its provider handles API encoding. Do not double-encode the AWS field.<\/p>\n\n\n\n
        Security default:<\/strong> Azure lab VMs have only a private NIC and SSH key login; we use Azure Run Command for inspection instead of adding a public IP, NSG, bastion or provisioning connection. The demo cloud-init writes files and does not require package downloads<\/strong>, avoiding additional outbound-networking topics. On AWS the instance also gets no public IP from this configuration, and you must already have a working subnet and management access to inspect guest files.<\/p>\n\n\n\n
        Lab 08 \u2014 Render a Linux shell startup script<\/h2>\n\n\n\n
        Estimated classroom slot:<\/strong> 15 min
        Execution:<\/strong> Local only \u2014 no cloud costs<\/strong><\/p>\n\n\n\n
        Objective:<\/strong> Move from configuration text to a practical Linux startup script; learn to escape shell ${NAME}<\/code> safely.<\/p>\n\n\n\n
        What changed from the previous lab:<\/strong> Reuses the same app_name<\/code> and environment<\/code> idea. File extension stays .tftpl<\/code>, but the rendered result is a shell script.<\/p>\n\n\n\n
        Step 1 \u2014 Understand the folder<\/h3>\n\n\n\n
        labs\/08-shell-script-template\/\n  main.tf\n  templates\/startup.sh.tftpl\n  README.md\n<\/code><\/pre>\n\n\n\n
        Step 2 \u2014 Create\/review each file<\/h3>\n\n\n\n
        main.tf<\/code><\/strong><\/p>\n\n\n\n
        terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n}\n\nvariable \"app_name\" {\n  type    = string\n  default = \"demoapp\"\n}\n\nvariable \"environment\" {\n  type    = string\n  default = \"dev\"\n}\n\noutput \"startup_script\" {\n  value = templatefile(\"${path.module}\/templates\/startup.sh.tftpl\", {\n    app_name    = var.app_name\n    environment = var.environment\n  })\n}\n<\/code><\/pre>\n\n\n\n
        templates\/startup.sh.tftpl<\/code><\/strong><\/p>\n\n\n\n
        #!\/bin\/sh\nset -eu\nAPP_NAME=\"${app_name}\"\nENVIRONMENT=\"${environment}\"\nprintf 'Starting %s in %s\\n' \"$${APP_NAME}\" \"$${ENVIRONMENT}\"\nprintf '%s\\n' \"$${APP_NAME}:$${ENVIRONMENT}\" > \/tmp\/tf-template-bootstrap.txt\n<\/code><\/pre>\n\n\n\n
        Step 3 \u2014 Run and inspect<\/h3>\n\n\n\n
        From the lab folder, use the following commands. Replace placeholder IDs for cloud labs.<\/p>\n\n\n\n
        terraform init -backend=false\nterraform validate\nterraform apply -auto-approve\nterraform output -raw startup_script > \/tmp\/tf-template-startup.sh\nsh -n \/tmp\/tf-template-startup.sh\nsh \/tmp\/tf-template-startup.sh\ncat \/tmp\/tf-template-bootstrap.txt\n<\/code><\/pre>\n\n\n\n
        Expected:<\/strong> The script prints Starting demoapp in dev<\/code>; the file contains demoapp:dev<\/code>.<\/p>\n\n\n\n
        Step 4 \u2014 Student practice<\/h3>\n\n\n\n
        Replace the environment with qa<\/code> and rerender. Verify that the printed script contains literal shell ${APP_NAME}<\/code> after template expansion.<\/p>\n\n\n\n
        Instructor note:<\/strong> The template uses Terraform $${<\/code> escaping for the literal shell<\/em> ${...}<\/code>. This shell script is intentionally harmless and requires no root privileges.<\/p>\n\n\n\n
        Lab 09 \u2014 Build cloud-init without creating a VM<\/h2>\n\n\n\n
        Estimated classroom slot:<\/strong> 20 min
        Execution:<\/strong> Local only \u2014 no cloud costs<\/strong><\/p>\n\n\n\n
        Objective:<\/strong> Reuse templatefile()<\/code> to produce a complete #cloud-config<\/code> document and preview the YAML before provisioning.<\/p>\n\n\n\n
        What changed from the previous lab:<\/strong> Keeps the app\/environment inputs from Lab 08. The output is now cloud-init YAML encoded from an HCL object.<\/p>\n\n\n\n
        Step 1 \u2014 Understand the folder<\/h3>\n\n\n\n
        labs\/09-cloud-init-preview\/\n  main.tf\n  templates\/cloud-init.tftpl\n  README.md\n<\/code><\/pre>\n\n\n\n
        Step 2 \u2014 Create\/review each file<\/h3>\n\n\n\n
        main.tf<\/code><\/strong><\/p>\n\n\n\n
        terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n}\n\nvariable \"app_name\" {\n  type    = string\n  default = \"demoapp\"\n}\n\nvariable \"environment\" {\n  type    = string\n  default = \"dev\"\n}\n\noutput \"cloud_init\" {\n  value = templatefile(\"${path.module}\/templates\/cloud-init.tftpl\", {\n    app_name    = var.app_name\n    environment = var.environment\n  })\n}\n<\/code><\/pre>\n\n\n\n
        templates\/cloud-init.tftpl<\/code><\/strong><\/p>\n\n\n\n
        #cloud-config\n${yamlencode({\n  write_files = [{\n    path        = \"\/etc\/tf-template\/app.conf\"\n    permissions = \"0644\"\n    content     = format(\"name=%s\\nenvironment=%s\\n\", app_name, environment)\n  }]\n  runcmd = [\n    [\"sh\", \"-c\", \"echo READY > \/var\/tmp\/tf-template-ready\"]\n  ]\n})}\n<\/code><\/pre>\n\n\n\n
        Step 3 \u2014 Run and inspect<\/h3>\n\n\n\n
        From the lab folder, use the following commands. Replace placeholder IDs for cloud labs.<\/p>\n\n\n\n
        terraform init -backend=false\nterraform validate\nterraform apply -auto-approve\nterraform output -raw cloud_init > \/tmp\/tf-cloud-init-preview.yaml\nhead -15 \/tmp\/tf-cloud-init-preview.yaml\n<\/code><\/pre>\n\n\n\n
        Expected:<\/strong> Starts with #cloud-config<\/code>, declares \/etc\/tf-template\/app.conf<\/code>, and writes \/var\/tmp\/tf-template-ready<\/code> on first boot.<\/p>\n\n\n\n
        Step 4 \u2014 Student practice<\/h3>\n\n\n\n
        Add a second nonsecret write_files<\/code> entry to the array, preview the YAML, and check the indentation.<\/p>\n\n\n\n
        Instructor note:<\/strong> This lab does not require Azure\/AWS credentials. It teaches cloud-init format without VM setup cost. The cloud-init document is a preview, not something executed locally.<\/p>\n\n\n\n
        Lab 10 \u2014 Azure Ubuntu VM from the cloud-init template<\/h2>\n\n\n\n
        Estimated classroom slot:<\/strong> 40 min
        Execution:<\/strong> Azure deploy \u2014 chargeable<\/strong><\/p>\n\n\n\n
        Objective:<\/strong> Attach the exact Lab 09 template to an actual Azure Linux VM using custom_data = base64encode(templatefile(...))<\/code>.<\/p>\n\n\n\n
        What changed from the previous lab:<\/strong> Same template as Lab 09; only now Azure resources are added: resource group, VNet, subnet, NIC and one Ubuntu VM (5 resources).<\/p>\n\n\n\n
        Step 1 \u2014 Understand the folder<\/h3>\n\n\n\n
        labs\/10-azure-ubuntu-cloud-init\/\n  main.tf\n  templates\/cloud-init.tftpl\n  README.md\n<\/code><\/pre>\n\n\n\n
        Step 2 \u2014 Create\/review each file<\/h3>\n\n\n\n
        main.tf<\/code><\/strong><\/p>\n\n\n\n
        terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \"~> 5.9.0\"\n    }\n  }\n}\n\nprovider \"azurerm\" {\n  features {}\n}\n\nvariable \"location\" {\n  type    = string\n  default = \"eastus\"\n}\n\nvariable \"name_prefix\" {\n  type    = string\n  default = \"tpl-basic\"\n}\n\nvariable \"ssh_public_key_path\" {\n  type    = string\n  default = \"~\/.ssh\/id_ed25519.pub\"\n}\n\nvariable \"app_name\" {\n  type    = string\n  default = \"demoapp\"\n}\n\nvariable \"environment\" {\n  type    = string\n  default = \"dev\"\n}\n\nresource \"azurerm_resource_group\" \"lab\" {\n  name     = \"${var.name_prefix}-rg\"\n  location = var.location\n}\n\nresource \"azurerm_virtual_network\" \"lab\" {\n  name                = \"${var.name_prefix}-vnet\"\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  address_space       = [\"10.80.0.0\/16\"]\n}\n\nresource \"azurerm_subnet\" \"lab\" {\n  name                 = \"${var.name_prefix}-subnet\"\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n  address_prefixes     = [\"10.80.1.0\/24\"]\n}\n\nresource \"azurerm_network_interface\" \"lab\" {\n  name                = \"${var.name_prefix}-nic\"\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  ip_configuration {\n    name                          = \"internal\"\n    subnet_id                     = azurerm_subnet.lab.id\n    private_ip_address_allocation = \"Dynamic\"\n  }\n}\n\nresource \"azurerm_linux_virtual_machine\" \"lab\" {\n  name                  = \"${var.name_prefix}-vm\"\n  location              = azurerm_resource_group.lab.location\n  resource_group_name   = azurerm_resource_group.lab.name\n  size                  = \"Standard_B2s_v2\"\n  admin_username        = \"labadmin\"\n  network_interface_ids = [azurerm_network_interface.lab.id]\n\n  disable_password_authentication = true\n  admin_ssh_key {\n    username   = \"labadmin\"\n    public_key = file(pathexpand(var.ssh_public_key_path))\n  }\n\n  os_disk {\n    caching              = \"ReadWrite\"\n    storage_account_type = \"Standard_LRS\"\n  }\n\n  source_image_reference {\n    publisher = \"Canonical\"\n    offer     = \"ubuntu-26_04-lts\"\n    sku       = \"server\"\n    version   = \"latest\"\n  }\n\n  custom_data = base64encode(templatefile(\"${path.module}\/templates\/cloud-init.tftpl\", {\n    app_name    = var.app_name\n    environment = var.environment\n  }))\n}\n\noutput \"resource_group_name\" {\n  value = azurerm_resource_group.lab.name\n}\n\noutput \"vm_name\" {\n  value = azurerm_linux_virtual_machine.lab.name\n}\n<\/code><\/pre>\n\n\n\n
        templates\/cloud-init.tftpl<\/code><\/strong><\/p>\n\n\n\n
        #cloud-config\n${yamlencode({\n  write_files = [{\n    path        = \"\/etc\/tf-template\/app.conf\"\n    permissions = \"0644\"\n    content     = format(\"name=%s\\nenvironment=%s\\n\", app_name, environment)\n  }]\n  runcmd = [\n    [\"sh\", \"-c\", \"echo READY > \/var\/tmp\/tf-template-ready\"]\n  ]\n})}\n<\/code><\/pre>\n\n\n\n
        Step 3 \u2014 Run and inspect<\/h3>\n\n\n\n
        From the lab folder, use the following commands. Replace placeholder IDs for cloud labs.<\/p>\n\n\n\n
        az login\naz account set --subscription \"YOUR_SUBSCRIPTION_ID\"\nexport ARM_SUBSCRIPTION_ID=\"$(az account show --query id -o tsv)\"\ntest -f \"$HOME\/.ssh\/id_ed25519.pub\"  # Use the preflight key-setup instructions if missing<\/em>\nterraform init\nterraform validate\nterraform plan -out=tfplan\nterraform apply tfplan\naz vm run-command invoke -g \"$(terraform output -raw resource_group_name)\" -n \"$(terraform output -raw vm_name)\" --command-id RunShellScript --scripts \"cloud-init status --wait; cat \/etc\/tf-template\/app.conf; cat \/var\/tmp\/tf-template-ready\"\n<\/code><\/pre>\n\n\n\n
        Expected:<\/strong> One private Ubuntu VM. Run Command should show name=demoapp<\/code>, environment=dev<\/code> and READY<\/code> after cloud-init completes.<\/p>\n\n\n\n
        Step 4 \u2014 Student practice<\/h3>\n\n\n\n
        Change app_name<\/code> to training-app<\/code> and run terraform plan<\/code> only. Identify the VM replacement that custom_data<\/code> would trigger; do not apply an unintended replacement.<\/p>\n\n\n\n
        Instructor note:<\/strong> This VM intentionally has no public IP or inbound SSH rule. Azure Run Command is the verification method. The cloud-init example does not install packages and therefore does not depend on outbound internet. custom_data<\/code> changes normally replace the VM.<\/p>\n\n\n\n
        Cleanup (once your verification is complete):<\/strong><\/p>\n\n\n\n
        terraform plan -destroy\nterraform destroy\n<\/code><\/pre>\n\n\n\n
        Lab 11 \u2014 AWS EC2 user-data with the same shell template<\/h2>\n\n\n\n
        Estimated classroom slot:<\/strong> 25 min
        Execution:<\/strong> AWS deploy \u2014 optional and chargeable<\/strong><\/p>\n\n\n\n
        Objective:<\/strong> Compare the provider interfaces: aws_instance.user_data<\/code> accepts the rendered shell script without wrapping it in base64encode()<\/code>.<\/p>\n\n\n\n
        What changed from the previous lab:<\/strong> Uses the shell template from Lab 08. AWS VPC\/subnet and AMI are external inputs to avoid unrelated networking code.<\/p>\n\n\n\n
        Step 1 \u2014 Understand the folder<\/h3>\n\n\n\n
        labs\/11-aws-ec2-user-data\/\n  main.tf\n  templates\/startup.sh.tftpl\n  README.md\n<\/code><\/pre>\n\n\n\n
        Step 2 \u2014 Create\/review each file<\/h3>\n\n\n\n
        main.tf<\/code><\/strong><\/p>\n\n\n\n
        terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n  required_providers {\n    aws = {\n      source  = \"hashicorp\/aws\"\n      version = \"~> 6.0\"\n    }\n  }\n}\n\nprovider \"aws\" {\n  region = var.aws_region\n}\n\nvariable \"aws_region\" {\n  type    = string\n  default = \"ap-northeast-1\"\n}\n\nvariable \"subnet_id\" {\n  description = \"Existing subnet ID in the selected AWS region.\"\n  type        = string\n}\n\nvariable \"ami_id\" {\n  description = \"Linux AMI ID compatible with the chosen instance type.\"\n  type        = string\n}\n\nvariable \"app_name\" {\n  type    = string\n  default = \"demoapp\"\n}\n\nvariable \"environment\" {\n  type    = string\n  default = \"dev\"\n}\n\nresource \"aws_instance\" \"lab\" {\n  ami                         = var.ami_id\n  instance_type               = \"t3.micro\"\n  subnet_id                   = var.subnet_id\n  associate_public_ip_address = false\n\n  user_data = templatefile(\"${path.module}\/templates\/startup.sh.tftpl\", {\n    app_name    = var.app_name\n    environment = var.environment\n  })\n\n  tags = { Name = \"tf-template-demo\" }\n}\n\noutput \"instance_id\" {\n  value = aws_instance.lab.id\n}\n<\/code><\/pre>\n\n\n\n
        templates\/startup.sh.tftpl<\/code><\/strong><\/p>\n\n\n\n
        #!\/bin\/sh\nset -eu\nAPP_NAME=\"${app_name}\"\nENVIRONMENT=\"${environment}\"\nprintf '%s\\n' \"$${APP_NAME}:$${ENVIRONMENT}\" > \/var\/tmp\/tf-template-bootstrap.txt\n<\/code><\/pre>\n\n\n\n
        Step 3 \u2014 Run and inspect<\/h3>\n\n\n\n
        From the lab folder, use the following commands. Replace placeholder IDs for cloud labs.<\/p>\n\n\n\n
        aws sts get-caller-identity\naws ssm get-parameter --region ap-northeast-1 --name \/aws\/service\/ami-amazon-linux-latest\/al2023-ami-kernel-default-x86_64 --query Parameter.Value --output text\nterraform init\nterraform validate\nterraform plan -var=\"subnet_id=subnet-REPLACE\" -var=\"ami_id=ami-REPLACE\"\n# After replacing IDs: terraform apply -var=\"subnet_id=...\" -var=\"ami_id=...\"<\/em>\n<\/code><\/pre>\n\n\n\n
        Expected:<\/strong> An EC2 instance using a rendered startup script. No public IP or incoming rules are provisioned by this lab.<\/p>\n\n\n\n
        Step 4 \u2014 Student practice<\/h3>\n\n\n\n
        Compare Azure custom_data = base64encode(templatefile(...))<\/code> with AWS user_data = templatefile(...)<\/code>. Explain why only Azure is encoded explicitly.<\/p>\n\n\n\n
        Instructor note:<\/strong> Optional AWS companion. Requires a compatible Linux AMI and an existing subnet where an instance can launch. Verification inside the guest requires pre-existing management access such as SSM; this lab does not configure a key pair, SSM role or inbound security group.<\/p>\n\n\n\n
        Cleanup (once your verification is complete):<\/strong><\/p>\n\n\n\n
        terraform plan -destroy\nterraform destroy\n<\/code><\/pre>\n\n\n\n
        \n\n\n\n
        Module 6 \u2014 Best Practices and Real-World Design<\/h1>\n\n\n\n
        Design principles for production-quality templates<\/h2>\n\n\n\n
          \n
        1. Put\u00a0.tftpl<\/code>\u00a0files in a predictable\u00a0templates\/<\/code>\u00a0directory, separate from\u00a0main.tf<\/code>.<\/li>\n\n\n\n
        2. Render text in\u00a0locals<\/code>\u00a0where multiple templates need to be composed; avoid nested or recursive\u00a0templatefile()<\/code>\u00a0calls.<\/li>\n\n\n\n
        3. Use descriptive keys such as\u00a0environment<\/code>,\u00a0app_config<\/code>, or\u00a0health_script<\/code>. Don’t pass everything simply because it exists.<\/li>\n\n\n\n
        4. Prefer\u00a0jsonencode<\/code>\u00a0or\u00a0yamlencode<\/code>\u00a0for machine-readable formats. Let Terraform escape strings and build valid syntax.<\/li>\n\n\n\n
        5. Keep secrets out of templates, scripts, logs,\u00a0terraform output<\/code>, user data and local previews. Terraform state and saved plans can contain rendered secret values even when CLI output is hidden.<\/li>\n\n\n\n
        6. Validate the generated artifact, not just the HCL syntax: JSON parser for JSON, YAML parser for cloud-init,\u00a0sh -n<\/code>\u00a0for shell scripts and actual guest\/agent checks after provisioning.<\/li>\n\n\n\n
        7. Make first-boot scripts safe to retry where possible. User data\/cloud-init normally runs only at first boot, and changes can have provider-specific replacement behavior.<\/li>\n\n\n\n
        8. Add a focused test case for both sides of conditionals, empty and nonempty lists\/maps, and strings containing quotes or special characters.<\/li>\n\n\n\n
        9. Minimize unnecessary complexity: a one-line string does not need a\u00a0.tftpl<\/code>\u00a0file; avoid creating modules for a 5-line one-off template.<\/li>\n\n\n\n
        10. Keep templates small and content-based. Do not turn them into alternative infrastructure management or put access credentials inside them.<\/li>\n<\/ol>\n\n\n\n
          Final scenario<\/h2>\n\n\n\n
          A team needs to configure a newly provisioned Ubuntu VM with a small application configuration file and a health-check script. Three templates accomplish the content generation, while Terraform still creates just five Azure resources. The main teaching point is template composition.<\/strong><\/p>\n\n\n\n
          Lab 12 \u2014 Capstone: compose three templates into one Azure VM<\/h2>\n\n\n\n
          Estimated classroom slot:<\/strong> 45 min
          Execution:<\/strong> Azure deploy \u2014 chargeable<\/strong><\/p>\n\n\n\n
          Objective:<\/strong> Generate application config and a health-check script, then embed both in cloud-init while keeping Azure infrastructure unchanged.<\/p>\n\n\n\n
          What changed from the previous lab:<\/strong> Extends the Lab 10 VM pattern with three small .tftpl<\/code> files and one locals<\/code> block. It still creates only the same five kinds of Azure resources.<\/p>\n\n\n\n
          Step 1 \u2014 Understand the folder<\/h3>\n\n\n\n
          labs\/12-azure-capstone-composition\/\n  main.tf\n  templates\/app.conf.tftpl\n  templates\/health.sh.tftpl\n  templates\/cloud-init.tftpl\n  README.md\n<\/code><\/pre>\n\n\n\n
          Step 2 \u2014 Create\/review each file<\/h3>\n\n\n\n
          main.tf<\/code><\/strong><\/p>\n\n\n\n
          terraform {\n  required_version = \">= 1.15.0, < 2.0.0\"\n  required_providers {\n    azurerm = {\n      source  = \"hashicorp\/azurerm\"\n      version = \"~> 5.9.0\"\n    }\n  }\n}\n\nprovider \"azurerm\" {\n  features {}\n}\n\nvariable \"location\" {\n  type    = string\n  default = \"eastus\"\n}\n\nvariable \"name_prefix\" {\n  type    = string\n  default = \"tpl-final\"\n}\n\nvariable \"ssh_public_key_path\" {\n  type    = string\n  default = \"~\/.ssh\/id_ed25519.pub\"\n}\n\nvariable \"app_name\" {\n  type    = string\n  default = \"demoapp\"\n}\n\nvariable \"environment\" {\n  type    = string\n  default = \"dev\"\n}\n\nvariable \"port\" {\n  type    = number\n  default = 8080\n}\n\nvariable \"enable_monitoring\" {\n  type    = bool\n  default = true\n}\n\nvariable \"settings\" {\n  type    = map(string)\n  default = { log_level = \"info\", workers = \"2\" }\n}\n\nlocals {\n  app_config = templatefile(\"${path.module}\/templates\/app.conf.tftpl\", {\n    name              = var.app_name\n    environment       = var.environment\n    port              = var.port\n    enable_monitoring = var.enable_monitoring\n    settings          = var.settings\n  })\n\n  health_script = templatefile(\"${path.module}\/templates\/health.sh.tftpl\", {\n    name = var.app_name\n  })\n\n  cloud_init = templatefile(\"${path.module}\/templates\/cloud-init.tftpl\", {\n    app_config    = local.app_config\n    health_script = local.health_script\n  })\n}\n\nresource \"azurerm_resource_group\" \"lab\" {\n  name     = \"${var.name_prefix}-rg\"\n  location = var.location\n}\n\nresource \"azurerm_virtual_network\" \"lab\" {\n  name                = \"${var.name_prefix}-vnet\"\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n  address_space       = [\"10.80.0.0\/16\"]\n}\n\nresource \"azurerm_subnet\" \"lab\" {\n  name                 = \"${var.name_prefix}-subnet\"\n  resource_group_name  = azurerm_resource_group.lab.name\n  virtual_network_name = azurerm_virtual_network.lab.name\n  address_prefixes     = [\"10.80.1.0\/24\"]\n}\n\nresource \"azurerm_network_interface\" \"lab\" {\n  name                = \"${var.name_prefix}-nic\"\n  location            = azurerm_resource_group.lab.location\n  resource_group_name = azurerm_resource_group.lab.name\n\n  ip_configuration {\n    name                          = \"internal\"\n    subnet_id                     = azurerm_subnet.lab.id\n    private_ip_address_allocation = \"Dynamic\"\n  }\n}\n\nresource \"azurerm_linux_virtual_machine\" \"lab\" {\n  name                  = \"${var.name_prefix}-vm\"\n  location              = azurerm_resource_group.lab.location\n  resource_group_name   = azurerm_resource_group.lab.name\n  size                  = \"Standard_B2s_v2\"\n  admin_username        = \"labadmin\"\n  network_interface_ids = [azurerm_network_interface.lab.id]\n\n  disable_password_authentication = true\n  admin_ssh_key {\n    username   = \"labadmin\"\n    public_key = file(pathexpand(var.ssh_public_key_path))\n  }\n\n  os_disk {\n    caching              = \"ReadWrite\"\n    storage_account_type = \"Standard_LRS\"\n  }\n\n  source_image_reference {\n    publisher = \"Canonical\"\n    offer     = \"ubuntu-26_04-lts\"\n    sku       = \"server\"\n    version   = \"latest\"\n  }\n\n  custom_data = base64encode(local.cloud_init)\n}\n\noutput \"resource_group_name\" {\n  value = azurerm_resource_group.lab.name\n}\n\noutput \"vm_name\" {\n  value = azurerm_linux_virtual_machine.lab.name\n}\n\noutput \"config_preview\" {\n  value = local.app_config\n}\n\noutput \"cloud_init_sha256\" {\n  value = sha256(local.cloud_init)\n}\n<\/code><\/pre>\n\n\n\n
          templates\/app.conf.tftpl<\/code><\/strong><\/p>\n\n\n\n
          name=${name}\nenvironment=${environment}\nport=${port}\n%{ if enable_monitoring ~}\nmonitoring=enabled\n%{ else ~}\nmonitoring=disabled\n%{ endif ~}\n%{ for key, value in settings ~}\n${key}=${value}\n%{ endfor ~}\n<\/code><\/pre>\n\n\n\n
          templates\/health.sh.tftpl<\/code><\/strong><\/p>\n\n\n\n
          #!\/bin\/sh\nset -eu\ntest -f \/etc\/tf-template\/app.conf\nprintf '%s\\n' 'healthy: ${name}' > \/var\/tmp\/tf-template-health\n<\/code><\/pre>\n\n\n\n
          templates\/cloud-init.tftpl<\/code><\/strong><\/p>\n\n\n\n
          #cloud-config\n${yamlencode({\n  write_files = [\n    {\n      path        = \"\/etc\/tf-template\/app.conf\"\n      permissions = \"0644\"\n      content     = app_config\n    },\n    {\n      path        = \"\/usr\/local\/bin\/tf-template-health.sh\"\n      permissions = \"0755\"\n      content     = health_script\n    }\n  ]\n  runcmd = [[\"\/usr\/local\/bin\/tf-template-health.sh\"]]\n})}\n<\/code><\/pre>\n\n\n\n
          Step 3 \u2014 Run and inspect<\/h3>\n\n\n\n
          From the lab folder, use the following commands. Replace placeholder IDs for cloud labs.<\/p>\n\n\n\n
          az login\nexport ARM_SUBSCRIPTION_ID=\"$(az account show --query id -o tsv)\"\nterraform init\nterraform validate\nterraform console  # inspect local.app_config and local.cloud_init; type exit to quit<\/em>\nterraform plan -out=tfplan\nterraform apply tfplan\naz vm run-command invoke -g \"$(terraform output -raw resource_group_name)\" -n \"$(terraform output -raw vm_name)\" --command-id RunShellScript --scripts \"cloud-init status --wait; cat \/etc\/tf-template\/app.conf; cat \/var\/tmp\/tf-template-health\"\n<\/code><\/pre>\n\n\n\n
          Expected:<\/strong> Azure VM has \/etc\/tf-template\/app.conf<\/code> with map entries and conditionals; cloud-init runs the script and writes healthy: demoapp<\/code>.<\/p>\n\n\n\n
          Step 4 \u2014 Student practice<\/h3>\n\n\n\n
          Change enable_monitoring<\/code> to false<\/code> and add owner = \"platform\"<\/code> to settings<\/code>. Use terraform console<\/code> to review rendered content before<\/em> any apply. In a real deployed VM this custom-data change can require replacement.<\/p>\n\n\n\n
          Instructor note:<\/strong> The three templates are composed by Terraform locals<\/code>; the templates do not recursively call templatefile<\/code>. Two separate previews help verify content before cloud creation. The example deliberately keeps package installation and inbound networking outside scope.<\/p>\n\n\n\n
          Cleanup (once your verification is complete):<\/strong><\/p>\n\n\n\n
          terraform plan -destroy\nterraform destroy\n<\/code><\/pre>\n\n\n\n
          \n\n\n\n
          Review, validation, assessment and common pitfalls<\/h1>\n\n\n\n
          End-to-end step-by-step runbook<\/h2>\n\n\n\n
            \n
          1. Extract the ZIP and read this guide plus\u00a0README.md<\/code>.<\/li>\n\n\n\n
          2. Start with\u00a0labs\/01-inline-interpolation<\/code>. Execute\u00a0terraform init -backend=false<\/code>,\u00a0terraform validate<\/code>,\u00a0terraform apply<\/code>, and\u00a0terraform output<\/code>.<\/li>\n\n\n\n
          3. Move through Labs 02\u201307. Focus on the exact\u00a0new line(s)<\/strong>\u00a0added in each folder. Use\u00a0terraform console<\/code>\u00a0to examine expressions.<\/li>\n\n\n\n
          4. Run Lab 08; render the script locally; syntax-check it with\u00a0sh -n<\/code>; run only this harmless demo in your own shell.<\/li>\n\n\n\n
          5. Run Lab 09; preview cloud-init output. Do not apply any cloud resources until you have inspected the generated YAML.<\/li>\n\n\n\n
          6. Run Azure Lab 10 only if you have a budget and permission. Verify via Azure Run Command; destroy it afterward.<\/li>\n\n\n\n
          7. Optionally run AWS Lab 11 using your own existing subnet and matching AMI. Do not assume it has SSH or internet.<\/li>\n\n\n\n
          8. Run the final composition Lab 12 if you wish to do the complete cloud exercise. Verify the generated configuration in the guest, then destroy it.<\/li>\n\n\n\n
          9. Ask students to explain where string rendering happens versus where a VM’s first-boot agent executes scripts.<\/li>\n<\/ol>\n\n\n\n
            Quick reference: template syntax<\/h2>\n\n\n\n
            Intent<\/th>Syntax<\/th>Example<\/th><\/tr><\/thead>
            Insert a value<\/td>${...}<\/code><\/td>name=${app.name}<\/code><\/td><\/tr>
            Apply a function<\/td>${...}<\/code><\/td>${upper(name)}<\/code><\/td><\/tr>
            Conditional<\/td>%{ if }<\/code> \/ %{ else }<\/code> \/ %{ endif }<\/code><\/td>See Lab 04<\/td><\/tr>
            Repeat a list<\/td>%{ for item in items }<\/code> \/ %{ endfor }<\/code><\/td>See Lab 05<\/td><\/tr>
            Repeat a map<\/td>%{ for key, value in map }<\/code> \/ %{ endfor }<\/code><\/td>See Lab 06<\/td><\/tr>
            Strip whitespace after sequence<\/td>~}<\/code><\/td>%{ for item in items ~}<\/code><\/td><\/tr>
            Strip whitespace before sequence<\/td>%{~<\/code><\/td>%{~ endif }<\/code><\/td><\/tr>
            Literal shell ${HOME}<\/code> in output<\/td>$${HOME}<\/code><\/td>See Lab 08<\/td><\/tr>
            Literal %{ if ... }<\/code> in output<\/td>%%{ if ... }<\/code><\/td>Only when emitting template-like text literally<\/td><\/tr>
            Render a file<\/td>templatefile(path, vars)<\/code><\/td>See Lab 02<\/td><\/tr>
            Safe JSON\/YAML<\/td>jsonencode<\/code>, yamlencode<\/code><\/td>See Labs 07, 09<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
            Artifact inspection examples<\/h2>\n\n\n\n
            After running the corresponding local labs:<\/p>\n\n\n\n
            # Lab 07: structured JSON check<\/em>\nterraform output -raw config_json | python3 -m json.tool\n\n# Lab 08: shell syntax check (after changing to Lab 08 folder)<\/em>\nterraform output -raw startup_script > \/tmp\/tf-template-startup.sh\nsh -n \/tmp\/tf-template-startup.sh\n\n# Lab 09: rendered cloud-init header<\/em>\nterraform output -raw cloud_init | head -20\n<\/code><\/pre>\n\n\n\n
            For a YAML parser, use your environment’s existing YAML tooling; Python’s yaml.safe_load()<\/code> is available only when the optional PyYAML<\/code> package is installed. Plain terraform validate<\/code> cannot<\/strong> prove that a rendered script will execute correctly or that a guest can access a network package repository.<\/p>\n\n\n\n
            Example trainer demonstration: the exact Azure vs AWS difference<\/h2>\n\n\n\n
            # Azure (Linux VM): Base64-encode the rendered cloud-init file.\ncustom_data = base64encode(templatefile(\"${path.module}\/templates\/cloud-init.tftpl\", {\n  app_name    = var.app_name\n  environment = var.environment\n}))\n\n# AWS (EC2): Supply the plain rendered script to user_data.\nuser_data = templatefile(\"${path.module}\/templates\/startup.sh.tftpl\", {\n  app_name    = var.app_name\n  environment = var.environment\n})\n<\/code><\/pre>\n\n\n\n
            Azure migration warning if you reuse your OLD 13-resource lab<\/h2>\n\n\n\n
            Your earlier state managed a Windows VM and an Ubuntu VM plus networking. Do not paste the new five-resource lab into that state<\/strong>: names, Terraform addresses, CIDRs and authentication assumptions are different. If you instead add custom_data<\/code> to an already-created<\/strong> azurerm_linux_virtual_machine.ubuntu<\/code> resource, AzureRM typically treats the custom-data change as ForceNew<\/strong>, which leads to VM replacement; that is not an innocuous in-place text update. Export\/secure your old state and review every proposed change carefully. For teaching, use the supplied standalone Lab 10 or Lab 12 directory.<\/p>\n\n\n\n
            Common mistakes and repair strategies<\/h2>\n\n\n\n
            Symptom<\/th>Likely cause<\/th>Resolution<\/th><\/tr><\/thead>
            Terraform says file not found<\/td>Wrong path or filename<\/td>Check templates\/*.tftpl<\/code>; use ${path.module}<\/code><\/td><\/tr>
            Template says key env<\/code> missing<\/td>Passed environment<\/code> instead of env<\/code><\/td>Make keys match exactly<\/td><\/tr>
            ${HOME}<\/code> fails or becomes Terraform syntax<\/td>Bash expansion was mistaken for Terraform<\/td>Write $${HOME}<\/code> in a .tftpl<\/code> file<\/td><\/tr>
            ${var.app_name}<\/code> fails in a .tftpl<\/code> file<\/td>var<\/code> object was never passed<\/td>Use ${app_name}<\/code> after passing app_name = var.app_name<\/code><\/td><\/tr>
            Weird empty lines in config<\/td>Directive lines add literal newlines<\/td>Use whitespace trim markers like %{ for x in xs ~}<\/code><\/td><\/tr>
            JSON\/YAML parser rejects output<\/td>Handwritten quoting, indentation, escaping<\/td>Use jsonencode()<\/code> or yamlencode()<\/code><\/td><\/tr>
            Azure VM plan shows -\/+<\/code><\/td>Changed custom_data<\/code> \/ image \/ other ForceNew field<\/td>Stop; inspect replacement before applying<\/td><\/tr>
            Cloud-init file missing after deploy<\/td>Cloud-init not finished or script failed<\/td>Use cloud-init status --wait<\/code>, inspect guest logs<\/td><\/tr>
            AWS user-data didn’t run on reboot<\/td>First-boot behavior is the default<\/td>Don’t confuse configuration with a recurring service<\/td><\/tr>
            Terraform state contains rendered credentials<\/td>Secrets were interpolated into files\/plan<\/td>Remove secrets; use cloud-native secret delivery and protect\/revoke exposed credentials<\/td><\/tr>
            Ubuntu VM image or size rejected<\/td>Not available in selected Azure region\/subscription<\/td>Check az vm image list<\/code>, az vm list-skus<\/code>, quota\/policy; choose an approved image\/SKU<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
            Security, operations and cost notes<\/h2>\n\n\n\n