Challenge - Validate and Secure a Terraform Configuration

Terraform applies whatever configuration it is given. If a variable accepts any string, it will happily pass a malformed region or an out-of-range count straight through to the provider, and the failure surfaces halfway through an apply as an opaque API error. If an output holds a connection string, Terraform prints it to the terminal and writes it to state in plain text, where it lands in CI logs and shared state backends. The language ships with guardrails for exactly these problems, but they are opt-in: nothing turns them on for you.

Those guardrails come in layers. validation blocks constrain a variable at parse time, rejecting bad input with a message you write before any change is attempted. The sensitive argument suppresses a value in CLI output and plan diffs. precondition and postcondition blocks assert what must be true before and after a resource is handled, failing the run when reality diverges from the assumption. Standalone check blocks go further, validating infrastructure assumptions on every plan and apply, independent of any single resource's lifecycle. Together they turn a configuration that merely works into one that fails fast, explains itself, and keeps its secrets.

By completing this Intermediate challenge, you will be able to:

• Constrain variable inputs so invalid values are rejected before any change is attempted, with actionable feedback
• Prevent credential-bearing values from appearing in CLI output and state diffs, and confirm a plan masks them rather than printing them
• Assert that a provisioned resource ended up in the expected state after it is created
• Add standalone, continuous assertions that validate infrastructure assumptions independent of any resource lifecycle

Prerequisites

Before attempting this challenge, you should be comfortable with:

• Writing and editing Terraform configuration files (HCL syntax)
• Working with Terraform variables, outputs, and data sources
• Running Terraform CLI commands (init, plan)