docs: add Terraform certification notes and tasks

terraform/task-20.md

@@ -0,0 +1,106 @@
+# Assignment
+
+The Nautilus DevOps team needs to create an SSM parameter in AWS with the following requirements:
+
+1) The name of the parameter should be nautilus-ssm-parameter.
+
+2) Set the parameter type to String.
+
+3) Set the parameter value to nautilus-value.
+
+4) The parameter should be created in the us-east-1 region.
+
+5) Ensure the parameter is successfully created using terraform and can be retrieved when the task is completed.
+
+The Terraform working directory is /home/bob/terraform. Create the main.tf file (do not create a different .tf file) to accomplish this task.
+
+Note: Right-click under the EXPLORER section in VS Code and select Open in Integrated Terminal to launch the terminal.
+
+# Solution
+
+# SSM Parameter — `nautilus-ssm-parameter`
+
+Terraform solution to create a plaintext String parameter in AWS Systems Manager
+Parameter Store.
+
+## `main.tf`
+
+```hcl
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+resource "aws_ssm_parameter" "nautilus" {
+  name  = "nautilus-ssm-parameter"
+  type  = "String"
+  value = "nautilus-value"
+}
+```
+
+## How to run
+
+```bash
+cd /home/bob/terraform
+terraform init
+terraform apply -auto-approve
+```
+
+## How it works
+
+### `aws_ssm_parameter`
+
+One resource covers the whole task. SSM Parameter Store is a managed key/value store
+for configuration data and secrets, and this creates a single entry in it.
+
+- **`name = "nautilus-ssm-parameter"`** — the parameter's key/path. Names can be
+  hierarchical (e.g. `/app/prod/db-url`); a flat name like this one is stored at the
+  root.
+
+- **`type = "String"`** — the parameter type. The three types are:
+  - `String` — a single plaintext value (used here).
+  - `StringList` — a comma-separated list of values.
+  - `SecureString` — an encrypted value backed by a KMS key.
+
+  The task wants a plain `String`, so no encryption or KMS key is involved.
+
+- **`value = "nautilus-value"`** — the stored value. Because the type is `String`,
+  it's held as-is in plaintext and returned verbatim on read.
+
+- **Region** comes from the provider (`us-east-1`). Unlike IAM, SSM parameters
+  **are** regional — a parameter created here is only visible in `us-east-1`, which
+  satisfies requirement #4.
+
+### Retrieval (requirement #5)
+
+The task asks that the parameter be retrievable once created. Nothing extra is
+needed in the config for that — a `String` parameter is readable immediately via the
+SSM API. The verification command below confirms it.
+
+> Note: if this were a `SecureString`, you'd need `--with-decryption` on read to get
+> the plaintext back. For a plain `String` that flag is unnecessary.
+
+## Verify
+
+```bash
+aws ssm get-parameter --name nautilus-ssm-parameter \
+  --query 'Parameter.{Name:Name,Type:Type,Value:Value}'
+```
+
+Expected:
+
+```json
+{
+  "Name": "nautilus-ssm-parameter",
+  "Type": "String",
+  "Value": "nautilus-value"
+}
+```