Glossary

A quick lookup of every term introduced, for when you forget one mid-file.

OpenTofu - Open-source IaC tool; a fork of Terraform; CLI is tofu. Terraform - The original IaC tool OpenTofu forked from; same language (HCL). HCL - HashiCorp Configuration Language; the syntax of all .tf files. Provider - Plugin that lets OpenTofu talk to a platform's API (here, aws). Resource - One piece of infrastructure declared in code. Data source - A read-only lookup of something that already exists. Variable / Output / Local - Input / published result / named intermediate value. Module - A reusable, callable package of .tf files. Root (root module) - A directory you run tofu in; has backend + provider config. State - OpenTofu's record mapping code to real resources; stored as JSON. Backend - Where state is stored; here an S3 bucket (remote backend). Locking - Preventing two simultaneous applies from corrupting state. Workspace - Multiple separate states from the same code (used in bootstrap). Plan / Apply / Destroy - Preview changes / make them / tear down. Declarative - Describe the desired end state, not the steps. Idempotent - Re-running changes nothing if already in the desired state. Drift - Reality diverging from code (e.g. someone clicked in the console). IaC - Infrastructure as Code. Landing zone - Baseline org-wide AWS setup (accounts, guardrails, logging). CI/CD / Pipeline - Automation that runs on push to test and deploy. Buildspec - YAML file listing the commands CodeBuild runs.

AWS Account - Billing + resource boundary (a tenant). AWS Organizations / OU / SCP - Multi-account grouping / account folder / guardrail policy. Region / AZ - Geographic location / isolated data center within a region. IAM / Role / Policy / Assume role - Permission system / assumable identity / permission doc / temporarily taking a role. IAM Identity Center - AWS single sign-on (federated to Entra here). ARN - Globally unique ID of an AWS resource. VPC / Subnet / CIDR - Private network / a slice of it tied to an AZ / an IP range. IGW / NAT Gateway - Internet door / outbound-only internet for private subnets. Route Table / Security Group - Traffic routing rules / per-resource firewall. VPC Endpoint - Private path from your VPC to an AWS service (Gateway = free, Interface = paid). ECS / Fargate / ECR - Container runtime / serverless flavor / Docker registry. ALB - Application Load Balancer. RDS / Multi-AZ - Managed database / standby copy in another AZ for HA. ElastiCache / Redis - Managed in-memory cache. S3 / Bucket / Object - Object storage / container / a stored file. CloudFront / WAF / API Gateway - CDN / web firewall / managed API front door. Route 53 / Hosted zone / ACM - DNS / a domain's DNS container / TLS certificates. KMS - Managed encryption keys. CloudWatch / Alarm / CloudTrail / SNS - Monitoring / alert / audit log / notifications. Budgets - Spending limits with alerts. CodePipeline / CodeBuild / CodeStar Connection - Orchestrator / build server / GitHub link.

Where to go next

1. Re-read modules/networking/main.tf - with sections 5, 11, and 14 in hand, you should now understand every line.
2. Follow SETUP.md end to end (you can do make validate with no AWS account to see the tooling work).
3. Pick a stub module (say modules/s3/) and read its variables.tf and outputs.tf to see the interface the env root already expects - then you'll understand what "filling in a stub" means.