Putting It All Together: My Terraform Journey

The 30-day Terraform challenge has been a rollercoaster of learning, trial, and triumph. As I stand on Day 22, immersed in Azure infrastructure automation, I’ve already gained invaluable skills and insights. While there’s still ground to cover, this journey has been as much about perseverance as it has been about technical growth.

Here’s a look into where I started, where I am now, and some of the challenges that have shaped my experience so far — especially with Terraform Sentinel policies.

The Beginning: Learning Terraform and Azure Integration

When I began this challenge, my focus was simple: understand how Terraform works and use it to manage Azure infrastructure. The learning curve was steep. Concepts like Terraform state files, remote backends, and modular configurations were completely new to me.

My first milestone was provisioning a resource group and an Azure Storage account. It felt small but served as the foundation for larger, more complex setups like virtual networks, AKS clusters, and container registries.

The Turning Point: Modularization and Complex Workflows

By Day 10, I transitioned from writing simple resource configurations to creating reusable modules for components like:

• Virtual Networks (VNet)
• Azure Kubernetes Service (AKS)
• Network Security Groups (NSG)
• Azure Container Registry (ACR)

These modules simplified my workflow, but they also introduced new challenges. Managing variables and outputs across multiple modules was tricky. One misconfigured variable caused cascading failures, forcing me to backtrack and rethink my approach.

Current Progress: Terraform Sentinel Policies

Day 23 has brought me face-to-face with Terraform Sentinel — a governance tool that enforces compliance rules during Terraform plans and applies. Sentinel is powerful, but it’s also unforgiving.

My first Sentinel policy aimed to enforce tagging on all Azure resources. Writing the policy was straightforward, but enforcing it was a different story:

1. Testing Non-Compliance Running terraform plan against existing configurations revealed several resources that lacked the required tags. Sentinel immediately flagged these, blocking the apply.
2. Fixing Non-Compliant Resources Updating resources to comply with the policy wasn’t always simple. For instance, adding tags to an Azure VNet triggered a cascading re-creation of associated subnets, disrupting downstream dependencies. I had to carefully adjust my configurations in stages, prioritizing resources with minimal impact.
3. Iterative Debugging Sentinel’s error messages required a deep dive into both policy logic and Terraform plans. Adjusting the policy to handle exceptions — such as resources created by Azure itself — was a learning experience in balancing enforcement with flexibility.

Challenges Faced

1. Terraform State Management

Using Azure Blob Storage for remote state helped maintain consistency, but managing state locks during collaborative work was a challenge. Accidentally leaving a locked state file required using terraform force-unlock, which I quickly learned to handle cautiously.

2. Dependency Management

AKS clusters with dependencies on VNets, public IPs, and NSGs required careful orchestration. A minor change in one module could unintentionally disrupt the entire workflow.

3. Sentinel’s Rigid Enforcement

While Sentinel ensures compliance, it doesn’t forgive mistakes. Balancing strict governance with practical workflows has been one of the most intellectually demanding aspects of this challenge so far.

What’s Next?

With seven days left in the challenge, my focus is on refining what I’ve built and tackling remaining tasks:

• Advanced Sentinel Policies: Beyond tagging, I want to enforce stricter policies, such as restricting the creation of public-facing resources without justification.
• CI/CD Pipeline Integration: I plan to integrate Terraform into a GitHub Actions pipeline, automating validations and applying changes.
• Documentation: Creating thorough documentation for each module and policy will help future-proof the infrastructure.

Lessons Learned

1. Start Small and Build Gradually Trying to deploy complex infrastructure on Day 1 is a recipe for frustration. Starting small allowed me to build confidence and understanding.
2. Embrace Challenges Each error — whether a misconfigured module or a failed Sentinel policy — taught me something new. The key is persistence.
3. Learn Terraform Sentinel Early Sentinel might seem like an advanced topic, but incorporating it from the start ensures compliance isn’t an afterthought.
4. Take Breaks Debugging Terraform configurations for hours can be exhausting. Stepping away and revisiting problems with fresh eyes often led to breakthroughs.

Reflections

As I near the final week of this challenge, I’m proud of how far I’ve come. Terraform has shown me the power of Infrastructure as Code, and Azure has proven to be a versatile cloud platform. Combining the two has not only expanded my technical skillset but also deepened my understanding of DevOps principles.

To those considering a similar challenge: dive in. It’s not easy, but every hurdle is an opportunity to learn. And when you see your infrastructure come to life — automated, scalable, and compliant — it’s all worth it.

Have you tried Terraform Sentinel or built Azure infrastructure with Terraform? I’d love to hear your tips, challenges, and experiences!

Feel free to connect with me on LinkedIn to discuss more about DevOps, Terraform, and cloud infrastructure.