DEVOPS · 18 NOTES · UPDATED 2026.08.29

OPENTOFU

NOTES 18

0102 MIN · 2026.08.29The Big Picture: What Problem Are We Solving?A beginner's guide to OpenTofu, written for a software developer who is new to AWS and new to DevOps. Every concept is explained from scratch and then tied to a real file in this repository, so by the end you should be…0201 MIN · 2026.08.29DevOps Vocabulary You Need (Just Enough)You are a developer, so here is the minimum DevOps vocabulary, mapped to ideas you already know.0304 MIN · 2026.08.29AWS Terminology Explained for Beginners: Accounts, IAM, VPC, ECS, RDSAWS (Amazon Web Services) is a cloud provider: it rents you computers, databases, networks, and hundreds of other services over the internet. Here are the AWS concepts this repository actually uses. Skim now; refer back…0401 MIN · 2026.08.29What OpenTofu Is (and How It Relates to Terraform)OpenTofu is the tool this repo uses to turn .tf files into real AWS resources. A few facts that matter:0504 MIN · 2026.08.29The HCL Language: The Building BlocksEvery .tf file is written in HCL. HCL is made of blocks. A block looks like:0603 MIN · 2026.08.29State: OpenTofu's MemoryThis is the concept most newcomers stumble on, so read it slowly.0702 MIN · 2026.08.29The Core Workflow: init, plan, apply, destroyEvery interaction with OpenTofu uses the same handful of commands. Here they are, in the order you use them.0802 MIN · 2026.08.29How This Repository Is OrganizedHere is the whole repository at a glance, grouped by the five layers. The arrows show the order you stand them up.0902 MIN · 2026.08.29Layer 1 - bootstrap: Creating the State BackendGoal: create the secure S3 bucket (and KMS key) that will hold the remote state for one AWS account. This is the first thing you run in any account, and it is the only layer that uses local state.1002 MIN · 2026.08.29Layer 2 - platform: The Landing ZoneA landing zone is DevOps jargon for "the baseline, org-wide AWS setup you stand up before any application infrastructure" - the accounts, the security guardrails, the audit logging, the login system, and the budgets. It…1104 MIN · 2026.08.29Layer 3 - modules: Reusable Building BlocksThis is where the real infrastructure is defined. A module is a self-contained package: inputs (variables.tf), resources (main.tf), and outputs (outputs.tf). Roots call modules; modules can call other modules.1202 MIN · 2026.08.29Layer 4 - envs: One Root per EnvironmentEach of envs/dev, envs/staging, envs/prod is a root that assembles the modules into one complete environment, with its own state in its own account. The three are near-identical in structure but differ in inputs (dev…1303 MIN · 2026.08.29Layer 5 - cicd: The Delivery PipelinesSo far you'd run tofu apply from your laptop. This project deliberately does not allow that for normal changes. Instead, every environment is applied by an automated pipeline, triggered by a git push. The README is…1402 MIN · 2026.08.29HCL Features Used in This Repo, ExplainedA consolidated reference of every HCL language feature this repo uses, with a pointer to where you saw it. Use this as a cheat sheet.1501 MIN · 2026.08.29The Makefile: Your Day-to-Day CommandsYou rarely type raw tofu commands in this repo - the Makefile wraps them so they're consistent. A Makefile is just a list of named command shortcuts (targets); you run make <target>. The variables DIR (which root) and…1601 MIN · 2026.08.29Supporting Tooling: tenv, tflint, pre-commit, .gitignoreThese aren't OpenTofu itself, but they're part of working in this repo.1701 MIN · 2026.08.29Putting It Together: The Full Provisioning OrderHere is the whole repository as one sequence, which also doubles as a review of every layer. (Full detail is in SETUP.md.)1803 MIN · 2026.08.29GlossaryA quick lookup of every term introduced, for when you forget one mid-file.