Terraform Cheatsheet: Providers, State and Modules Reference

# Install
brew tap hashicorp/tap && brew install hashicorp/tap/terraform
# Alternative: open-source fork
brew install opentofu                   # tofu is a drop-in for `terraform`

# New project
mkdir infra && cd infra
terraform fmt -recursive
terraform init                          # downloads providers + initialises backend
terraform validate
terraform plan -out=tfplan
terraform apply tfplan
terraform destroy

# Inspect state
terraform state list
terraform state show aws_s3_bucket.assets
terraform output -json

# Auth (cloud)
export AWS_PROFILE=prod
export ARM_USE_CLI=true
gcloud auth application-default login

terraform {
  required_version = ">= 1.7"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.60"
    }
    random = { source = "hashicorp/random", version = "~> 3.6" }
  }

  backend "s3" {
    bucket         = "acme-tf-state"
    key            = "prod/app.tfstate"
    region         = "us-east-1"
    dynamodb_table = "tf-locks"
    encrypt        = true
  }
}

provider "aws" {
  region = "us-east-1"
  default_tags {
    tags = {
      Owner    = "platform"
      Env      = "prod"
      ManagedBy = "terraform"
    }
  }
}

# Pinned provider versions + remote, locked, encrypted state.
# `terraform init -upgrade` updates within the version constraint.

# modules/s3-bucket/main.tf
variable "name"        { type = string }
variable "force_destroy" {
  type    = bool
  default = false
}

resource "aws_s3_bucket" "this" {
  bucket        = var.name
  force_destroy = var.force_destroy
}

resource "aws_s3_bucket_public_access_block" "this" {
  bucket                  = aws_s3_bucket.this.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

output "arn"    { value = aws_s3_bucket.this.arn }
output "bucket" { value = aws_s3_bucket.this.id }

# envs/prod/main.tf — using the module
module "assets" {
  source  = "../../modules/s3-bucket"
  name    = "acme-assets-prod"
}

output "assets_bucket" {
  value = module.assets.bucket
}

# main.tf — VPC + S3 bucket + KMS key, with for_each + tags.
terraform {
  required_version = ">= 1.7"
  required_providers { aws = { source = "hashicorp/aws", version = "~> 5.60" } }
}

provider "aws" { region = "us-east-1" }

variable "env"      { type = string  default = "dev" }
variable "buckets"  {
  type    = map(string)
  default = { assets = "private", logs = "private" }
}

locals { name_prefix = "acme-${var.env}" }

resource "aws_kms_key" "primary" {
  description             = "${local.name_prefix} primary key"
  deletion_window_in_days = 30
  enable_key_rotation     = true
}

resource "aws_s3_bucket" "this" {
  for_each       = var.buckets
  bucket         = "${local.name_prefix}-${each.key}"
  force_destroy  = var.env != "prod"
}

resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
  for_each = aws_s3_bucket.this
  bucket   = each.value.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.primary.arn
    }
  }
}

output "buckets" {
  value = { for k, b in aws_s3_bucket.this : k => b.id }
}