docs: add Terraform certification notes and tasks

terraform/task-31.md

@@ -0,0 +1,105 @@
+# Assignment
+
+The Nautilus DevOps team is currently engaged in a cleanup process, focusing on removing unnecessary data and services from their AWS account. As part of the migration process, several resources were created for one-time use only, necessitating a cleanup effort to optimize their AWS environment.
+
+Delete an IAM group named iamgroup_siva using terraform. Make sure to keep the provisioning code, as we might need to provision this instance again later.
+
+The Terraform working directory is /home/bob/terraform.
+
+Note: Right-click under the EXPLORER section in VS Code and select Open in Integrated Terminal to launch the terminal.
+
+# Solution
+
+# Delete IAM Group (Keep Code) — `iamgroup_siva`
+
+Same shape as the "delete but keep the code" pattern: **destroy** the group while
+leaving its provisioning block in `main.tf` for later reuse. A **targeted destroy**
+does exactly this — it acts on the real resource and Terraform state only, never on
+your `.tf` source.
+
+## `main.tf` — leave unchanged
+
+Do **not** delete or comment out the block. It stays exactly as given:
+
+```hcl
+resource "aws_iam_group" "this" {
+  name = "iamgroup_siva"
+}
+```
+
+## How to run
+
+```bash
+cd /home/bob/terraform
+
+# Destroy ONLY this IAM group; leaves the code in main.tf intact.
+terraform destroy -target=aws_iam_group.this -auto-approve
+```
+
+## How it works
+
+### Targeted destroy vs. the wrong approaches
+
+| Approach | Result |
+|----------|--------|
+| Delete the resource block, then `apply` | Group is destroyed, but the **code is gone** — violates "keep the provisioning code." |
+| `terraform destroy` (no target) | Destroys **everything** in the config, not just this group. |
+| `terraform destroy -target=aws_iam_group.this` | Destroys **only** this group; code stays in `main.tf`. ✅ |
+
+The `-target` flag scopes the operation to the single resource address
+(`aws_iam_group.this` — note this is the **Terraform resource name** `this`, not the
+AWS group name `iamgroup_siva`). Terraform calls `DeleteGroup`, removes the resource
+from state, and leaves your configuration file untouched, because destroy operates on
+infrastructure and state, never on source code.
+
+### Why the code surviving matters
+
+Keeping the block means the group is trivially re-creatable later: a plain
+`terraform apply` will see it declared in config but absent from state and recreate
+it. That satisfies "we might need to provision this again" — the declaration remains
+the reusable blueprint.
+
+### One caveat for IAM groups
+
+`DeleteGroup` only succeeds if the group is **empty** — no users as members and no
+attached/inline policies. If the destroy errors with `DeleteConflict`, detach
+everything first, then re-run:
+
+```bash
+# Remove any members
+aws iam get-group --group-name iamgroup_siva \
+  --query 'Users[].UserName' --output text | \
+  xargs -r -n1 -I{} aws iam remove-user-from-group --group-name iamgroup_siva --user-name {}
+
+# Detach any managed policies
+aws iam list-attached-group-policies --group-name iamgroup_siva \
+  --query 'AttachedPolicies[].PolicyArn' --output text | \
+  xargs -r -n1 -I{} aws iam detach-group-policy --group-name iamgroup_siva --policy-arn {}
+
+# Then retry
+terraform destroy -target=aws_iam_group.this -auto-approve
+```
+
+For a bare group like this one (created empty), the plain targeted destroy works
+directly.
+
+### Expected state afterward
+
+After the destroy, the config still declares a resource that no longer exists in
+state, so `terraform plan` will show Terraform wants to **create** `iamgroup_siva`
+again (`+ 1 to add`). That's expected — **do not apply it**. The task wants the group
+deleted with the code retained, which is exactly this state.
+
+## Verify
+
+```bash
+aws iam get-group --group-name iamgroup_siva 2>&1 | grep -q 'NoSuchEntity' \
+  && echo "Group deleted." \
+  || echo "Group still exists."
+
+# Confirm the code is still present
+grep -A2 'resource "aws_iam_group" "this"' /home/bob/terraform/main.tf
+```
+
+Expected — `get-group` fails with `NoSuchEntity` (group gone), and the resource block
+is still present in `main.tf`.