docs: add Terraform certification notes and tasks

terraform/task-22.md

@@ -0,0 +1,116 @@
+# Assignment
+
+The Nautilus DevOps team is working on automating infrastructure deployment using AWS CloudFormation. As part of this effort, they need to create a CloudFormation stack that provisions an S3 bucket with versioning enabled.
+
+Create a CloudFormation stack named xfusion-stack using Terraform. This stack should contain an S3 bucket named xfusion-bucket-20270 as a resource, and the bucket must have versioning enabled. The Terraform working directory is /home/bob/terraform. Create the main.tf file (do not create a different .tf file) to accomplish this task.
+
+Note: Right-click under the EXPLORER section in VS Code and select Open in Integrated Terminal to launch the terminal.
+
+# Solution
+
+# CloudFormation Stack — `xfusion-stack` (S3 bucket with versioning)
+
+Terraform provisions a **CloudFormation stack**; the stack's template, in turn,
+creates a versioned S3 bucket. The bucket is a CloudFormation-managed resource, not a
+native Terraform one.
+
+## `main.tf`
+
+```hcl
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+resource "aws_cloudformation_stack" "xfusion" {
+  name = "xfusion-stack"
+
+  template_body = <<-TEMPLATE
+    AWSTemplateFormatVersion: "2010-09-09"
+    Description: S3 bucket with versioning enabled
+    Resources:
+      XfusionBucket:
+        Type: AWS::S3::Bucket
+        Properties:
+          BucketName: xfusion-bucket-20270
+          VersioningConfiguration:
+            Status: Enabled
+  TEMPLATE
+}
+```
+
+## How to run
+
+```bash
+cd /home/bob/terraform
+terraform init
+terraform apply -auto-approve
+```
+
+## How it works
+
+### Two layers of provisioning
+
+This task is deliberately indirect. Terraform does **not** create the bucket
+directly with `aws_s3_bucket`. Instead:
+
+1. Terraform creates an `aws_cloudformation_stack` resource.
+2. AWS CloudFormation reads the template embedded in that stack and creates the S3
+   bucket from it.
+
+So the ownership chain is **Terraform → CloudFormation stack → S3 bucket**. If you
+inspect the bucket afterward it will show as managed by the `xfusion-stack` stack,
+which is exactly what the task asks for.
+
+### `aws_cloudformation_stack`
+
+- **`name = "xfusion-stack"`** — the stack name, exactly as required.
+- **`template_body`** — the CloudFormation template, inlined as a YAML heredoc. The
+  `<<-TEMPLATE` form strips leading indentation so the YAML parses cleanly despite
+  being nested inside HCL. You could also point at a file with `template_url` (S3) or
+  `file()`, but inlining keeps everything in the single `main.tf` the task requires.
+
+### The CloudFormation template
+
+- **`AWSTemplateFormatVersion`** — the CFN schema version; `"2010-09-09"` is the only
+  valid value and is effectively a constant.
+- **`Resources.XfusionBucket`** — the logical ID (an internal name CloudFormation
+  uses to track the resource). It's arbitrary; the actual bucket name comes from the
+  properties below.
+- **`Type: AWS::S3::Bucket`** — declares an S3 bucket.
+- **`BucketName: xfusion-bucket-20270`** — sets the real, globally-unique bucket
+  name required by the task.
+- **`VersioningConfiguration.Status: Enabled`** — turns on object versioning, so
+  overwritten or deleted objects are retained as prior versions. This is the CFN
+  equivalent of Terraform's `aws_s3_bucket_versioning` resource.
+
+### Why versioning is inside the template
+
+Because the bucket is owned by CloudFormation, its configuration must be expressed in
+CFN syntax inside the template — not with a separate Terraform
+`aws_s3_bucket_versioning` block. Mixing a native TF versioning resource against a
+CFN-managed bucket would create two controllers fighting over the same bucket, so all
+bucket config lives in the template.
+
+## Verify
+
+```bash
+# Stack created successfully
+aws cloudformation describe-stacks --stack-name xfusion-stack \
+  --query 'Stacks[0].{Name:StackName,Status:StackStatus}'
+
+# Bucket exists with versioning enabled
+aws s3api get-bucket-versioning --bucket xfusion-bucket-20270 \
+  --query 'Status'
+```
+
+Expected — stack `StackStatus: CREATE_COMPLETE`, and the versioning query returning
+`"Enabled"`.