Pro · Lesson 12 of 12

Capstone

Build a small root module you can init, validate, and test without a cloud account. Then write the production differences you did not turn on.

Picture it this way

You cook the recipe in a toy kitchen: a name, a validation rule, and a test. The real kitchen would add a remote state lock, a reviewed apply, and a binary you named on purpose.

The lab module

One variable, one validation, one local, one terraform_data resource, one output. A test file asserts the output. No AWS provider, so a missing cloud key is not a failure.

If terraform test is not in your binary, record the version and which check you could run. Do not mark the test passed.

What you would add for a shared environment

A remote backend with the lock your version documents. A CI job that prints terraform version or tofu version and refuses to apply from a pull request. A moved block if you rename the resource later. No claim that OpenTofu and Terraform will both accept every file you wrote. Run the file with the binary you picked.

Production piece	Lesson
Remote state and a lock	State, backends, and locking
Separate dev and prod	Workspaces and environments
Reviewed apply	CI and HCP Terraform
Which binary	Security, policy, and OpenTofu

Toy kitchen, then the real one

Variable
Resource
Test

Step 1 of 3The lab stays on local state and terraform_data.

Lab: init, validate, and test

Put these files in an empty directory. Use the Terraform binary if that is what you installed. If you use OpenTofu, run tofu and treat a rejected argument as a version note, not as a pass.

cat > main.tf <<'EOF'
terraform {
  required_version = ">= 1.7.0"
}
variable "environment" {
  type = string
  validation {
    condition     = contains(["dev", "test"], var.environment)
    error_message = "Use dev or test in this lab."
  }
}
locals {
  name_prefix = "dfd-${var.environment}"
}
resource "terraform_data" "note" {
  input = local.name_prefix
}
output "name_prefix" {
  value = local.name_prefix
}
EOF
cat > name.tftest.hcl <<'EOF'
run "dev_prefix" {
  command = plan
  variables { environment = "dev" }
  assert {
    condition     = output.name_prefix == "dfd-dev"
    error_message = "Expected dfd-dev."
  }
}
EOF
terraform init -input=false
terraform validate
terraform test

Concept summary

The capstone runs locally with terraform_data.
A cloud module adds a backend, a lock, and a reviewed apply.
Name the binary. Do not grade Terraform and OpenTofu as one result.

Knowledge check

Why does the capstone avoid an AWS resource?

The test command is missing. What do you record?

What is the #workspaces address on the old page?

Official sources

Checked against the linked documentation in October 2026. A later release can move a flag, a price, or a supported pair. Use the page for the version you installed.