Unit 4: AWS with OpenTofu

Study notes for managing AWS resources through OpenTofu.

Not long ago there was Terraform.
And then Terraform switched to a BUSL license and scared everyone in the ecosystem away.
So, the ecosystem forked Terraform and created OpenTofu.

OpenTofu is an Infrastructure as Code (IaC) tool used to manage resources in the cloud.

The Language

I recommend reading Open Tofu’s extensive documentation to learn the language.

There are 3 elements to the OpenTofu language:

Expressions go on the right-hand side of Arguments.
Arguments go inside of Blocks.
Blocks can also be nested inside of each other.

Here are the types of top-level blocks available:

terraform - Special block that configures OpenTofu settings
provider - Configures an OpenTofu provider (such as AWS)
resource - Block that represents a managed resource
data - Block that represents a request to get data from a data source and export the results into a variable
module - Creates an instance of a module based off of code from another location
variable - Declares a variable

While using ~~Terraform~~ OpenTofu, the state of the resources in the cloud must be tracked.

By default, OpenTofu tracks this state with the local backend, which means it writes the state to a text file in your working directory.

This is a huge problem because this state file is not encrypted, and can contain sensitive information (i.e. credentials)!

To solve this, select a different backend, such as the S3 backend which stores your state in an S3 bucket.

Additionally, you can enable encryption of the state file and use AWS KMS to encrypt/decrypt the state and manage its keys.

Here are some links that I recommend adding to your bookmarks list for quickly looking up information: