Modern Guide to Learning Terraform & OpenTofu

# 1. Fetch latest Ubuntu AMI
data "aws_ami" "ubuntu" {
  most_recent = true
  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"]
  }
  owners = ["099720109477"] # Canonical
}

# 2. Provision EC2 Instance
resource "aws_instance" "web" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t3.micro"
  vpc_security_group_ids = [aws_security_group.web_sg.id]

  user_data = <<-EOF
              #!/bin/bash
              apt-get update
              apt-get install -y nginx git
              git clone https://github.com/example/repo.git /var/www/html/repo
              systemctl start nginx
              EOF
}

# 3. Security Group (Open 80 & 443)
resource "aws_security_group" "web_sg" {
  name = "web-sg"
  dynamic "ingress" {
    for_each = [80, 443]
    content {
      from_port   = ingress.value
      to_port     = ingress.value
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# 1. Fetch latest Ubuntu Image
data "google_compute_image" "ubuntu" {
  family  = "ubuntu-2204-lts"
  project = "ubuntu-os-cloud"
}

# 2. Provision Compute Engine Instance
resource "google_compute_instance" "web" {
  name         = "web-server"
  machine_type = "e2-micro"
  zone         = "us-central1-a"

  # GCP uses network tags to attach firewall rules
  tags = ["http-server", "https-server"]

  boot_disk {
    initialize_params { image = data.google_compute_image.ubuntu.self_link }
  }

  network_interface {
    network = "default"
    access_config {} # Assigns Ephemeral Public IP
  }

  metadata_startup_script = <<-EOF
                            #!/bin/bash
                            apt-get update
                            apt-get install -y nginx git
                            git clone https://github.com/example/repo.git /var/www/html/repo
                            systemctl start nginx
                            EOF
}

# 3. Firewall Rule (Open 80 & 443)
resource "google_compute_firewall" "web_firewall" {
  name    = "allow-web"
  network = "default"

  allow {
    protocol = "tcp"
    ports    = ["80", "443"]
  }

  source_ranges = ["0.0.0.0/0"]
  target_tags   = ["http-server", "https-server"]
}

# Azure requires explicit creation of Network Interfaces (NICs)
resource "azurerm_network_interface" "web_nic" {
  name                = "web-nic"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.sub.id
    private_ip_address_allocation = "Dynamic"
    public_ip_address_id          = azurerm_public_ip.pub.id
  }
}

# 1. Provision Virtual Machine
resource "azurerm_linux_virtual_machine" "web" {
  name                = "web-server"
  resource_group_name = azurerm_resource_group.rg.name
  location            = azurerm_resource_group.rg.location
  size                = "Standard_B1s"
  admin_username      = "adminuser"
  network_interface_ids = [azurerm_network_interface.web_nic.id]

  admin_ssh_key {
    username   = "adminuser"
    public_key = file("~/.ssh/id_rsa.pub")
  }

  source_image_reference {
    publisher = "Canonical"
    offer     = "0001-com-ubuntu-server-jammy"
    sku       = "22_04-lts-gen2"
    version   = "latest"
  }

  # Gotcha: Azure requires base64 encoding for custom_data (cloud-init)
  custom_data = base64encode(<<-EOF
                #!/bin/bash
                apt-get update
                apt-get install -y nginx git
                git clone https://github.com/example/repo.git /var/www/html/repo
                systemctl start nginx
                EOF)
}

# 2. Network Security Group (Open 80 & 443)
resource "azurerm_network_security_group" "web_nsg" {
  name                = "web-nsg"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name

  security_rule {
    name                       = "AllowWeb"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_ranges    = ["80", "443"]
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }
}

variable "bucket_names" {
  type    = set(string)
  default = ["assets", "logs", "backups"]
}

resource "aws_s3_bucket" "buckets" {
  for_each      = var.bucket_names
  bucket        = "my-company-${each.key}-2026"
  force_destroy = false

  tags = {
    Environment = "Production"
    Purpose     = each.key
  }
}

variable "bucket_names" {
  type    = set(string)
  default = ["assets", "logs", "backups"]
}

resource "google_storage_bucket" "buckets" {
  for_each      = var.bucket_names
  name          = "my-company-${each.key}-2026"
  location      = "US"
  force_destroy = false

  # Uniform bucket-level access is a modern GCP best practice
  uniform_bucket_level_access = true

  labels = {
    environment = "production"
    purpose     = each.key
  }
}

# Azure groups "buckets" (containers) inside a Storage Account
resource "azurerm_storage_account" "main" {
  name                     = "mycompanystorage2026"
  resource_group_name      = azurerm_resource_group.rg.name
  location                 = azurerm_resource_group.rg.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

variable "container_names" {
  type    = set(string)
  default = ["assets", "logs", "backups"]
}

resource "azurerm_storage_container" "containers" {
  for_each              = var.container_names
  name                  = each.key
  storage_account_name  = azurerm_storage_account.main.name
  container_access_type = "private"
}