docs: add Terraform certification notes and tasks

terraform/task-36.md

@@ -0,0 +1,116 @@
+# Assignment
+
+The Nautilus DevOps team is enhancing infrastructure automation and needs to provision a Security Group using Terraform with specific configurations.
+
+For this task, create an AWS Security Group using Terraform with the following requirements:
+
+The Security Group name xfusion-sg should be stored in a variable named KKE_sg.
+Note:
+
+1. The configuration values should be stored in a variables.tf file.
+
+2. The Terraform script should be structured with a main.tf file referencing variables.tf.
+The Terraform working directory is /home/bob/terraform.
+
+Right-click under the EXPLORER section in VS Code and select Open in Integrated Terminal to launch the terminal.
+
+# Solution
+
+# Security Group with Variables — `xfusion-sg` (`KKE_sg`)
+
+Two-file structure again: `variables.tf` holds the config, `main.tf` references it. The
+Security Group name must be stored in a variable named exactly `KKE_sg`.
+
+## `variables.tf`
+
+```hcl
+variable "KKE_sg" {
+  description = "Name of the Security Group"
+  type        = string
+  default     = "xfusion-sg"
+}
+```
+
+## `main.tf`
+
+```hcl
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+# Default VPC to place the security group in
+data "aws_vpc" "default" {
+  default = true
+}
+
+resource "aws_security_group" "xfusion_sg" {
+  name        = var.KKE_sg
+  description = "Security group xfusion-sg managed by Terraform"
+  vpc_id      = data.aws_vpc.default.id
+
+  tags = {
+    Name = var.KKE_sg
+  }
+}
+```
+
+## How to run
+
+```bash
+cd /home/bob/terraform
+terraform init
+terraform apply -auto-approve
+```
+
+## How it works
+
+### Splitting config from logic
+
+Terraform merges every `.tf` file in the working directory into one configuration, so
+`variables.tf` and `main.tf` act as a single unit — no imports needed. The convention:
+`variables.tf` declares inputs, `main.tf` declares resources that consume them via
+`var.<name>`.
+
+### The variable
+
+- **`variable "KKE_sg"`** — holds the Security Group name, exactly as required. The
+  `default` of `xfusion-sg` lets `terraform apply` run without prompting for a value.
+- **`type = string`** validates the input type at plan time.
+
+### The Security Group
+
+- **`name = var.KKE_sg`** — resolves to `xfusion-sg`. The `var.` prefix interpolates
+  the variable's value.
+- **`description`** — **required** by AWS on every security group. If you omit it, the
+  provider defaults it to "Managed by Terraform"; it's set explicitly here for clarity.
+  Note the description is **immutable** — AWS won't let you change it after creation, so
+  it must be right the first time.
+- **`vpc_id = data.aws_vpc.default.id`** — places the SG in the account's default VPC.
+  The `data "aws_vpc" "default"` block reads the existing default VPC without managing
+  it. (If `vpc_id` is omitted entirely, the SG lands in the default VPC anyway, but
+  wiring it explicitly is clearer and deterministic.)
+- **No `ingress`/`egress` blocks** — the task specifies no rules, so none are defined.
+  Be aware that when Terraform manages a security group with no `egress` block, it
+  **removes** the default allow-all outbound rule, leaving the SG with no rules at all.
+  That matches the task (which asks only for the named SG to exist); add an `egress`
+  block if outbound traffic is later needed.
+
+## Verify
+
+```bash
+aws ec2 describe-security-groups \
+  --filters Name=group-name,Values=xfusion-sg \
+  --query 'SecurityGroups[0].{Name:GroupName,Desc:Description,Vpc:VpcId,Id:GroupId}'
+```
+
+Expected — `GroupName: xfusion-sg`, the description, the default VPC ID, and a
+generated group ID.