Dependencies

mkdir terraform-lesson-21
cd terraform-lesson-21
touch versions.tf main.tf outputs.tf .gitignore

terraform {
  required_version = ">= 1.5.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

# ── NETWORKING LAYER ─────────────────────────────────────────────────────────

# VPC — no dependencies, created first
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true

  tags = { Name = "lesson21-vpc", ManagedBy = "Terraform" }
}

# Internet gateway — depends on VPC via vpc_id reference
# Terraform sees aws_vpc.main.id and creates the edge: VPC -> IGW
resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id  # Implicit dependency: aws_vpc.main must exist first

  tags = { Name = "lesson21-igw", ManagedBy = "Terraform" }
}

# Two subnets — each depends on VPC, but NOT on each other
# Terraform will create them in parallel after the VPC is ready
resource "aws_subnet" "public_a" {
  vpc_id            = aws_vpc.main.id  # Implicit dependency: aws_vpc.main
  cidr_block        = "10.0.1.0/24"
  availability_zone = "us-east-1a"
  map_public_ip_on_launch = true

  tags = { Name = "lesson21-subnet-a", ManagedBy = "Terraform" }
}

resource "aws_subnet" "public_b" {
  vpc_id            = aws_vpc.main.id  # Same dependency as public_a — but independent of it
  cidr_block        = "10.0.2.0/24"
  availability_zone = "us-east-1b"
  map_public_ip_on_launch = true

  tags = { Name = "lesson21-subnet-b", ManagedBy = "Terraform" }
}

# Security group — depends on VPC
resource "aws_security_group" "web" {
  name   = "lesson21-web-sg"
  vpc_id = aws_vpc.main.id  # Implicit dependency: aws_vpc.main

  ingress {
    description = "HTTP"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    description = "All outbound"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = { Name = "lesson21-web-sg", ManagedBy = "Terraform" }
}

# ── IAM LAYER ────────────────────────────────────────────────────────────────

# IAM role — no dependencies on networking, can be created in parallel with VPC
resource "aws_iam_role" "web_instance" {
  name = "lesson21-web-instance-role"

  # Trust policy — allows EC2 to assume this role
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "ec2.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })

  tags = { Name = "lesson21-web-role", ManagedBy = "Terraform" }
}

# Instance profile — wraps the IAM role so EC2 can use it
# Depends on the role via iam_role reference
resource "aws_iam_instance_profile" "web" {
  name = "lesson21-web-profile"
  role = aws_iam_role.web_instance.name  # Implicit dependency: aws_iam_role.web_instance
}

# ── COMPUTE LAYER ────────────────────────────────────────────────────────────

# EC2 instance — depends on subnet, security group, and instance profile
# Depends on internet gateway via depends_on — explicit dependency needed
resource "aws_instance" "web" {
  ami                    = "ami-0c55b159cbfafe1f0"  # Amazon Linux 2 — us-east-1
  instance_type          = "t2.micro"
  subnet_id              = aws_subnet.public_a.id          # Implicit: aws_subnet.public_a
  vpc_security_group_ids = [aws_security_group.web.id]     # Implicit: aws_security_group.web
  iam_instance_profile   = aws_iam_instance_profile.web.name  # Implicit: aws_iam_instance_profile.web

  # Explicit dependency — the instance needs internet access at launch
  # It references no attribute of the internet gateway, so Terraform cannot
  # infer this dependency automatically
  depends_on = [aws_internet_gateway.main]

  tags = { Name = "lesson21-web", ManagedBy = "Terraform" }

  lifecycle {
    create_before_destroy = true
    ignore_changes        = [ami]
  }
}

# Route table — depends on VPC and internet gateway
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id  # Implicit dependency: aws_vpc.main

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id  # Implicit dependency: aws_internet_gateway.main
  }

  tags = { Name = "lesson21-rt-public", ManagedBy = "Terraform" }
}

# Route table association — connects the route table to both public subnets
resource "aws_route_table_association" "public_a" {
  subnet_id      = aws_subnet.public_a.id      # Implicit: aws_subnet.public_a
  route_table_id = aws_route_table.public.id   # Implicit: aws_route_table.public
}

resource "aws_route_table_association" "public_b" {
  subnet_id      = aws_subnet.public_b.id      # Implicit: aws_subnet.public_b
  route_table_id = aws_route_table.public.id   # Implicit: aws_route_table.public
}

# Lambda function that needs the VPC security group but does not reference its ID
# It uses depends_on because the security group must exist before the Lambda
# can be attached to the VPC — but Lambda config references group by name, not ID
resource "aws_lambda_function" "processor" {
  filename      = "processor.zip"
  function_name = "lesson21-processor"
  role          = aws_iam_role.web_instance.arn  # Implicit: aws_iam_role.web_instance
  handler       = "index.handler"
  runtime       = "nodejs18.x"

  vpc_config {
    subnet_ids         = [aws_subnet.public_a.id]    # Implicit: aws_subnet.public_a
    security_group_ids = [aws_security_group.web.id] # Implicit: aws_security_group.web
  }

  # Even though security group ID is referenced above, the VPC itself must
  # be fully configured with routing before Lambda can reach the internet
  # This explicit dependency ensures routing is in place before Lambda is created
  depends_on = [
    aws_route_table_association.public_a,  # Route table must be associated first
    aws_route_table_association.public_b
  ]
}

# Generate the full dependency graph in DOT format
terraform graph

# Generate the graph for planned changes only
terraform graph -type=plan

# Render to an image using Graphviz (requires graphviz installed)
terraform graph | dot -Tpng -o dependency-graph.png

# Or use the online viewer — paste DOT output at dreampuf.github.io/GraphvizOnline
terraform graph | pbcopy   # macOS: copies to clipboard

# ── CYCLE EXAMPLE — What NOT to do ───────────────────────────────────────────

# This creates a dependency cycle — do not use this pattern
# resource "aws_security_group" "bad_example" {
#   name   = "cycle-example"
#   vpc_id = aws_vpc.main.id
#
#   ingress {
#     from_port       = 0
#     to_port         = 0
#     protocol        = "-1"
#     security_groups = [aws_security_group.bad_example.id]  # References ITSELF
#     # Terraform cannot create this: needs the SG ID to create the SG
#   }
# }
# Error: Cycle: aws_security_group.bad_example -> aws_security_group.bad_example

# ── CORRECT PATTERN — Break the cycle with aws_security_group_rule ───────────

# Create the security group WITHOUT the self-referencing rule
resource "aws_security_group" "cluster" {
  name        = "lesson21-cluster-sg"
  description = "Security group for cluster nodes"
  vpc_id      = aws_vpc.main.id  # Implicit dependency on VPC

  egress {
    description = "All outbound"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = { Name = "lesson21-cluster-sg", ManagedBy = "Terraform" }
}

# Add the self-referencing rule AFTER the security group exists
# aws_security_group_rule depends on the SG being created first
# so there is no cycle — the SG exists, then the rule references it
resource "aws_security_group_rule" "cluster_self_ingress" {
  type              = "ingress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  security_group_id = aws_security_group.cluster.id  # Implicit: cluster SG exists first

  # self = true allows traffic from any resource that also uses this security group
  # This is the cluster communication pattern — nodes can talk to each other
  self = true

  description = "Allow all traffic within the cluster security group"
}