A beginner's guide to OpenTofu, written for a software developer who is new to
AWS and new to DevOps. Every concept is explained from scratch and then tied to
a real file in this repository, so by the end you should be able to read any
.tf file here and understand what it does and why.
You do not need to be a DevOps engineer to follow this. Where a DevOps or AWS term appears, it is defined the first time it shows up.
Table of contents
- The big picture: what problem are we solving?
- DevOps vocabulary you need (just enough)
- AWS vocabulary you need (just enough)
- What OpenTofu is (and how it relates to Terraform)
- The HCL language: the building blocks
- State: OpenTofu's memory
- The core workflow: init, plan, apply, destroy
- How this repository is organized
- Layer 1 - bootstrap/: creating the state backend
- Layer 2 - platform/: the landing zone
- Layer 3 - modules/: reusable building blocks
- Layer 4 - envs/: one root per environment
- Layer 5 - cicd/: the delivery pipelines
- HCL features used in this repo, explained
- The Makefile: your day-to-day commands
- Supporting tooling: tenv, tflint, pre-commit, .gitignore
- Putting it together: the full provisioning order
- Glossary
When you build a web app, the app needs things to run on in the cloud: servers, a database, networking, storage, DNS, and so on. Traditionally, a person would log into the AWS web console and click buttons to create all of these by hand.
That manual approach has serious problems:
- It is not repeatable. Creating the same setup again (for a second environment, or after an accident) means clicking through everything again, and you will inevitably do it slightly differently.
- It is not reviewable. There is no record of what was created or why. You cannot see a diff before a change happens.
- It does not scale to a team. Two people clicking in the console will step on each other.
Infrastructure as Code (IaC) is the fix. Instead of clicking buttons, you describe the infrastructure you want in text files, commit those files to git (just like application code), and a tool reads them and makes AWS match the description. The text files become the single source of truth.
This repository is exactly that: a complete description, in code, of all the AWS infrastructure for the AlphaForm platform. The tool that reads the code and talks to AWS is OpenTofu.
The mental model to hold onto:
You declare the desired end state ("I want a network with three subnets and a database"). OpenTofu figures out the steps to get there and executes them. You never write the steps yourself.
This is called a declarative approach (you describe the destination), as opposed to an imperative one (you write the turn-by-turn directions).