docs: add Terraform certification notes and tasks

terraform/task-38.md

@@ -0,0 +1,103 @@
+# Assignment
+
+The Nautilus DevOps team is automating IAM user creation using Terraform for better identity management.
+
+For this task, create an AWS IAM User using Terraform with the following requirements:
+
+The IAM User name iamuser_mark should be stored in a variable named KKE_user.
+Note:
+
+1. The configuration values should be stored in a variables.tf file.
+
+2. The Terraform script should be structured with a main.tf file referencing variables.tf.
+The Terraform working directory is /home/bob/terraform.
+
+Right-click under the EXPLORER section in VS Code and select Open in Integrated Terminal to launch the terminal.
+
+# Solution
+
+# IAM User with Variables — `iamuser_mark` (`KKE_user`)
+
+Two-file structure: `variables.tf` holds the config, `main.tf` references it. The IAM
+User name must be stored in a variable named exactly `KKE_user`.
+
+## `variables.tf`
+
+```hcl
+variable "KKE_user" {
+  description = "Name of the IAM user"
+  type        = string
+  default     = "iamuser_mark"
+}
+```
+
+## `main.tf`
+
+```hcl
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+resource "aws_iam_user" "mark" {
+  name = var.KKE_user
+
+  tags = {
+    Name = var.KKE_user
+  }
+}
+```
+
+## How to run
+
+```bash
+cd /home/bob/terraform
+terraform init
+terraform apply -auto-approve
+```
+
+## How it works
+
+### Splitting config from logic
+
+Terraform merges every `.tf` file in the directory into one configuration, so
+`variables.tf` and `main.tf` act as a single unit — no imports needed. `variables.tf`
+declares inputs; `main.tf` declares resources that consume them via `var.<name>`.
+
+### The variable
+
+- **`variable "KKE_user"`** — holds the IAM user name, exactly as required. The
+  `default` of `iamuser_mark` lets `terraform apply` run without prompting.
+- **`type = string`** validates the input type at plan time.
+
+### The IAM user
+
+- **`name = var.KKE_user`** — resolves to `iamuser_mark`. The `var.` prefix
+  interpolates the variable's value.
+- **`iamuser_` prefix matters.** These locked-down sandboxes require IAM user names to
+  start with `iamuser_`. The variable's value already satisfies that, so the create
+  stays inside the login user's permission scope and won't be denied.
+- **IAM is global.** The `region` in the provider is needed to initialize and
+  authenticate, but IAM resources aren't regional — the user is visible account-wide.
+- **No policies, keys, or login profile.** The task asks only for the user to exist, so
+  nothing is attached. This keeps the config minimal and avoids the custom-policy /
+  attach restrictions these sandboxes enforce (attaching permissions broader than the
+  login user has would fail with `AccessDenied`).
+
+## Verify
+
+```bash
+aws iam get-user --user-name iamuser_mark \
+  --query 'User.{Name:UserName,Id:UserId,Arn:Arn}'
+```
+
+Expected — the user's name, a unique ID, and an ARN of the form
+`arn:aws:iam::<account-id>:user/iamuser_mark`.