Terraform Professional study plan
Terraform Professional · Give each week a clear focus.
8 weeks · About 8 hours per week
Author and refactor Terraform configuration (expressions, functions, dynamic blocks, validation, lifecycle)
Rewrite a flat 300-line root configuration using for expressions, splat expressions, conditionals, and nested function calls instead of copy-pasted blocks
Replace repeated resource blocks with dynamic blocks driven by typed list and map variables, including iterator and labels arguments
Add validation blocks to every input variable, covering string length, regex, CIDR format, and cross-variable checks via precondition
Use terraform console to prove out at least 15 built-in functions (lookup, try, can, flatten, merge, cidrsubnet, setproduct) before wiring them into config
Your checkpoint
A refactored repository where terraform fmt and terraform validate pass cleanly, terraform plan produces zero diff against the pre-refactor apply, and a written changelog lists each block converted to a dynamic block or expression.
Author and refactor Terraform configuration (expressions, functions, dynamic blocks, validation, lifecycle) & Manage Terraform state, backends, and state operations
Apply lifecycle meta-arguments (create_before_destroy, prevent_destroy, ignore_changes, replace_triggered_by) and demonstrate each in a plan output
Write preconditions and postconditions that fail on intentionally bad data, and capture the error messages
Convert imperative renames into moved blocks and confirm the plan shows a move rather than destroy/create
Use import blocks to adopt two hand-created resources into state, then remove the blocks and verify no drift
Drill terraform state list, show, mv, rm, and pull against a local backend to inspect and surgically edit state
Your checkpoint
A recorded state-surgery exercise in which three renamed resources are moved with moved blocks and the resulting plan shows 3 moves, 0 destroys, plus a short note on what each lifecycle rule protects against.
Manage Terraform state, backends, and state operations
Configure a remote backend with state locking and encryption, then verify that a second concurrent apply blocks as expected
Recover from a simulated stale lock using force-unlock and document the exact steps
Split a monolithic state into two state files and wire them together with terraform_remote_state or data sources
Compare CLI workspaces against separate root modules with distinct state, and pick the right pattern for two named environments
Run terraform refresh / plan -refresh-only to reconcile and describe drift after manually changing a real resource
Your checkpoint
A state-operations runbook containing five verified procedures (lock recovery, state split, remote state reference, drift reconciliation, state backup and restore), each with the commands you actually ran and their output.
Design, publish, and consume reusable modules
Design a module interface: typed variables with validation, sensible defaults, and outputs that expose only what consumers need
Extract an existing configuration into a reusable module and consume it twice from the same root with different inputs
Publish the module to a version-controlled source and pin consumers to a specific tag
Instantiate the module with for_each and wire per-instance outputs through to downstream resources
Write a module README and a runnable examples directory using terraform-docs conventions
Your checkpoint
A tagged v1.0.0 module consumed from a pinned git tag by two separate root configurations, both of which pass plan with no warnings, plus a README documenting every input and output.
Collaborate using HCP Terraform / Terraform Enterprise (workspaces, VCS-driven runs, variables, run triggers)
Create two VCS-connected workspaces and drive a run end to end from a pull request through speculative plan to apply on merge
Organize variables into a shared variable set, marking credentials sensitive and scoping the set to the right workspaces
Configure a run trigger so a successful apply in the upstream workspace queues a downstream run
Use the CLI-driven workflow with remote runs and compare its behavior against local execution
Audit run history, plan output, and state versions to answer who changed what and when
Your checkpoint
Two linked workspaces with a working run trigger, a scoped variable set, and a written run log of three consecutive runs showing the trigger chain firing and the sensitive values masked.
Manage providers, dependency locking, and Terraform version constraints
Pin provider versions with pessimistic constraints and required_version, then justify each constraint in a comment
Generate and commit a dependency lock file for linux_amd64, darwin_arm64, and windows_amd64 using terraform providers lock
Alias a second provider configuration and route specific resources to it explicitly
Execute a controlled upgrade with terraform init -upgrade and diff the lock file before and after
Configure a filesystem mirror or network mirror in the CLI config and confirm installs succeed without the public registry
Your checkpoint
A committed lock file covering three platforms plus a written upgrade procedure that was executed successfully against a deliberately bumped constraint, with the before/after lock-file diff attached.
Secure and test configurations (sensitive data handling, policy as code, native testing framework)
Mark credentials and derived values sensitive throughout variables, locals, and outputs, and verify redaction in plan, apply, and state
Write a policy-as-code rule that blocks a plan when a storage resource is public or unencrypted, and prove it fails a noncompliant plan
Build a terraform test suite with .tftest.hcl using run blocks, assertions, and mock providers so no real infrastructure is created
Add static scanning and a secret check to a CI pipeline that fails on a hardcoded credential
Explain where sensitive values still land in plaintext and design the backend controls that mitigate it
Your checkpoint
A green five-test terraform test suite using mocked providers, a policy check that blocks one intentionally noncompliant plan with a readable message, and a CI config that fails on a planted secret.
Author and refactor Terraform configuration (expressions, functions, dynamic blocks, validation, lifecycle) & Manage Terraform state, backends, and state operations & Design, publish, and consume reusable modules & Collaborate using HCP Terraform / Terraform Enterprise (workspaces, VCS-driven runs, variables, run triggers) & Manage providers, dependency locking, and Terraform version constraints & Secure and test configurations (sensitive data handling, policy as code, native testing framework)
Sit two timed full-length mock exams covering all six domains and score at least 85% on the second
Re-drill every missed question back to the specific command or language feature it tested
Re-run your own domain deliverables (refactor repo, state runbook, module, tests) from scratch without notes
Close the two weakest domains with targeted hands-on labs rather than rereading
Your checkpoint
A scored results sheet for both mocks with per-domain accuracy, a remediation list showing each weak objective closed by a lab you completed, and a final pass on all prior deliverables.
Milestones
Week 2: Plan output on the refactor repo shows zero unintended diffs, and the state-surgery exercise reports 3 moves with 0 destroys.
Week 4: Score at least 80% on a self-written 30-question quiz covering domains 1 through 3, and both root configurations consuming the tagged module plan cleanly.
Week 6: The run trigger chain fires end to end in HCP Terraform, and the multi-platform lock file installs successfully on a clean machine.
Week 7: The terraform test suite passes with mocked providers and the policy check blocks the noncompliant plan as designed.
Week 8: Second timed mock exam scores at least 85% overall with no single domain below 70%.