Terraform AWS EC2 Setup Guide

This guide covers setting up and provisioning an EC2 instance on AWS using Terraform, based on the HashiCorp AWS Get Started tutorial adapted for a Makers bootcamp environment.

Prerequisites

• Terraform CLI installed (terraform -version to verify)
• AWS CLI installed and configured (aws --version)
• An AWS account with IAM credentials
• A pre-existing security group in your AWS account

Project Structure

learn-terraform-get-started-aws/
├── terraform.tf    # Provider and version configuration
└── main.tf         # Resources and infrastructure definition

Step 1: Configure the Terraform Provider

Create terraform.tf to define which providers and versions to use:

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.92"
    }
  }

  required_version = ">= 1.2"
}

Step 2: Write the Main Configuration

Create main.tf with your provider, AMI data source, and EC2 instance:

provider "aws" {
  region = "eu-west-2"
}

data "aws_ami" "ubuntu" {
  most_recent = true

  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*"]
  }

  owners = ["099720109477"] # Canonical
}

resource "aws_instance" "app_server" {
  ami             = data.aws_ami.ubuntu.id
  instance_type   = "t2.micro"
  security_groups = ["your-security-group-name"]

  tags = {
    Name  = "learn-terraform"
    Owner = "Students"
  }
}

Note: Replace "your-security-group-name" with the name of a pre-existing security group in your AWS account. In a Makers environment, student IAM policies restrict creating and managing security groups, so you must reference one that already exists.

Step 3: Verify AWS Credentials

Check that the AWS CLI is authenticated:

aws sts get-caller-identity

Check your configured credentials:

aws configure list

Step 4: Initialise Terraform

Terraform reads your .tf files to know which providers to download:

terraform init

This downloads the AWS provider plugin into a .terraform subdirectory and creates .terraform.lock.hcl.

Step 5: Validate Configuration

Check for syntax errors:

terraform validate

Step 6: Plan

Preview what Terraform will create without making any changes:

terraform plan

Values shown as (known after apply) are generated by AWS at creation time — Terraform cannot know them in advance.

Step 7: Apply

Create the infrastructure:

terraform apply

Type yes when prompted. After a successful apply, note the instance ID in the output:

aws_instance.app_server: Creation complete after 13s [id=i-035f9b642e2fefea6]

Step 8: Inspect State

List tracked resources:

terraform state list

Show full details of all resources:

terraform show

Key Concepts

How Terraform reads files

Terraform reads all .tf files in the current directory. Filenames don’t matter — terraform.tf is a convention, not a requirement.

terraform init vs terraform apply

• terraform init — downloads providers, no AWS credentials needed
• terraform plan / terraform apply — talk to AWS, credentials required

IAM: Explicit Deny always wins

In AWS IAM, an explicit Deny overrides any Allow policy. If a policy explicitly denies an action, adding an Allow elsewhere won’t help — the deny must be removed or modified.

(known after apply)

Values like public_ip, id, and availability_zone are assigned by AWS when the resource is created. Terraform can’t know them at plan time.

Referencing existing security groups

In environments with restricted IAM permissions, use security_groups to reference a pre-existing security group by name rather than creating one with Terraform:

security_groups = ["existing-sg-name"]

Makers-Specific Notes

• Use region eu-west-2 (London)
• Student IAM policy (AdministratorAccessForStudents) restricts creating/deleting security groups — reference a pre-existing one
• Add Owner = "Students" tag to resources to satisfy IAM conditions
• Aptem deliverables: (1) terraform apply flow diagram, (2) zip of Terraform codebase