docs: add Terraform certification notes and tasks

terraform/task-14.md

@@ -0,0 +1,84 @@
+# Assignment
+
+When establishing infrastructure on the AWS cloud, Identity and Access Management (IAM) is among the first and most critical services to configure. IAM facilitates the creation and management of user accounts, groups, roles, policies, and other access controls. The Nautilus DevOps team is currently in the process of configuring these resources and has outlined the following requirements:
+
+For this task, create an IAM user named iamuser_james using terraform. The Terraform working directory is /home/bob/terraform. Create the main.tf file (do not create a different .tf file) to accomplish this task.
+
+Note: Right-click under the EXPLORER section in VS Code and select Open in Integrated Terminal to launch the terminal.
+
+# Solution
+
+# IAM User — `iamuser_james`
+
+Terraform solution to create a single IAM user named `iamuser_james`.
+
+## `main.tf`
+
+```hcl
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+resource "aws_iam_user" "james" {
+  name = "iamuser_james"
+}
+```
+
+## How to run
+
+```bash
+cd /home/bob/terraform
+terraform init
+terraform apply -auto-approve
+```
+
+## How it works
+
+### `aws_iam_user`
+
+This single resource is all the task needs. The `name` argument sets the IAM
+user's login/identifier to `iamuser_james` exactly as required.
+
+A few things worth knowing about what's happening under the hood:
+
+- **IAM is global, not regional.** IAM resources live in the `aws` partition, not
+  in any one region. The `region` in the provider block is still required for the
+  provider to initialize and authenticate, but it has no bearing on *where* the
+  user is created — an IAM user is visible account-wide regardless of region.
+
+- **The `iamuser_` prefix is not cosmetic.** In these locked-down sandbox
+  environments, IAM user names must begin with `iamuser_`. The task-supplied name
+  already satisfies that, so the create call stays within the login user's
+  permission scope and won't get denied.
+
+- **No path, policy, or login profile is set.** The task asks only for the user to
+  exist, so we deliberately don't attach policies, create access keys, or set a
+  console password. That keeps the resource minimal and avoids the inline-policy /
+  custom-policy restrictions that these sandboxes enforce — attaching a policy the
+  login user can't grant would fail with `AccessDenied`.
+
+### Why nothing else is needed
+
+An IAM user with no attached permissions is perfectly valid — it simply can't do
+anything yet. Groups, policies, access keys, and login profiles are all separate
+resources you'd add later as requirements dictate. For "create a user named X,"
+one `aws_iam_user` block is the complete and correct answer.
+
+## Verify
+
+```bash
+aws iam get-user --user-name iamuser_james \
+  --query 'User.{Name:UserName,Id:UserId,Arn:Arn}'
+```
+
+Expected — the user's name, a unique ID, and an ARN of the form
+`arn:aws:iam::<account-id>:user/iamuser_james`.