Recommended Free Tools
The goal of this stage is to rebuild your already-working resume deployment as Terraform code, then optionally let GitHub Actions apply backend changes for you. The official extension, “Terraform Your Cloud Resume Challenge,” frames the motivation with two questions: “What happens if you accidentally delete the underlying infrastructure for your resume?” and “What if you want to change it to a different cloud provider?” Code you can re-run answers both.
A note on labels: “Week 3” is a common way to pace the work, not a universal schedule. The official extension is a numbered challenge, and you can choose AWS, Google Cloud or Microsoft Azure.
As an Amazon Associate I earn from qualifying purchases.
What you are building, in order
The sequence below is provider-neutral. Where the official guide names provider equivalents, they are noted.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →1. Install Terraform and get provider credentials
You need Terraform installed and an active account with your chosen cloud. Configure that provider’s CLI, or supply credentials through environment variables or provider configuration. The credentials are what let Terraform call the provider’s API on your behalf.
#1 Best Overall
2. Configure the provider and initialize
Declare the provider in your configuration, then run terraform init so Terraform downloads and sets up the provider in the working directory. The guide suggests pinning provider versions. It is optional, but it stops a new provider release from changing your results unexpectedly.
3. Start with the storage bucket
Begin with the bucket that holds your static site: an S3 bucket on AWS, Azure Storage Blob, or a Google Storage Bucket. Then run:
terraform planto preview what would be created or changed.terraform applyonly after you have read that plan.
The guide is explicit that you should always review the plan before making changes. A plan is where you catch a “replace” or “destroy” you did not intend, which matters most for anything holding data.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors4. Add HTTPS, DNS, database and API
Next, codify the remaining pieces: HTTPS, DNS, the database, and the serverless functions and API gateway that talk to it. Wire resources together through attributes instead of typing values by hand. For example, pass the bucket’s domain into the HTTPS configuration by reference. Terraform then understands the dependency and builds things in the right order.
5. Inspect state and make a small change
Terraform state records the resources Terraform created and that they exist in the provider. Look at it (for example with terraform state list) and confirm your bucket appears. Then change one small attribute and read the proposed update in the plan before applying. This is how you learn to read plans, which is the skill that matters later in CI.
6. Optional extensions
- Destroy and re-apply resources to prove the code can rebuild your deployment.
- Import existing backend infrastructure into Terraform management rather than recreating it.
- Put the configuration in a GitHub repository.
- Automate backend deployment with CI/CD such as GitHub Actions.
The challenge also asks you to link a short blog post describing the Terraform work in your resume.
Rank #3
Is Terraform portable across clouds?
Not automatically. The guide presents IaC as a way to reproduce and change infrastructure, but each configuration still needs a provider block and that provider’s own resource types. Moving from S3 to Azure Storage means rewriting resources, not flipping a switch. This is an inference from the guide’s steps and provider options, but it follows directly from how they are structured.
Choosing a provider
The guide offers three clouds and no authoritative source ranks them for this project, so avoid “best cloud” claims. Decide using these questions:
- Which provider already hosts your resume?
- Which storage, HTTPS, DNS, database and API services does it use?
- What credentials and provider configuration does it need?
- How does it support GitHub Actions federation? The GitHub material reviewed here covers AWS in detail; check your provider’s own docs otherwise.
Cost depends on your provider, account, region and free-tier eligibility. Do not assume any resource is free; check current pricing for your account.
Adding GitHub Actions
The challenge treats CI/CD as extra credit, with Actions controlling how Terraform applies backend changes. HashiCorp’s “Automate Terraform with GitHub Actions” tutorial shows one concrete pattern:
- Open a pull request; the workflow generates a Terraform plan for that branch so reviewers can read it.
- Merge to
main; the workflow applies the change.
Treat that as an example architecture, not a requirement. The tutorial uses HCP Terraform and AWS and needs accounts with all three of GitHub, HCP Terraform and AWS. It warns that provisioning can incur charges depending on AWS free-tier eligibility, and it tells you to destroy the resources and delete the workspace when finished.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Keeping cloud credentials out of GitHub secrets
According to GitHub Docs (“Configuring OpenID Connect in cloud providers”), OpenID Connect (OIDC) lets workflows reach cloud resources without storing long-lived cloud credentials as GitHub secrets. You configure the cloud to trust GitHub’s identity provider, then the workflow requests an OIDC token and exchanges it for a short-lived cloud access token usable by that job. Exchange details and expiry vary by provider.
HashiCorp’s tutorial takes a different route: an HCP Terraform team token stored as a GitHub secret, with AWS credentials held as workspace variables in HCP Terraform. That is not direct GitHub-to-cloud OIDC, so do not conflate the two.
AWS specifics
- Constrain the trust policy. GitHub’s AWS guide says to evaluate the
subclaim so only the expected repository and branch or environment can assume the role. A broad trust policy would let other repositories use your role. - Request the token with permissions. The workflow needs
id-token: write. GitHub clarifies: “Settingid-token: writein the workflow’s permissions does not give the workflow permission to modify or write to any resources.” (GitHub Docs, “Configuring OpenID Connect in Amazon Web Services.”) What the job can do is decided by the IAM role it assumes, so keep that role least-privilege. - Match the subject format. GitHub states that repositories created after July 15, 2026, or those that opted into immutable subject claims, have a
subcontaining immutable owner and repository IDs. Your trust policy must match the format your repository uses. Because this changes over time, copy the subject format from GitHub’s current docs rather than from an older tutorial.
A skeleton of the relevant workflow shape, with placeholders you must replace:
permissions:
id-token: write
contents: read
steps:
- uses: actions/checkout@v4
- uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>
aws-region: <REGION>
- run: terraform init
- run: terraform planCheck the action’s current major version in its repository before using this. Also decide where your Terraform state lives, since a CI runner starts empty each run; a remote backend is the usual answer, and HCP Terraform in HashiCorp’s example fills that role.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallBefore you call it done
- Every resource in the live resume appears in code, or is deliberately left out.
terraform planon unchanged code reports no changes.- Provider versions are pinned if you chose to.
- No access keys are committed to the repository.
- If you tried the HashiCorp tutorial, you destroyed its resources and deleted the workspace.
The challenge page also lists a Terraform Associate exam price (USD 70.50), but that page does not establish the figure is current, so confirm it with the exam provider before budgeting.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
