Cloud Infrastructure as Code: Two-Week Online Course

A two-week online course on infrastructure as code with Terraform and Terragrunt, taught on the smarter-infrastructure repository, which builds Smarter’s complete AWS environment. It is a real production configuration, not a teaching example: an EKS cluster on Spot capacity with the Cluster Autoscaler and roles for service accounts, Calico network policies, Traefik and cert-manager as Helm releases, and a root configuration that refuses to run against the wrong AWS account. Smarter itself goes on to manage infrastructure at run time, through a service layer that creates DNS records, certificates, ingresses and GPU node groups, with an in-memory provider in tests. There are six 30-minute recorded lectures and a 90-minute live session each week. Week 1 covers Terraform and reading a real stack, and week 2 covers environments, security, cost and teamwork. See Course Formats and Grading for the format, the grading scale and the course policies, and Cloud Infrastructure as Code for an overview of the subject.

At a Glance

Students

Cloud, operations and platform engineers, and developers who deploy their own systems.

Deployment

Each student clones smarter-infrastructure and installs Terraform (or OpenTofu), Terragrunt and the AWS CLI, with a sandbox AWS account for plans and small exercises.

Workload

3 hours of instruction and 4 to 6 hours of assignments each week.

Cost

A few dollars at most, if students destroy what they create.

Warning

terraform apply creates real, billable cloud resources. Use a dedicated sandbox account with a billing alert, never apply the full Smarter stack, and destroy what you create at the end of each session.

Learning Objectives

By the end of the course, students can:

  1. Explain infrastructure as code and the Terraform lifecycle, including state.

  2. Read and write Terraform modules with variables, outputs and pinned providers.

  3. Use Terragrunt to manage several environments from one code base.

  4. Explain the security design of a production AWS and Kubernetes environment.

  5. Plan, review and price infrastructure changes, and check them with static analysis.

Technical Prerequisites

  • Required: the Linux or macOS command line, Git and GitHub.

  • Required: cloud fundamentals: regions, networks, subnets, IAM and managed services.

  • Required: Docker and basic Kubernetes concepts.

  • Required: reading JSON and YAML.

  • Required before Live session 1: Terraform or OpenTofu, Terragrunt and the AWS CLI installed, with a sandbox AWS profile.

  • Helpful: networking (CIDR, routing, NAT, DNS), and some AWS console experience.

Schedule

The files that the lectures refer to are listed in full under Smarter in the Source Code.

Week

Item

Content

1

Lecture 1 (30 min)

Why infrastructure as code. Declarative configuration, the lifecycle, and state.

1

Lecture 2 (30 min)

Terraform language. Providers, resources, data sources, variables, outputs, modules and expressions.

1

Lecture 3 (30 min)

Reading a real stack. The aws/terraform modules in smarter-infrastructure and how they depend on each other.

1

Live session 1 (90 min)

Tooling triage, then a live plan, apply and destroy of a small module. Start Assignment 1.

2

Lecture 4 (30 min)

Terragrunt and environments. terragrunt.hcl, global.hcl, the stack folder, and the alpha, local and prod environments.

2

Lecture 5 (30 min)

Security and cost. Private networks, security groups, IAM roles for service accounts, network policies, and pricing a plan. Cloud Infrastructure.

2

Lecture 6 (30 min)

Infrastructure in the application, and teamwork. Smarter’s infrastructure service layer and its in-memory test provider; reviewing plans, CI, drift and imports.

2

Live session 2 (90 min)

Capstone presentations (about 5 minutes each, with 2 minutes of questions).

Assignment 1 is due at the end of week 1, Assignment 2 in the middle of week 2, and Assignment 3 and the capstone at the start of Live session 2.

Smarter in the Source Code

Every lecture, lab and assignment in this course rests on the files below, in two repositories: smarter-infrastructure, the Terraform and Terragrunt that build Smarter’s AWS environment, and smarter, the application that manages infrastructure of its own at run time. Every reference is to the main branch, so that students can open each one during class.

The Terraform Stack

Module

What it creates

Where to look

vpc

The network: public and private subnets, NAT and routing, and the Route53 zone that the platform uses.

aws/terraform/vpc/

kubernetes

An EKS cluster built with the community terraform-aws-modules/eks module, with roles for service accounts (IRSA), managed node groups on Spot capacity that scale from 0 to 15 nodes, the Cluster Autoscaler, the CoreDNS, VPC CNI and EBS CSI add-ons, and persistent storage.

aws/terraform/kubernetes/main.tf, config/cluster-autoscaler.yaml.tpl

Network policies

With enable_enhanced_security on, Calico as the network policy engine, default-deny ingress for MariaDB, Redis and the application, and egress from the application limited to the database ports.

aws/terraform/kubernetes/network_policy.tf

kubernetes_ingress and kubernetes_cert_manager

Traefik as the ingress controller, its DNS records, and cert-manager for TLS certificates, each installed as a Helm release from a values template.

aws/terraform/kubernetes_ingress/, aws/terraform/kubernetes_cert_manager/

kubernetes_descheduler

The descheduler, which moves pods to rebalance the cluster’s nodes.

aws/terraform/kubernetes_descheduler/

smarter

Each environment’s own resources: certificates, CloudFront, an ECR repository, IAM, S3, SES for email, Route53 records, a bastion host, Kubernetes secrets and ingresses.

aws/terraform/smarter/

Terragrunt and Environments

Topic

How it is done

Where to look

The root configuration

Generates the AWS provider with allowed_account_ids, a guard that refuses to run against any other account, and the remote state: an S3 bucket per account and a DynamoDB lock table.

aws/terragrunt.hcl

Shared values

Region, domain, cluster name and tags, each read from the environment with a default.

aws/global.hcl, .env.example

The shared stack

The cluster’s version, node group sizes, and the AMD64 and Graviton instance types, once for every environment.

aws/stack/stack.hcl, aws/stack/

Environments

alpha, local and prod, each a short terragrunt.hcl that points at the smarter module and merges the shared values.

aws/environments/

Something to question

The remote state sets encrypt = false, and a comment in the root configuration marks a known naming problem as a FIX NOTE. Real code has debts, and finding them is part of reading it.

aws/terragrunt.hcl

A guide

A getting-started guide for Terraform, written for this repository.

doc/TERRAFORM_GETTING_STARTED_GUIDE.md

Infrastructure Inside the Application

Python paths are under smarter/smarter/ in the smarter repository.

Topic

What Smarter does

Where to look

One facade

All DNS, certificate, Kubernetes and email work goes through infrastructure.dns, .certificates, .kubernetes and .email. The application never calls the AWS SDK directly. Infrastructure Services.

infrastructure/services/__init__.py, infrastructure/services/

Providers

Route53 and Certificate Manager in production, and an in-memory provider that tests use instead, behind one CloudProvider interface that another cloud could implement.

infrastructure/providers/aws/, providers/memory.py, providers/base.py

Declarative at run time

Deploying an LLMClient creates its DNS record, certificate and Kubernetes ingress from a template, in Celery tasks.

llmclient/k8s/ingress.yaml.tpl, llmclient/tasks/deploy_default_api.py

Node groups on demand

Serving a self-hosted model creates an EKS managed node group of the right GPU or CPU nodes, starting at zero, and removes nodes safely.

llmhost/services/nodegroups.py

An inventory

Every cloud resource that the platform created or found, and whether it still exists.

infrastructure/models.py

Safety rules

Why tests fake every cloud call, and the tag that keeps tests that touch real infrastructure from running by default.

smarter-infrastructure-safety/SKILL.md

Graded Assignments

Assignment 1: A First Module

Students write a Terraform configuration for an encrypted, versioned S3 bucket with a lifecycle rule and remote state, then plan, apply and destroy it.

Turn in: a Git repository and the command output.

Criterion

Pts

Exemplary

Developing

Correctness

6

All requirements met; applies cleanly.

A requirement missing.

Structure

5

Variables, outputs, pinned versions, remote state.

Hard-coded; local state.

Hygiene

5

Nothing secret or stateful committed; destroyed afterwards.

State committed, or resources left.

Explanation

4

Plan explained.

Raw output.

Assignment 2: Stack Map and Environment Diff

Students map each module to its resources and dependencies, then compare the alpha and prod environments and explain each difference.

Turn in: a table, a dependency diagram, and a one-page environment comparison.

Criterion

Pts

Exemplary

Developing

Resource map

6

Correct for every module.

Gaps.

Dependencies

5

Outputs feeding inputs shown.

No edges.

Environment comparison

6

Every difference found and justified.

Some differences missed.

Clarity

3

Clear.

Unclear.

Assignment 3: Plan, Price and Scan

Students plan the vpc and kubernetes modules against a sandbox account, estimate the monthly cost, and run tflint and Checkov on the repository, triaging the findings.

Turn in: the plan summary, a cost table, and a triage table.

Criterion

Pts

Exemplary

Developing

Plan

4

Runs and is explained.

Does not run.

Cost

6

Every billable resource priced, with assumptions.

Major items missing.

Static analysis triage

6

Each finding classified with reasons.

Output pasted only.

Recommendations

4

One saving and one fix, with trade-offs.

None.

Capstone Projects

Students choose one, and present it in Live session 2.

Capstone A: A Reusable Module with CI

Learning objective. Write a reusable, documented and automatically checked Terraform module.

Students write a module such as a backup bucket with a least-privilege IAM role for a Kubernetes service account, or a billing alarm with notification, with examples, generated documentation, and CI that runs fmt, validate, tflint and Checkov.

What students turn in:

  • A Git repository with the module, examples, README.md and CI.

  • Evidence of a plan, apply and destroy.

  • A five-minute presentation.

How it is graded (100 points):

Criterion

Pts

Exemplary

Developing

Works

20

Applies and destroys cleanly.

Errors.

Interface

20

Typed, documented, validated variables.

Untyped.

Security

20

Encryption and least privilege.

Wide permissions.

Automated checks

20

All four in CI, passing.

Partial.

Documentation and presentation

20

Generated docs, working example, clear presentation.

Missing.

Capstone B: An Architecture and Cost Review

Learning objective. Review a real production infrastructure against the AWS Well-Architected Framework, with evidence.

Students review smarter-infrastructure for security, reliability and cost, using code, plans, static analysis and cost estimates, and propose prioritized changes, at least one as a diff.

What students turn in:

  • A four- to six-page review.

  • A cost model with two reduction options.

  • A five-minute presentation.

How it is graded (100 points):

Criterion

Pts

Exemplary

Developing

Framework use

20

Organized by pillar and question.

Named only.

Evidence

25

Every finding cited.

Opinions.

Cost model

20

Complete, with trade-offs.

Partial.

Recommendations

20

Prioritized; one as a diff.

Unprioritized.

Presentation

15

Clear and on time.

Overruns.

Further Study