First Terraform on AWS
VPC + EC2.
Overview
The first Terraform deploy on AWS moves IaC from theory to practice. Five primitives cover the foundation: VPC plus EC2 boilerplate, workspaces for environments, remote state for the team, modules for reuse, and CI for drift.
- VPC plus EC2 boilerplate. First Terraform with the AWS provider. Networking and a worker node are the standard starting point.
- Per-environment workspaces. dev, staging, prod workspaces. Same code, different state.
- Remote state with locking. S3 backend plus DynamoDB lock table. Required as soon as more than one engineer touches the repo.
- Modules plus CI integration. Modules capture reusable patterns;
terraform planin CI on every PR catches drift before merge.
The approach
Three habits keep the first Terraform deploy from rotting into a one-off: workspaces for environments, remote state for the team, and modules for reuse from day one.
- Per-environment workspaces. Separate state per environment. dev, staging, and prod do not share a workspace.
- Remote state with locking. S3 plus DynamoDB locks. Two engineers running
applysimultaneously stays safe. - Modules for reuse. Per-pattern modules with documented inputs and outputs. Subsequent services compose modules instead of copy-pasting.
- CI plan on PRs.
terraform planruns on every pull request. Reviewers see what is about to change before approving.
Why this compounds
The first deploy takes effort to wire correctly. Each subsequent service reuses the modules and the patterns; the team gets faster and the audit trail improves with every deploy.
- Release safety. Terraform plan catches drift before it ships. Surprises during apply become rare.
- Team scalability. Modules and workspaces let multiple engineers work concurrently without state conflicts.
- Audit trail. Version-controlled IaC satisfies SOC2 and compliance review without per-change forensics.
- Year-one investment, year-two habit. The first deploy is heavy lift. By the third service, the team composes modules reflexively.