Set Up the ShopLite Repo and Run terraform init

1. 1

   Install Terraform and check the version

   Install Terraform 1.10 or newer; this course uses features from 1.10 onward, such as S3-native state locking. Use your OS package manager so updates are easy, and avoid random binaries from the internet.

   On Windows, run the commands in Git Bash or PowerShell after installing with winget install Hashicorp.Terraform. On Linux, add HashiCorp's apt/yum repository as described on developer.hashicorp.com, then apt install terraform.

   terminalcopy cmd

   $ brew tap hashicorp/tap && brew install hashicorp/tap/terraform

   terraform version

   ── expected output ──

   Terraform v1.13.3

   on darwin_arm64

2. 2

   Give Terraform AWS credentials (not root, not long-lived keys)

   Terraform's AWS provider finds credentials the same way the AWS CLI does. Use the named profile you set up in the AWS course (Topic 0.4 / 1.4), ideally an IAM Identity Center (SSO) profile, which gives short-lived credentials. Never use root user keys.

   Export AWS_PROFILE so both the CLI and Terraform pick it up, then confirm who you are before creating anything. Checking get-caller-identity first is a habit worth keeping, because it's the only reliable way to know which account you're about to change.

   terminalcopy cmd

   $ aws sso login --profile shoplite-dev

   export AWS_PROFILE=shoplite-dev

   aws sts get-caller-identity

   ── expected output ──

   {

   "UserId": "AROAXXXXXXXXXXXXXXXXX:priya",

   "Account": "123456789012",

   "Arn": "arn:aws:sts::123456789012:assumed-role/AWSReservedSSO_AdministratorAccess_abc123/priya"

   }

3. 3

   Create the repo and a .gitignore that protects state and secrets

   All infrastructure lives in infra/ inside the ShopLite repo. Later stages split it into modules and environments, but a single folder is the right place to start.

   The .gitignore matters more than it looks. .terraform/ is a local cache of downloaded providers (hundreds of MB). *.tfstate files can contain passwords and resource details in plain text and must never reach Git — Stage 1 moves state to S3. *.tfplan files are saved plans, which also contain sensitive values. Note what is NOT ignored: .terraform.lock.hcl must be committed.

   # Local provider cache — recreated by terraform init
   **/.terraform/*
   
   # State: may contain secrets in plain text. Never commit.
   *.tfstate
   *.tfstate.*
   
   # Saved plans also contain sensitive values
   *.tfplan
   tfplan
   
   # Crash logs
   crash.log
   crash.*.log
   
   # Local-only variable overrides (secrets, personal settings)
   *.local.tfvars
   override.tf
   override.tf.json
   
   # NOTE: .terraform.lock.hcl is intentionally NOT ignored — commit it.

   terminalcopy cmd

   $ mkdir -p shoplite/infra && cd shoplite && git init

   ── expected output ──

   Initialized empty Git repository in /home/priya/shoplite/.git/

4. 4

   Pin Terraform and provider versions

   versions.tf holds the terraform settings block. required_version stops anyone running an older Terraform against this code. required_providers says which provider to download (source is <namespace>/<name> on the Registry) and which versions are allowed.

   terraform {
     required_version = ">= 1.10"
   
     required_providers {
       aws = {
         source  = "hashicorp/aws"
         version = "~> 6.0"
       }
     }
   }

5. 5

   Configure the AWS provider with default tags

   The provider block configures the plugin: which region to use and, very usefully, default_tags. Every taggable resource this configuration creates automatically gets these tags, so you never forget them. In the AWS course's cost topic (7.4), tags are how you find out what ShopLite actually costs.

   We hardcode the region for now; Mission 0.4 turns it into a variable.

   provider "aws" {
     region = "ap-south-1"
   
     default_tags {
       tags = {
         Project   = "shoplite"
         ManagedBy = "terraform"
         Repo      = "github.com/you/shoplite"
       }
     }
   }

6. 6

   Run terraform init

   init prepares the working directory: it reads required_providers, downloads matching providers from the Registry into .terraform/, writes .terraform.lock.hcl, and sets up the backend where state is stored (local for now). Run it the first time, and again whenever you add a provider or module or change the backend.

   terminalcopy cmd

   $ cd infra

   terraform init

   ── expected output ──

   Initializing the backend...

   Initializing provider plugins...

   - Finding hashicorp/aws versions matching "~> 6.0"...

   - Installing hashicorp/aws v6.14.0...

   - Installed hashicorp/aws v6.14.0 (signed by HashiCorp)

   Terraform has created a lock file .terraform.lock.hcl to record the provider

   selections it made above. Include this file in your version control repository

   so that Terraform can guarantee to make the same selections by default when

   you run "terraform init" in the future.

    

   Terraform has been successfully initialized!

7. 7

   Format and validate — the two commands to run before every commit

   terraform fmt rewrites files into the canonical style (aligned = signs, two-space indents), so diffs in pull requests only show real changes. -recursive covers subfolders. terraform validate checks syntax and internal consistency, such as unknown arguments or bad references, without calling AWS. In Stage 7 both run in CI on every pull request.

   terminalcopy cmd

   $ terraform fmt -recursive

   terraform validate

   ── expected output ──

   Success! The configuration is valid.

8. 8

   Commit the starting point

   Check that git status shows the lock file but not .terraform/, then commit. Every mission in this course ends with a commit, so your Git history becomes the ShopLite build log.

   terminalcopy cmd

   $ cd .. && git add . && git status --short

   ── expected output ──

   A .gitignore

   A infra/.terraform.lock.hcl

   A infra/providers.tf

   A infra/versions.tf

Make each change, run the command, and read the error before revealing the diagnosis. Recognising these messages on sight is what makes you fast on a real team. Undo the change afterwards.