04 · Infrastructure as CodeLab 28 / 59
Challengeterraform
Terraform Validation, Linting & CI — Challenge
Build the gate that runs before every apply: format, validate, lint, scan, and a plan a human approves.
- Time
- 25 min
- Level
- Intermediate
- Objectives
- 4 objectives
- Cost
- Free
Where this fits in the platform
Already built
This lab adds
- A plan that runs in CI, so drift is caught before apply
Which lets you
—
Before you start
You will need
- Terraform >= 1.6
- tflint
- trivy or checkov
- A GitHub repository
You do not need these already — the lab environment below provides them.
You will be able to
- Chain the checks that catch a bad change before it reaches AWS
- Apply exactly the plan that was reviewed
- Detect drift on a schedule rather than during an incident
Cost — Free
— everything here runs without creating infrastructure. `plan` reads AWS but changes nothing.
The goal#
Achieve the same outcome as Terraform Validation, Linting & CI, from an empty starting point, without the steps.
Terraform runs from someone's laptop. Reviews read the HCL, not the plan, so nobody notices the -/+ that would recreate the database until it happens.
This lab puts the checks in front of the apply.
Hands-on environment
Run this lab in a real terminal, free and in your browser. The environment is temporary and yours alone — break it as much as you like.
Start the challengeOpens in Killercoda, in a new tab — keep this page open for the steps.
This is the guided lab's environment — the same machine, with its walkthrough on the left. Work from the task above and leave those steps alone until you are done, or you are reading the answers.
Run it on your own machine
Run this lab on your own machine. One command starts the environment, with everything the lab needs already installed:
You will need:
- terraform
- docker
git clone https://github.com/EgyKode/EgyKode-lab.git
cd EgyKode-lab
./egykode start
./egykode shellYou need Docker and Git installed. Everything else runs inside the environment. The first start downloads it and takes a few minutes; later starts are seconds.
Not sure what you already have? Run: npm run doctor — it checks and changes nothing.
Anything you tick here is your own record. EgyKode cannot see inside that terminal, so the success criteria stay self-assessed even when the environment checks your work for you.
What must be true when you are done
Step 1 of 3
What must be true when you are done#
fmt,validate,tflintand a security scan all run in CI on a pull request.- A misformatted or insecure change fails the pipeline — proven deliberately.
- The apply consumes a saved plan artifact rather than re-planning.
- A scheduled run reports drift when a resource is changed outside Terraform.
Rules#
- Do not open the guided lab until you are finished, or until the same problem has held you up for 20 minutes.
- Documentation is allowed and encouraged.
- Verify every criterion with a command whose output you can read.
If you get stuck#
- What did you expect, exactly?
- What happened instead — the error text, not a paraphrase?
- Which layer is that error from?
- What is the smallest command that proves the layer below is fine?
You are done when
0 of 4
The concept behind it
Phase complete · 04 Infrastructure as Code
You can now: The AWS environment is described in version-controlled modules with remote, locked state.
Next phase
Lab 28 of 59 on the project path