OpenTofu AWS Free-Tier Lab

Level:Intermediate

Time:2-3 hours

Cost:medium

Works locally:No

Cloud creds:Yes

Cleanup:Yes

Reviewed:2026-05-30

Validation:make validate

OpenTofu Terraform AWS EC2 VPC

Overview

Student AWS free-tier IaC lab with explicit destroy and cost warnings.

What You Will Build

Outcome Plan/apply evidence plus destroy proof

Tools used OpenTofu, Terraform, AWS, EC2, VPC

Best fit Intermediate - 2-3 hours

Architecture Diagram

Student workstation Repository files IaC plan AWS account Validation proof

Prerequisites

• Install or review: OpenTofu, Terraform, AWS, EC2, VPC.
• Use your own cloud account credentials and keep them out of commits.
• This project expects cloud resources, so verify budget alerts and cleanup first.
• Open the safety guide before running commands that create infrastructure.

Credentials And Cost Warning

Cost and credential stance

Cost risk is medium. Cloud target: AWS. Cloud credentials needed: Yes. Always use your own account, never commit secrets, and confirm cleanup before creating paid infrastructure.

Step-By-Step Lab

Use this flow before you run commands:

1. Read the cost and credential warning above.
2. Review the validation, troubleshooting, cleanup, and portfolio proof sections below.
3. Follow the original project guide preserved near the bottom of this page.
4. Return to the validation and cleanup checks before you capture portfolio evidence.

Validation Checks

Run the project validation command before and after meaningful changes:

make validate

Troubleshooting

• Run make validate first so local tooling issues are visible early.
• If a command fails, check tool versions, working directory, and required environment variables.
• For cloud failures, confirm account identity, region, quotas, and least-privilege IAM.

Cleanup

Cleanup is available or expected for this lab. Use the cleanup or destroy steps in the guide below, then confirm that local clusters, containers, cloud resources, buckets, state files, and CI secrets are no longer active.

Portfolio Proof

• Validation command output: make validate
• Screenshot or terminal proof: Plan/apply evidence plus destroy proof
• Notes explaining what changed, what failed, and how you fixed it
• Cleanup evidence, especially for cloud or Kubernetes resources

Original Project Guide

The original README content is preserved here for lab-specific commands and context. Headings are intentionally demoted so the page outline stays focused on the standard lab flow.

External image reference Level

External image reference Cost

External image reference IaC

External image reference Cloud

Beginner-friendly infrastructure-as-code lab that creates a tiny AWS VPC, public subnet, security group, and optional free-tier EC2 instance with OpenTofu or Terraform.

What You Learn

• How OpenTofu/Terraform plans and applies infrastructure
• How providers, variables, outputs, and state work
• Why tags and destroy steps matter for cost control
• How to keep cloud labs small and reviewable

Architecture

flowchart TB
  Student["Student workstation"] --> Tofu["OpenTofu or Terraform"]
  Tofu --> AWS["AWS provider"]
  AWS --> VPC["VPC 10.52.0.0/16"]
  VPC --> Subnet["Public subnet"]
  Subnet --> SG["Security group"]
  SG --> EC2["Optional t3.micro nginx instance"]

Cost Warning

This lab can create AWS resources. Use free-tier eligible instance types, confirm your region, restrict SSH to your own IP, and destroy everything when done.

Prerequisites

• AWS account
• AWS CLI configured
• OpenTofu, or Terraform with TF=terraform

One-Command Local Validation

make validate

Validation is local: it checks formatting, initializes providers without a backend, and runs validate. It does not create AWS resources.

Review-Then-Apply Workflow

cp terraform.tfvars.example terraform.tfvars
make plan
make up
make logs
make down

Use Terraform instead of OpenTofu:

TF=terraform make validate
TF=terraform make plan
TF=terraform make up
TF=terraform make down

make up refuses to run until make plan has created tfplan, so students review the cloud changes first.

Troubleshooting

• tofu: command not found: install OpenTofu or prefix commands with TF=terraform.
• AWS credential errors: run aws sts get-caller-identity and confirm the expected account appears.
• SSH is open to the world: set allowed_ssh_cidr in terraform.tfvars to your public IP with /32.
• Duplicate names or stale state: run make logs to inspect outputs, then make down when you are done.

Cleanup

make down
rm -f tfplan

Always confirm the destroy plan before approving it.

Student Exercises

• Add an S3 backend for remote state.
• Add a second subnet in another Availability Zone.
• Add a budget alarm.
• Convert the EC2 instance into a reusable module.

Source Files On GitHub

Use the guide first.

The full learning flow stays on this page. Open GitHub only when a step asks you to inspect code, fork the lab, or download source assets.

Read safety guide Open project source