Study each pattern before starting the activity. The official references are at the end of each section.

What to Deliver

5.1 CloudFormation Template Structure

# template.yaml
AWSTemplateFormatVersion: "2010-09-09"
Description: "Activity 1 - Basic AWS infrastructure"

Parameters:
  Environment:
    Type: String
    Default: dev
    AllowedValues: [dev, staging, prod]
  VpcCidr:
    Type: String
    Default: "10.0.0.0/16"

Resources:
  MyVpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Sub "${Environment}-vpc"

  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref MyVpc
      CidrBlock: "10.0.1.0/24"
      AvailabilityZone: !Select [0, !GetAZs ""]
      MapPublicIpOnLaunch: true

  WebSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: "Allow HTTP and SSH"
      VpcId: !Ref MyVpc
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: "0.0.0.0/0"  # Restrict to your IP in production
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: "0.0.0.0/0"

Outputs:
  VpcId:
    Description: "VPC ID"
    Value: !Ref MyVpc
  SubnetId:
    Description: "Public Subnet ID"
    Value: !Ref PublicSubnet

5.2 CloudFormation CLI Commands

# Validate template
aws cloudformation validate-template --template-body file://template.yaml

# Create stack
aws cloudformation create-stack \
  --stack-name activity1-stack \
  --template-body file://template.yaml \
  --parameters ParameterKey=Environment,ParameterValue=dev

# Check stack status
aws cloudformation describe-stacks --stack-name activity1-stack \
  --query "Stacks[0].StackStatus"

# Delete stack (always run this after the activity)
aws cloudformation delete-stack --stack-name activity1-stack

# Confirm deletion
aws cloudformation describe-stacks --stack-name activity1-stack
# Should return "Stack with id ... does not exist"

Week 1 Official References

Deliverables per Activity

5.3 Terraform File Structure

my-terraform-project/
  main.tf          # resource definitions
  variables.tf     # input variable declarations
  outputs.tf       # output value declarations
  terraform.tfvars # variable values (do NOT commit if it has secrets)
  providers.tf     # provider configuration
  versions.tf      # required_providers and terraform version constraint

# Module structure:
modules/
  vpc/
    main.tf
    variables.tf
    outputs.tf
    README.md

5.4 providers.tf and versions.tf

# versions.tf
terraform {
  required_version = ">= 1.6"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

# providers.tf
provider "aws" {
  region = var.aws_region
  # Credentials come from environment or ~/.aws/config — NEVER hardcoded
}

5.5 variables.tf and terraform.tfvars

# variables.tf
variable "aws_region" {
  description = "AWS region to deploy into"
  type        = string
  default     = "ap-southeast-1"
}

variable "environment" {
  description = "Deployment environment (dev, staging, prod)"
  type        = string
  validation {
    condition     = contains(["dev","staging","prod"], var.environment)
    error_message = "environment must be dev, staging, or prod."
  }
}

variable "vpc_cidr" {
  description = "CIDR block for the VPC"
  type        = string
  default     = "10.0.0.0/16"
}

# terraform.tfvars  (values for the above)
aws_region  = "ap-southeast-1"
environment = "dev"
vpc_cidr    = "10.1.0.0/16"

5.6 Module Pattern

# modules/vpc/main.tf
resource "aws_vpc" "this" {
  cidr_block           = var.vpc_cidr
  enable_dns_support   = true
  enable_dns_hostnames = true
  tags = { Name = "${var.environment}-vpc" }
}

resource "aws_subnet" "public" {
  count             = length(var.public_subnet_cidrs)
  vpc_id            = aws_vpc.this.id
  cidr_block        = var.public_subnet_cidrs[count.index]
  availability_zone = var.availability_zones[count.index]
  map_public_ip_on_launch = true
  tags = { Name = "${var.environment}-public-${count.index + 1}" }
}

# modules/vpc/outputs.tf
output "vpc_id" { value = aws_vpc.this.id }
output "public_subnet_ids" { value = aws_subnet.public[*].id }

# root main.tf — calling the module
module "vpc" {
  source               = "./modules/vpc"
  environment          = var.environment
  vpc_cidr             = var.vpc_cidr
  public_subnet_cidrs  = ["10.0.1.0/24","10.0.2.0/24"]
  availability_zones   = ["ap-southeast-1a","ap-southeast-1b"]
}

5.7 The Terraform Workflow — Every Time

Weeks 2–3 Official References

Minimum Infrastructure Requirements

Milestone Breakdown

Capstone Terraform Structure

capstone/
  main.tf              # calls all modules
  variables.tf
  outputs.tf
  terraform.tfvars     # do not commit secrets
  versions.tf
  providers.tf
  README.md
  docs/
    architecture.png   # architecture diagram
    testing-notes.md
  modules/
    networking/        # VPC, subnets, IGW, route tables
      main.tf
      variables.tf
      outputs.tf
    security-groups/   # all security group definitions
    compute/           # launch template, ASG, jump host
    load-balancer/     # ALB, listener, target group
    database/          # RDS, subnet group
    storage/           # S3 bucket and lifecycle

Key Terraform Patterns for the Capstone

Security Group with Least-Privilege Rules

resource "aws_security_group" "web" {
  name        = "${var.environment}-web-sg"
  description = "Web tier — allow HTTP from ALB only"
  vpc_id      = var.vpc_id

  ingress {
    description     = "HTTP from ALB"
    from_port       = 80
    to_port         = 80
    protocol        = "tcp"
    security_groups = [var.alb_sg_id]  # NOT 0.0.0.0/0
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = { Name = "${var.environment}-web-sg" }
}

Auto Scaling Group with ALB Integration

resource "aws_autoscaling_group" "web" {
  name                = "${var.environment}-web-asg"
  min_size            = 1
  max_size            = 3
  desired_capacity    = 2
  vpc_zone_identifier = var.private_subnet_ids  # private subnets
  target_group_arns   = [aws_lb_target_group.web.arn]
  health_check_type   = "ELB"

  launch_template {
    id      = aws_launch_template.web.id
    version = "$Latest"
  }

  tag {
    key                 = "Name"
    value               = "${var.environment}-web"
    propagate_at_launch = true
  }
}

RDS Multi-AZ

resource "aws_db_instance" "main" {
  identifier             = "${var.environment}-db"
  engine                 = "mysql"
  engine_version         = "8.0"
  instance_class         = "db.t3.micro"
  allocated_storage      = 20
  db_name                = "appdb"
  username               = var.db_username
  password               = var.db_password  # use secrets manager in production
  db_subnet_group_name   = aws_db_subnet_group.main.name
  vpc_security_group_ids = [var.rds_sg_id]
  multi_az               = true
  publicly_accessible    = false
  skip_final_snapshot    = true  # set to false in production
  tags = { Name = "${var.environment}-rds" }
}

Capstone Deliverables

Capstone Evaluation (3-point scale per area)

Weeks 4–8 Official References

Project Immersion Expectations

5.8 Docker Fundamentals

# Dockerfile — basic Node.js web app example
FROM node:20-alpine

WORKDIR /app

COPY package*.json ./
RUN npm ci --only=production

COPY . .

EXPOSE 3000

CMD ["node", "server.js"]

# Build an image
docker build -t my-app:latest .

# Run a container
docker run -p 3000:3000 my-app:latest

# List running containers
docker ps

# Stop a container
docker stop <container-id>

# Remove all stopped containers and unused images
docker system prune -f

5.9 Kubernetes Fundamentals

# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
  labels:
    app: my-app
spec:
  replicas: 2
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
        - name: my-app
          image: my-app:latest
          ports:
            - containerPort: 3000
          resources:
            requests:
              cpu: "100m"
              memory: "128Mi"
            limits:
              cpu: "250m"
              memory: "256Mi"
---
apiVersion: v1
kind: Service
metadata:
  name: my-app-service
spec:
  selector:
    app: my-app
  ports:
    - port: 80
      targetPort: 3000
  type: LoadBalancer

5.10 GitLab CI/CD Pipeline

# .gitlab-ci.yml
stages:
  - validate
  - build
  - deploy

variables:
  TF_ROOT: ${CI_PROJECT_DIR}/terraform

terraform:validate:
  stage: validate
  image:
    name: hashicorp/terraform:1.6
    entrypoint: [""]
  script:
    - cd $TF_ROOT
    - terraform init -backend=false
    - terraform validate

docker:build:
  stage: build
  image: docker:24
  services:
    - docker:dind
  script:
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA .
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
  only:
    - main

Weeks 9–11 Deliverables

Weeks 9–11 Official References