Session M4-02 trainer guide: Terraform modules and security checks¶

Teaching goal¶

Show how to build and connect Terraform modules, validate them locally, and investigate a security-gate failure. Keep Bicep as a short trainer comparison or optional extension.

One-hour plan¶

Time	Segment
0:00 to 0:08	Architecture and Terraform project model
0:08 to 0:20	Module contracts
0:20 to 0:32	Root composition
0:32 to 0:44	Staged validation
0:44 to 0:54	Intentional security failure
0:54 to 1:00	Bicep comparison and lab handoff

Prepare¶

Run terraform fmt -check -recursive on the solution.
Initialize the solution with -backend=false and run terraform validate.
Run the security gate once against the insecure file and once against the fix.
Keep cloud credentials unset.
Prepare the Bicep solution for a six-minute comparison. Do not assign it as required learner work.

Architecture and module contracts¶

Use the supplied three-tier design. Trace address space and subnets through the network module. Show how compute uses subnet IDs and exposes the application security group, then how database uses that group and its private subnets.

Ask learners to state each boundary before generating code. A module is useful when its callers depend on a small, stable interface.

Root composition¶

Use this request:

Read the Terraform root module and architecture constraints. Complete the network,
compute, and database module contracts. Pass values through typed variables and
outputs. Keep the database password sensitive. Do not add credentials, a backend,
plan, or apply command.

Inspect every added input and output. Reject duplicated CIDRs or values copied between modules when an output should carry them.

Staged validation¶

Run checks in this order:

terraform fmt -check -recursive
terraform init -backend=false
terraform validate

Formatting catches style drift. Initialization resolves providers and modules. Validation checks the configuration against the installed provider schema. None of these commands compares the configuration with a cloud environment.

Do not run a plan during the required session. A plan needs an approved identity, target environment, backend decision, and human review.

Intentional security failure¶

Run:

bash lab/starter/check-security.sh lab/starter/insecure-iac/main.tf

Let learners inspect the output before showing the solution. The gate should fail. Each repair must connect a reported pattern to the architecture or security rule.

Rerun the gate and Terraform validation against the repaired working file. Then compare it with lab/solution/secure-iac/main.tf.

Bicep comparison¶

Use the final six minutes to show the prepared Bicep module calls, @secure() parameter, and outputs. Learners do not need to build a second project.

Access policy¶

GitHub Copilot, Terraform, and the approved provider source are required. Stop if any is unavailable. No cloud account or credentials are needed.

Lab handoff¶

Give learners 90 minutes to complete the Terraform modules, run staged checks, and investigate the security failure. Ask them to submit command output.

Common questions¶

Do not run a plan. The required exercise has no approved cloud target or identity. Local validation is enough for the learning goal.

Keep Bicep as a comparison. It shows that the module and validation ideas transfer without doubling the required implementation.

Keep policy tooling separate. The security script is a deterministic training gate for the supplied failure. It does not replace policy tooling.