- Lab
-
Libraries: If you want this lab, consider one of these libraries.
- Core Tech
Bootstrapping the Distributed Backend
In this hands-on lab, you will prepare and execute a migration from local Terraform state to a production-grade remote backend on AWS. Starting with an existing Terraform project that uses local state, you will inspect a pre-provisioned S3 bucket to verify encryption, versioning, public access blocking, and TLS enforcement. You will examine a DynamoDB lock table to confirm the correct key schema and billing mode. You will then configure a lifecycle policy for cost management, write the backend configuration, and migrate the local state to the remote backend. By the end of the lab, you will have a secure, centralized state management system that supports concurrent team operations and provides a complete version history for disaster recovery.
Lab Info
Table of Contents
-
Challenge
Inspect and Verify the S3 State Bucket Security Configuration
- Verify that the S3 bucket follows a naming convention that includes the account ID and region.
- Confirm server-side encryption (AES-256) and bucket versioning are enabled.
- Verify that Block Public Access is fully enabled and the bucket policy enforces TLS.
- Configure a lifecycle policy that transitions non-current versions to Glacier after 30 days and expires them after 90 days.
-
Challenge
Verify the DynamoDB Lock Table and IAM Permissions for State Locking
- Verify the DynamoDB table exists with a
LockIDpartition key and pay-per-request billing. - Confirm the lock table contains no active locks before migration.
- Verify the IAM role has
dynamodb:GetItem,dynamodb:PutItem, anddynamodb:DeleteItempermissions on the table.
- Verify the DynamoDB table exists with a
-
Challenge
Configure the S3 Backend and Migrate Local State to the Remote Backend
- Create a
backend.tffile configuring the S3 backend with the bucket name, DynamoDB table, region, encryption flag, and a structured state key path. - Run
terraform initand confirm the interactive migration prompt to copy local state to S3. - Verify the state file exists in the S3 bucket and the local state file is emptied after migration.
- Run
terraform planto confirm zero drift, verify lock acquisition, and confirm the state file is versioned in S3.
- Create a
Real skill practice before real-world application
Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.
Learn by doing
Engage hands-on with the tools and technologies you’re learning. You pick the skill, we provide the credentials and environment.
Follow your guide
All labs have detailed instructions and objectives, guiding you through the learning process and ensuring you understand every step.
Turn time into mastery
On average, you retain 75% more of your learning if you take time to practice. Hands-on labs set you up for success to make those skills stick.