docs: add Terraform certification notes and tasks

terraform/task-28.md

@@ -0,0 +1,93 @@
+# Assignment
+
+Data protection and recovery are fundamental aspects of data management. It's essential to have systems in place to ensure that data can be recovered in case of accidental deletion or corruption. The DevOps team has received a requirement for implementing such measures for one of the S3 buckets they are managing.
+
+The S3 bucket name is xfusion-s3-1124, enable versioning for this bucket using Terraform.
+
+The Terraform working directory is /home/bob/terraform. Update the main.tf file (do not create a different .tf file) to accomplish this task.
+
+Note: Right-click under the EXPLORER section in VS Code and select Open in Integrated Terminal to launch the terminal.
+
+# Solution
+
+# Enable S3 Versioning — `xfusion-s3-1124`
+
+The bucket (`aws_s3_bucket.s3_ran_bucket`) already exists in this `main.tf`. Enabling
+versioning in modern AWS provider versions is done with a **separate**
+`aws_s3_bucket_versioning` resource, not an inline `versioning {}` block.
+
+## `main.tf` (append this block; leave the existing bucket unchanged)
+
+```hcl
+resource "aws_s3_bucket" "s3_ran_bucket" {
+  bucket = "xfusion-s3-1124"
+  acl    = "private"
+
+  tags = {
+    Name = "xfusion-s3-1124"
+  }
+}
+
+# Enable versioning on the bucket
+resource "aws_s3_bucket_versioning" "s3_ran_bucket" {
+  bucket = aws_s3_bucket.s3_ran_bucket.id
+
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+```
+
+## How to run
+
+```bash
+cd /home/bob/terraform
+terraform plan     # should show only the new aws_s3_bucket_versioning to add
+terraform apply -auto-approve
+```
+
+## How it works
+
+### `aws_s3_bucket_versioning`
+
+Since AWS provider v4, S3 sub-configurations (versioning, ACL, logging, lifecycle,
+encryption, etc.) were split out of the `aws_s3_bucket` resource into dedicated
+resources. Versioning is now its own resource:
+
+- **`bucket = aws_s3_bucket.s3_ran_bucket.id`** — targets the existing bucket by
+  reference. Using the attribute (not the hardcoded name) creates an **implicit
+  dependency**, so Terraform manages the bucket first, then the versioning config, and
+  the plan shows only the new resource being added.
+- **`versioning_configuration { status = "Enabled" }`** — turns on versioning. Valid
+  states are `Enabled`, `Suspended`, and `Disabled` (only meaningful on create).
+  `Enabled` means every overwrite or delete keeps prior object versions, which is
+  exactly the accidental-deletion/corruption protection the task calls for.
+
+### Note on the existing inline `acl`
+
+The existing bucket block sets `acl = "private"` inline. That inline argument is
+**deprecated** in current provider versions (the modern equivalent is a separate
+`aws_s3_bucket_acl` resource), but it still functions and — importantly — it's a
+**different concern** from versioning. Adding `aws_s3_bucket_versioning` does **not**
+conflict with the inline `acl`. Conflicts only arise if you configure the *same*
+concern two ways (e.g. an inline `versioning {}` block **and** a standalone
+`aws_s3_bucket_versioning` resource on the same bucket). Leave the `acl` line as-is —
+the task only asks for versioning.
+
+### How versioning behaves once enabled
+
+- New writes to existing keys create new versions; the old bytes are retained under a
+  prior version ID.
+- Deletes place a **delete marker** rather than removing data, so objects can be
+  recovered.
+- Versioning, once enabled, can only be **suspended**, never fully turned off — that's
+  by design in S3.
+
+## Verify
+
+```bash
+aws s3api get-bucket-versioning --bucket xfusion-s3-1124 \
+  --query 'Status'
+```
+
+Expected — `"Enabled"`.