I'll provide you with a comprehensive Terraform AWS tutorial for 2025, covering modern best practices and the latest features.

Prerequisites

• Terraform 1.7+ (latest version)


• AWS CLI configured with credentials


• Basic AWS knowledge

1. Setup and Installation

Install Terraform

# On macOS
brew tap hashicorp/tap
brew install hashicorp/tap/terraform
# On Windows (Chocolatey)
choco install terraform
# On Linux
wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt update && sudo apt install terraform

Configure AWS CLI

aws configure
# Enter your AWS Access Key, Secret Key, region (us-east-1), and output format (json)

2. Project Structure

Create the following directory structure:

terraform-aws-project/
├── main.tf
├── variables.tf
├── outputs.tf
├── terraform.tfvars
└── providers.tf

3. Basic Configuration

providers.tf

terraform {
  required_version = ">= 1.7.0"
  
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
  # Optional: Remote State Backend (S3 recommended)
  backend "s3" {
    bucket = "my-terraform-state-2025"
    key    = "terraform.tfstate"
    region = "us-east-1"
    # For state locking
    dynamodb_table = "terraform-state-locking"
  }
}
provider "aws" {
  region = var.aws_region
  
  default_tags {
    tags = {
      Environment = var.environment
      Project     = "terraform-tutorial-2025"
      ManagedBy   = "terraform"
    }
  }
}

variables.tf

variable "aws_region" {
  description = "AWS region"
  type        = string
  default     = "us-east-1"
}
variable "environment" {
  description = "Deployment environment"
  type        = string
  default     = "dev"
  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Environment must be dev, staging, or prod."
  }
}
variable "vpc_cidr" {
  description = "CIDR block for VPC"
  type        = string
  default     = "10.0.0.0/16"
}
variable "instance_type" {
  description = "EC2 instance type"
  type        = string
  default     = "t3.micro"
}
variable "enable_monitoring" {
  description = "Enable CloudWatch monitoring"
  type        = bool
  default     = true
}

4. Core Infrastructure

main.tf

VPC Module (using community module for best practices)

name = "main-vpc-${var.environment}"
cidr = var.vpc_cidr

azs = ["us-east-1a", "us-east-1b"]
private_subnets = ["10.0.1.0/24", "10.0.2.0/24"]
public_subnets = ["10.0.101.0/24", "10.0.102.0/24"]

enablenatgateway = true
enablevpngateway = false
singlenatgateway = var.environment == "dev" ? true : false

tags = {
Environment = var.environment
Terraform = "true"
}
}

Security Group

ingress {
description = "HTTP"
from_port = 80
to_port = 80
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}

ingress {
description = "HTTPS"
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}

ingress {
description = "SSH"
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}

egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}

tags = {
Name = "web-sg-${var.environment}"
}
}

EC2 Instance with latest Amazon Linux 2023

filter {
name = "name"
values = ["al2023-ami-2023.*-x86_64"]
}

filter {
name = "virtualization-type"
values = ["hvm"]
}
}

IAM Role for EC2

assumerolepolicy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Action = "sts:AssumeRole"
Effect = "Allow"
Principal = {
Service = "ec2.amazonaws.com"
}
}
]
})
}

resource "awsiamrolepolicyattachment" "ssmmanagedinstance" {
role = awsiamrole.ec2_role.name
policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

resource "awsiaminstanceprofile" "ec2profile" {
name = "ec2-profile-${var.environment}"
role = awsiamrole.ec2_role.name
}

EC2 Instance

user_data = base64encode(<<-EOF
#!/bin/bash
dnf update -y
dnf install -y nginx
systemctl start nginx
systemctl enable nginx
echo "

Hello from Terraform AWS 2025!

metadata_options {
http_endpoint = "enabled"
http_tokens = "required"
}

monitoring = var.enable_monitoring

tags = {
Name = "web-server-${var.environment}"
}

lifecycle {
createbeforedestroy = true
ignore_changes = [ami]
}
}

Application Load Balancer

enabledeletionprotection = var.environment == "prod" ? true : false

tags = {
Environment = var.environment
}
}

resource "awslbtargetgroup" "webtg" {
name = "web-tg-${var.environment}"
port = 80
protocol = "HTTP"
vpcid = module.vpc.vpcid

health_check {
enabled = true
interval = 30
path = "/"
port = "traffic-port"
protocol = "HTTP"
timeout = 5
healthy_threshold = 2
unhealthy_threshold = 2
}
}

resource "awslbtargetgroupattachment" "webtgattachment" {
targetgrouparn = awslbtargetgroup.webtg.arn
targetid = awsinstance.web_server.id