Cloud Infrastructure as Code

Why Smarter. Infrastructure as code is hard to teach well, because a realistic configuration is expensive to run and nobody publishes their production one. The smarter-infrastructure repository is exactly that: the Terraform and Terragrunt that build Smarter’s AWS environment, in public. Students can read a complete, real production configuration without having to pay for one:

  • Six modules with real dependencies. The vpc network; an EKS cluster in the kubernetes module, with roles for service accounts, managed node groups on Spot capacity that scale from 0 to 15 nodes, and the Cluster Autoscaler; Traefik and cert-manager as Helm releases; the descheduler; and the smarter module’s certificates, CloudFront, ECR, IAM, S3, SES, Route53 records and bastion host.

  • Security built in. A private network for the cluster, Calico network policies with default-deny ingress for the database, the cache and the application, and a root configuration whose allowed_account_ids refuses to run against any other AWS account.

  • Environments without copy and paste. A shared stack of cluster versions and instance types, and alpha, local and prod environments that are a few lines each.

  • Real debts to find. The remote state is stored with encrypt = false, and a comment marks a known naming problem as a FIX NOTE. Students learn to review infrastructure code as critically as application code.

Smarter’s own infrastructure service layer then shows how an application manages cloud resources at run time. Deploying an LLMClient creates its DNS record, certificate and Kubernetes ingress, and serving a self-hosted model creates an EKS node group of GPU nodes. All of it goes through one facade, with Route53 and Certificate Manager in production and an in-memory provider in tests, so the same code runs in both.

What the course covers. Why infrastructure as code, declarative configuration, and the Terraform lifecycle; the Terraform language; state, remote state and locking; modules, their interfaces and composition; reading a real stack and mapping its dependencies; Terragrunt and environments; networking with VPCs, subnets, NAT and security groups; Kubernetes on AWS, with node groups, add-ons, storage and network policies; identity, roles for service accounts and least privilege; testing and CI with fmt, validate, tflint, Checkov and terraform test; pricing a plan; and infrastructure managed by the application itself.

Look at.

Each course plan lists every file that it uses, in both repositories, under Smarter in the Source Code.

Read. Cloud Infrastructure, Amazon Web Services (AWS), Infrastructure Services.

Exercises.

  • Map each Terraform module to the AWS resources that it creates, and explain why the cluster sits on a private network.

  • Run terraform plan against a sandbox AWS account, and estimate the monthly cost of the result. Compare it with the figures in Kubernetes for Running Applications at Scale.

  • Run tflint and Checkov on the repository, triage the findings, and fix one, such as the unencrypted remote state.

  • Study how Smarter’s infrastructure service layer lets the same code use AWS in production and a fake, in-memory provider in tests, and why that matters.

Warning

terraform apply creates real, billable cloud resources. Use a dedicated sandbox account with a billing alert, and destroy what you create at the end of each session.

Course plans. Three complete, ready-to-teach plans, each with a schedule, graded assignments and rubrics, two capstone projects, recommended texts, further study and technical prerequisites. See Course Formats and Grading for what the formats have in common.

See the Smarter Instructor Guide to install Smarter and set up a class.