Agenda

Terraform is required

Use Terraform for the lab:

architecture → modules → root composition → format → init → validate → security gate

Bicep appears as a prepared comparison. Learners do not build both projects.

Modules define contracts

Keep secrets in sensitive inputs. Do not copy values between layers.

Prompt from fixed constraints

Complete the network, compute, and database module contracts. Pass values through
typed variables and outputs. Keep the database password sensitive. Do not add
credentials, a backend, plan, or apply command.

Use the architecture to set the boundaries before Copilot drafts the files.

Validate in stages

terraform fmt -check -recursive
terraform init -backend=false
terraform validate

Fix the first failure before moving on. Each stage answers a different question.

What local validation does not prove

It does not check:

• the current cloud state;
• organization policy;
• quota or regional availability;
• the effect of an apply.

A reviewed plan needs an approved identity and target environment.

One intentional security failure

bash lab/starter/check-security.sh lab/starter/insecure-iac/main.tf

The gate must fail. Inspect the cited lines, repair the file, and check that the
rerun passes.

Bicep is a comparison

Show:

• module inputs and outputs;
• @secure() parameters;
• az bicep build;
• the same human review boundary.

Six minutes. No second required build.