Environments
Run the same ShopLite code as isolated dev and prod environments: separate state, separate tfvars, separate AWS accounts with guards against applying to the wrong one, and a safe way to share outputs.
Until now there has been one ShopLite. Real systems have at least dev and prod, which must share code (so prod runs what was tested) but share nothing else: not state, not credentials, not blast radius. This stage compares the two common approaches, workspaces versus separate backends, builds the one most teams settle on, puts prod in its own AWS account with guardrails that make 'applied dev changes to prod' impossible, and shows how other teams can consume ShopLite's outputs without being able to read its state.
+ ShopLite gains: per-environment backends and tfvars behind a small wrapper script, a prod environment in its own AWS account with allowed_account_ids, a us-east-1 provider alias for billing alarms, and outputs published to SSM for other teams
- 6.1
Workspaces vs Separate Backends
Try CLI workspaces on ShopLite, see exactly where they help and where they bite, and decide on the environment strategy for the rest of the course.
25 minFree (nothing is applied)1 break-its - 6.2
Dev and Prod from the Same Code
`./tf dev plan` and `./tf prod plan` run the same code against separate states with separate settings — HA NAT, Multi-AZ, and bigger tasks in prod — and nobody can accidentally mix them.
50 minPlan-only for prod here; applying prod costs ~$0.35/hour (Multi-AZ DB, 2 NATs)2 break-its - 6.3
Separate AWS Accounts and Provider Aliases
Prod runs in its own AWS account, reached by assuming a deploy role; each environment's provider refuses to act on any other account; and a second provider in `us-east-1` creates a billing alarm where AWS actually publishes billing data.
45 minFree (a CloudWatch alarm is free-tier)2 break-its - 6.4
Sharing Outputs with Other Teams — Without Sharing State
The analytics team's separate Terraform config can find ShopLite's VPC, private subnets, and database security group through SSM parameters, without ever getting read access to ShopLite's state.
35 minFree (standard SSM parameters)2 break-its