We close Chapter 32 with a certification especially relevant to this book, but with an important particularity: it is not from AWS, but from HashiCorp, the company that created Terraform. It is the HashiCorp Certified: Terraform Associate, and it validates your mastery of Terraform itself, regardless of the cloud you use it on. Since Terraform has been one of the main characters throughout the book, this certification is a natural and very valuable complement to your profile.
The key difference: Terraform is multi-cloud
Remember something fundamental we saw in Chapter 10: Terraform is not exclusive to AWS. It is a HashiCorp tool that works with many providers (AWS, Azure, Google Cloud, and many more). That provider independence is one of its great virtues (remember the portability and avoiding lock-in that we valued in several chapters).
AWS certifications (32.1-32.4) → validate your mastery of AWS
The Terraform Associate (from HashiCorp) → validates your mastery of TERRAFORM
(which works for ANY cloud)That’s why this certification is different and complementary to AWS certifications: one certifies the cloud, the other certifies the infrastructure as code tool you use on any cloud.
What is the HashiCorp Terraform Associate
The HashiCorp Certified: Terraform Associate is the official HashiCorp certification that validates that you master Terraform: you understand infrastructure as code, know how to write and organize configurations, manage state, use modules, know the workflow... everything you’ve learned about Terraform throughout the book.
What the Terraform Associate validates (everything in the book about Terraform!): ✓ Infrastructure as code concepts (Part II) ✓ Writing HCL configurations, variables, outputs (Parts II-III) ✓ The workflow: init, plan, apply, destroy (Ch. 11) ✓ State management and remote backends (Chs. 11, 20) ✓ Modules and reuse (Ch. 18) ✓ Providers and the Terraform ecosystem (Ch. 11)
It is Associate level (intermediate): accessible after mastering Terraform with practice, without being as demanding as the Professional certifications.
Analogy: if AWS certifications are like certifying that you know how to drive in a specific country (you know its roads, its rules), the Terraform Associate is like certifying that you know how to operate a type of vehicle (say, drive a truck) that you can use in any country. The vehicle (Terraform) is the same wherever you go; mastering it is a portable skill. That’s why this certification complements AWS certifications so well: one is about the "territory" (the cloud), the other about the "vehicle" (the tool).
Why it is valuable for your profile
This certification brings things that AWS certifications do not fully cover:
- It certifies a portable skill
Since Terraform works for any cloud, mastering it is a skill that is not tied to AWS. If tomorrow you work with Azure or Google Cloud, your knowledge of Terraform remains valid. The Terraform Associate certifies that transversal and highly demanded skill.
- It goes deep into the tool, not just the cloud
AWS certifications touch on Terraform in passing (as a way to manage AWS), but do not validate your mastery of Terraform itself. The Terraform Associate does: it shows that you know the tool in depth (its workflow, its state, its modules, its nuances).
- It perfectly complements AWS certifications
A profile with an AWS certification (you design or operate in AWS) and the Terraform Associate (you master multi-cloud infrastructure as code) is very complete and attractive: it shows that you know how to design/operate in the cloud and automate it with the standard IaC tool.
Very complete profile: AWS Certification (e.g. Solutions Architect) + Terraform Associate = "I master AWS cloud AND infrastructure as code (portable)"
How it connects with the book
This is perhaps the certification most directly aligned with what you have practiced, because a large part of the book has been learning Terraform:
What you have done in the book → What the Terraform Associate evaluates ────────────────────────────────────────────────────────────────────────── Infrastructure as code (Part II) → IaC concepts HCL, variables, providers (Parts II-III) → writing configurations State and backends (Chs. 11, 20) → state management Modules (Ch. 18) → modules and reuse init/plan/apply/destroy (Ch. 11) → the workflow
If you have followed and practiced the parts of the book dedicated to Terraform, you have a very solid foundation for this certification. It is, in a way, the natural accreditation of one of the two main skills this book teaches (the other being AWS).
How to prepare for it
- Master the Terraform workflow (Chapter 11): init, plan, apply, destroy, and understand what each one does.
- Understand state well (Chapters 11 and 20): what it is, why it matters, remote backends, locking.
- Handle modules (Chapter 18): how to create and use them.
- Practice writing real Terraform: nothing accredits mastery better than using the tool. Everything you have built in the book is direct practice.
- Use the official HashiCorp documentation and practice exams (we’ll see resources in Chapter 34).
Real world example: an engineer already has the AWS Solutions Architect Associate and masters Terraform through daily work. They realize that, although they know a lot about Terraform, they do not have it officially certified, and that it is a valuable skill beyond AWS. They get the HashiCorp Terraform Associate: since they already use Terraform constantly (infrastructure as code, modules, state, pipelines), preparation is mostly about reviewing and formalizing what they already do. They pass, and now their profile demonstrates two complementary things: that they master AWS and that they master portable infrastructure as code. When a project arises that uses multiple clouds, their Terraform certification makes them the ideal candidate. The portable, certified skill opened a door that the AWS certification alone did not.
What you should remember
- The HashiCorp Terraform Associate is the official HashiCorp certification (not AWS) that validates that you master Terraform itself: IaC, HCL, workflow, state, backends, and modules (everything in the book about Terraform).
- Its particularity: Terraform is multi-cloud (Ch. 10), so this certification certifies a portable skill, not tied to AWS. Like knowing how to operate a vehicle that works in any country, versus knowing a specific territory.
- It brings what AWS certifications do not: certifies a portable skill, goes deep into the tool (not just the cloud), and perfectly complements an AWS certification (very complete profile: you master the cloud and IaC).
- It is the certification most aligned with the Terraform practice in the book; if you have practiced the Terraform parts, you have a solid foundation.
- It is Associate level (intermediate). Prepare for it by mastering the workflow (Ch. 11), state (Chs. 11, 20), and modules (Ch. 18), and above all by practicing real Terraform.
You have completed Chapter 32 and have a clear map of the certifications that can boost your career! In Chapter 33 we will see something just as important as getting certified: practical projects to consolidate everything you have learned by building real things.
Cloud, AWS & Terraform — From Zero to Expert
Chapter 1 · What is cloud computing
- 1.1 The traditional client-server model
- 1.2 Problems the cloud came to solve
- 1.3 On-premise vs cloud vs hybrid
- 1.4 The three service models: IaaS, PaaS, SaaS
- 1.5 The five pillars of cloud (according to NIST)
- 1.6 Real advantages: elasticity, pay-as-you-go, global availability
Chapter 2 · The cloud market and major providers
- 2.1 AWS, Azure and GCP: differences and market share
- 2.2 Why learn AWS first
- 2.3 Concepts that are universal among providers
Chapter 3 · Regions, availability zones and edge
- 3.1 What is an AWS region and how to choose it
- 3.2 Availability Zones: high availability by design
- 3.3 Edge locations and CloudFront
- 3.4 Latency, resilience and data sovereignty
Chapter 4 · Compute: EC2
- 4.1 Instances: types, families and when to choose each
- 4.2 AMIs, key pairs and Security Groups
- 4.3 Instance lifecycle
- 4.4 Elastic IPs and Placement Groups
- 4.5 Savings Plans vs Reserved vs On-Demand vs Spot
Chapter 5 · Storage: S3
- 5.1 Buckets, objects and keys
- 5.2 Storage classes (Standard, IA, Glacier…)
- 5.3 Versioning and object lifecycle
- 5.4 Bucket policies and ACLs
- 5.5 Static website hosting
Chapter 6 · Networking: VPC
- 6.1 What is a VPC and why you need it
- 6.2 Public and private subnets
- 6.3 Internet Gateway and NAT Gateway
- 6.4 Route Tables and Network ACLs
- 6.5 VPC Peering and endpoints
Chapter 7 · Identity and access: IAM
- 7.1 Users, groups, roles and policies
- 7.2 The principle of least privilege
- 7.3 Identity-based vs resource-based policies
- 7.4 MFA and temporary credentials (STS)
- 7.5 IAM security best practices
Chapter 8 · Managed databases
- 8.1 RDS: engines, Multi-AZ and read replicas
- 8.2 Aurora and its advantages over vanilla RDS
- 8.3 DynamoDB: key-value / document model
- 8.4 ElastiCache for in-memory cache
- 8.5 When to use each type of database
Chapter 9 · Why Infrastructure as Code
- 9.1 Problems with manual provisioning
- 9.2 Declarative vs imperative IaC
- 9.3 Terraform vs CloudFormation vs Pulumi vs CDK
- 9.4 The plan → apply → destroy cycle
Chapter 10 · HCL: the Terraform language
- 10.1 Resource, variable, output, locals blocks
- 10.2 Data types: string, number, bool, list, map, object
- 10.3 Expressions, references and built-in functions
- 10.4 Conditionals and loops (count, for_each, for)
Chapter 11 · Providers and state
- 11.1 How the AWS provider works
- 11.2 The terraform.tfstate file and its importance
- 11.3 Local state vs remote state (S3 + DynamoDB)
- 11.4 Essential commands: init, plan, apply, destroy, fmt, validate
Chapter 12 · Your first real infrastructure in Terraform
- 12.1 Create a VPC with subnets from scratch
- 12.2 Launch a public EC2 instance
- 12.3 Associate a Security Group and an Elastic IP
- 12.4 Outputs and references between resources
- 12.5 Team workflow: PR review of plans
Chapter 13 · Load balancing and auto scaling
- 13.1 Application Load Balancer vs Network Load Balancer
- 13.2 Target Groups, listeners and rules
- 13.3 Auto Scaling Groups: policies and metrics
- 13.4 Warm pools and lifecycle hooks
Chapter 14 · Serverless with Lambda
- 14.1 The Lambda execution model
- 14.2 Triggers: API Gateway, S3, DynamoDB Streams, SQS
- 14.3 Dependency management and layers
- 14.4 Cold starts and strategies to reduce them
- 14.5 Limits and anti-patterns
Chapter 15 · Messaging and events
- 15.1 SQS: standard vs FIFO queues, DLQ
- 15.2 SNS: topics, subscriptions, fan-out
- 15.3 EventBridge: event buses and rules
- 15.4 Patterns: pub/sub, decoupling, saga
Chapter 16 · Content delivery and DNS
- 16.1 Route 53: record types and routing policies
- 16.2 CloudFront: distributions, caches and origins
- 16.3 ACM: free SSL/TLS certificates
- 16.4 WAF integrated with CloudFront
Chapter 17 · Containers on AWS
- 17.1 Docker: quick review of key concepts
- 17.2 ECR: private image registry
- 17.3 ECS: task definitions, services, Fargate vs EC2
- 17.4 EKS: when Kubernetes and when not
Chapter 18 · Modules: reuse and composition
- 18.1 Anatomy of a Terraform module
- 18.2 Input variables, outputs and dependencies
- 18.3 Local modules vs Terraform Registry modules
- 18.4 Module versioning with Git tags
- 18.5 Design of generic vs domain-specific modules
Chapter 19 · Workspaces and environment management
- 19.1 Terraform workspaces: use cases and limitations
- 19.2 Directory strategy per environment (dev/stg/prod)
- 19.3 Terragrunt: DRY for environment configurations
- 19.4 Environment variables and .tfvars files
Chapter 20 · Remote backends and locking
- 20.1 Configure S3 + DynamoDB as backend
- 20.2 State locking: avoiding team corruption
- 20.3 State migration between backends
- 20.4 terraform import: bring existing resources into state
Chapter 21 · Infrastructure testing
- 21.1 Terraform validate and fmt in CI
- 21.2 Checkov and tfsec: static security analysis
- 21.3 Terratest: integration tests in Go
- 21.4 Contract testing between modules
Chapter 22 · Terraform in CI/CD
- 22.1 Basic pipeline: lint → plan → apply in GitHub Actions
- 22.2 Atlantis: GitOps for Terraform
- 22.3 Terraform Cloud / HCP Terraform
- 22.4 Drift detection and automatic reconciliation
Chapter 23 · Defense in depth
- 23.1 AWS Organizations and Service Control Policies
- 23.2 AWS Config: continuous compliance
- 23.3 GuardDuty: threat detection
- 23.4 Security Hub: centralized view
- 23.5 KMS: key management and rotation
- 23.6 Secrets Manager vs Parameter Store
Chapter 24 · Observability: logs, metrics and traces
- 24.1 CloudWatch Logs, metrics and alarms
- 24.2 CloudWatch Dashboards and Contributor Insights
- 24.3 X-Ray: distributed tracing
- 24.4 OpenTelemetry on AWS
- 24.5 Managed Grafana and Managed Prometheus
Chapter 25 · Cost optimization
- 25.1 AWS Cost Explorer and budgets with alerts
- 25.2 Trusted Advisor and Compute Optimizer
- 25.3 Rightsizing: how to detect overprovisioning
- 25.4 Savings Plans vs Reserved Instances: strategic decision
- 25.5 FinOps: culture and processes to control spending
Chapter 26 · High availability and disaster recovery
- 26.1 RTO and RPO: defining objectives
- 26.2 Strategies: backup/restore, pilot light, warm standby, multi-site
- 26.3 Route 53 health checks and automatic failover
- 26.4 AWS Backup: centralized backup policy
Chapter 27 · AWS Well-Architected Framework
- 27.1 The six pillars: operational excellence, security, reliability, performance efficiency, cost optimization, sustainability
- 27.2 Well-Architected Tool: formal reviews
- 27.3 How to apply the framework in design decisions
Chapter 28 · Serverless architectures at scale
- 28.1 Event-driven architecture with Lambda + EventBridge
- 28.2 Saga pattern for distributed transactions
- 28.3 Step Functions: orchestration of complex workflows
- 28.4 Lambda@Edge and CloudFront Functions
Chapter 29 · Data platforms on AWS
- 29.1 Data Lake with S3, Glue and Athena
- 29.2 Kinesis Data Streams and Firehose for streaming
- 29.3 Redshift: data warehousing at scale
- 29.4 Lake Formation: data governance
Chapter 30 · Multi-account and landing zones
- 30.1 Why separate workloads into different accounts
- 30.2 AWS Control Tower and Account Factory
- 30.3 Centralized log and security management
- 30.4 Terraform at multi-account scale with shared modules
Chapter 31 · Platform Engineering and Internal Developer Platform
- 31.1 Golden paths and abstractions over Terraform
- 31.2 AWS Service Catalog
- 31.3 Backstage as a developer portal
- 31.4 Terraform modules as internal product
Chapter 32 · Relevant AWS certifications
- 32.1 Cloud Practitioner: is it worth it?
- 32.2 Solutions Architect Associate → Professional
- 32.3 DevOps Engineer Professional
- 32.4 Specialty: Security, Database, Networking
- 32.5 HashiCorp Terraform Associate
Chapter 33 · Projects to consolidate what you've learned
- 33.1 Project 1: serverless blog (S3 + CloudFront + Lambda + DynamoDB)
- 33.2 Project 2: REST API with ECS Fargate + RDS + ALB
- 33.3 Project 3: data platform with Glue + Athena + Redshift
- 33.4 Project 4: multi-account landing zone with Terraform and Control Tower
