Cloud Environment: OpenTofu

This document is part of the OpenTofu workshop and describes environment-cloud as training material, reference documentation and review basis.

Target State

You should not operate OpenTofu as just a plan/apply sequence. Treat it as an infrastructure-as-code system: configuration describes desired state, providers translate it into API calls, state maps real objects to resource instances and backends enable collaboration. The critical questions are reproducibility, state security, provider pinning, reviewability and controlled change.

Focus

Cloud-Accounts
OIDC
Remote State
Provider Credentials
Policy Gates

Core Terms

Term	Meaning
`OpenTofu`	Open source infrastructure-as-code tool for safely and predictably managing infrastructure.
`Configuration`	Collection of OpenTofu files describing which infrastructure should be managed.
`Root Module`	Top-level module of a working directory from which `tofu plan` and `tofu apply` start.
`Provider`	Plugin that connects OpenTofu to a remote system such as cloud, DNS, Kubernetes or SaaS.
`Resource`	Declaration of a managed infrastructure object with type, name and arguments.
`Data Source`	Read access to information from a provider or built-in source.
`Variable`	Input value of a module with type, default, validation and optional sensitive flag.
`Output`	Module output visible externally or consumed by automation.
`Local Value`	Named expression inside a module to reduce repetition and complex expressions.
`State`	Persisted mapping between resource instances in configuration and real objects.
`Backend`	Storage location and access model for state, optionally with locking for collaboration.
`Plan`	Preview of changes OpenTofu derives from configuration, state and provider information.
`Apply`	Execution of a plan or currently calculated change against real infrastructure.
`Module`	Reusable collection of OpenTofu configurations with clear inputs and outputs.
`Meta-Argument`	OpenTofu-owned control such as `count`, `for_each`, `depends_on`, `provider` or `lifecycle`.
`TACOS`	TF Automation and Collaboration Software for remote execution, state, policies and collaboration.

Working Model

Describe desired state in a clearly bounded root module.
Pin OpenTofu and provider versions for the project.
Check variables, locals, modules, outputs and meta-arguments before planning.
Prove changes with tofu fmt, tofu validate, tofu plan, plan artifacts and review diffs.
Assess state, backend, locking, credentials and sensitive outputs before every apply.
Document recovery: Git revert, state backup, import, state mv, secret rotation or provider correction.

Reference Commands

# Check project
tofu version
tofu fmt -check -recursive
tofu init -backend=false
tofu validate

# Plan and inspect changes
tofu plan -out=tfplan
tofu show tfplan
tofu show -json tfplan

# Inspect state and outputs
tofu state list
tofu output
tofu output -json

# Use tests and targeted operations only in labs
tofu test
tofu import <address> <id>
tofu state mv <old> <new>

Typical Decisions

Decision	Useful Question	Risk of the Wrong Choice
Root module boundary	Which infrastructure should be planned and applied together?	excessive blast radius or hidden dependencies
Backend	Who needs state access and which locking is required?	concurrent applies, state loss, secret leak
Provider version	Which API and provider version is approved?	unexpected plan diffs or breaking changes
Module	Is reuse more important than direct readability?	unclear inputs, output coupling, difficult debugging
Workspaces	Do they really separate environments or only state names?	mixing dev, staging and prod
Sensitive values	Are secrets only masked or also stored safely?	false confidence, state still contains sensitive data

Operations Notes

State is security-sensitive and can contain sensitive values.
Backends store state; some support locking while others do not.
Direct state file editing is discouraged by OpenTofu documentation; use CLI operations.
Saved plans can contain backend configuration; time-limited credentials may expire between plan and apply.
TACOS can provide remote execution, state, policy and collaboration but does not replace clean module boundaries.

Scope Boundary

This document covers OpenTofu core features and IaC operations. Cloud-specific resources are shown only as patterns and are not executed against real accounts.

Practice Appendix: Cloud Environment

This appendix provides a backlog for longer trainings, reviews and repetition. Each task is small enough to verify with local HCL artifacts and a Git repository.

A001. Cloud-Accounts

Task: document configuration and desired state and explicitly relate the observation to Cloud-Accounts.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A002. OIDC

Task: check provider requirement and explicitly relate the observation to OIDC.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A003. Remote State

Task: explain state impact and explicitly relate the observation to Remote State.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A004. Provider Credentials

Task: assess plan diff and explicitly relate the observation to Provider Credentials.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A005. Policy Gates

Task: describe backend and locking model and explicitly relate the observation to Policy Gates.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A006. OpenTofu

Task: check module boundary and explicitly relate the observation to OpenTofu.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A007. Configuration

Task: assess variable and output and explicitly relate the observation to Configuration.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A008. Root Module

Task: prove drift and explicitly relate the observation to Root Module.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A009. Provider

Task: mark secret risk and explicitly relate the observation to Provider.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A010. Resource

Task: name policy or CI gate and explicitly relate the observation to Resource.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A011. Data Source

Task: write down rollback or recovery path and explicitly relate the observation to Data Source.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A012. Variable

Task: state a team rule and explicitly relate the observation to Variable.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A013. Output

Task: document configuration and desired state and explicitly relate the observation to Output.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A014. Local Value

Task: check provider requirement and explicitly relate the observation to Local Value.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A015. State

Task: explain state impact and explicitly relate the observation to State.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A016. Backend

Task: assess plan diff and explicitly relate the observation to Backend.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A017. Plan

Task: describe backend and locking model and explicitly relate the observation to Plan.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A018. Apply

Task: check module boundary and explicitly relate the observation to Apply.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A019. Module

Task: assess variable and output and explicitly relate the observation to Module.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A020. Meta-Argument

Task: prove drift and explicitly relate the observation to Meta-Argument.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A021. TACOS

Task: mark secret risk and explicitly relate the observation to TACOS.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A022. Cloud-Accounts

Task: name policy or CI gate and explicitly relate the observation to Cloud-Accounts.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A023. OIDC

Task: write down rollback or recovery path and explicitly relate the observation to OIDC.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A024. Remote State

Task: state a team rule and explicitly relate the observation to Remote State.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A025. Provider Credentials

Task: document configuration and desired state and explicitly relate the observation to Provider Credentials.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A026. Policy Gates

Task: check provider requirement and explicitly relate the observation to Policy Gates.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A027. OpenTofu

Task: explain state impact and explicitly relate the observation to OpenTofu.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A028. Configuration

Task: assess plan diff and explicitly relate the observation to Configuration.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A029. Root Module

Task: describe backend and locking model and explicitly relate the observation to Root Module.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A030. Provider

Task: check module boundary and explicitly relate the observation to Provider.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A031. Resource

Task: assess variable and output and explicitly relate the observation to Resource.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A032. Data Source

Task: prove drift and explicitly relate the observation to Data Source.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A033. Variable

Task: mark secret risk and explicitly relate the observation to Variable.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A034. Output

Task: name policy or CI gate and explicitly relate the observation to Output.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A035. Local Value

Task: write down rollback or recovery path and explicitly relate the observation to Local Value.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A036. State

Task: state a team rule and explicitly relate the observation to State.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A037. Backend

Task: document configuration and desired state and explicitly relate the observation to Backend.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A038. Plan

Task: check provider requirement and explicitly relate the observation to Plan.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A039. Apply

Task: explain state impact and explicitly relate the observation to Apply.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A040. Module

Task: assess plan diff and explicitly relate the observation to Module.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A041. Meta-Argument

Task: describe backend and locking model and explicitly relate the observation to Meta-Argument.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A042. TACOS

Task: check module boundary and explicitly relate the observation to TACOS.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A043. Cloud-Accounts

Task: assess variable and output and explicitly relate the observation to Cloud-Accounts.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A044. OIDC

Task: prove drift and explicitly relate the observation to OIDC.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A045. Remote State

Task: mark secret risk and explicitly relate the observation to Remote State.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A046. Provider Credentials

Task: name policy or CI gate and explicitly relate the observation to Provider Credentials.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A047. Policy Gates

Task: write down rollback or recovery path and explicitly relate the observation to Policy Gates.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A048. OpenTofu

Task: state a team rule and explicitly relate the observation to OpenTofu.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A049. Configuration

Task: document configuration and desired state and explicitly relate the observation to Configuration.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A050. Root Module

Task: check provider requirement and explicitly relate the observation to Root Module.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A051. Provider

Task: explain state impact and explicitly relate the observation to Provider.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A052. Resource

Task: assess plan diff and explicitly relate the observation to Resource.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A053. Data Source

Task: describe backend and locking model and explicitly relate the observation to Data Source.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A054. Variable

Task: check module boundary and explicitly relate the observation to Variable.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A055. Output

Task: assess variable and output and explicitly relate the observation to Output.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A056. Local Value

Task: prove drift and explicitly relate the observation to Local Value.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A057. State

Task: mark secret risk and explicitly relate the observation to State.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A058. Backend

Task: name policy or CI gate and explicitly relate the observation to Backend.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A059. Plan

Task: write down rollback or recovery path and explicitly relate the observation to Plan.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A060. Apply

Task: state a team rule and explicitly relate the observation to Apply.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A061. Module

Task: document configuration and desired state and explicitly relate the observation to Module.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A062. Meta-Argument

Task: check provider requirement and explicitly relate the observation to Meta-Argument.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A063. TACOS

Task: explain state impact and explicitly relate the observation to TACOS.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A064. Cloud-Accounts

Task: assess plan diff and explicitly relate the observation to Cloud-Accounts.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A065. OIDC

Task: describe backend and locking model and explicitly relate the observation to OIDC.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A066. Remote State

Task: check module boundary and explicitly relate the observation to Remote State.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A067. Provider Credentials

Task: assess variable and output and explicitly relate the observation to Provider Credentials.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A068. Policy Gates

Task: prove drift and explicitly relate the observation to Policy Gates.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A069. OpenTofu

Task: mark secret risk and explicitly relate the observation to OpenTofu.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A070. Configuration

Task: name policy or CI gate and explicitly relate the observation to Configuration.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A071. Root Module

Task: write down rollback or recovery path and explicitly relate the observation to Root Module.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A072. Provider

Task: state a team rule and explicitly relate the observation to Provider.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A073. Resource

Task: document configuration and desired state and explicitly relate the observation to Resource.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A074. Data Source

Task: check provider requirement and explicitly relate the observation to Data Source.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A075. Variable

Task: explain state impact and explicitly relate the observation to Variable.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A076. Output

Task: assess plan diff and explicitly relate the observation to Output.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A077. Local Value

Task: describe backend and locking model and explicitly relate the observation to Local Value.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A078. State

Task: check module boundary and explicitly relate the observation to State.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A079. Backend

Task: assess variable and output and explicitly relate the observation to Backend.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A080. Plan

Task: prove drift and explicitly relate the observation to Plan.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A081. Apply

Task: mark secret risk and explicitly relate the observation to Apply.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A082. Module

Task: name policy or CI gate and explicitly relate the observation to Module.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A083. Meta-Argument

Task: write down rollback or recovery path and explicitly relate the observation to Meta-Argument.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A084. TACOS

Task: state a team rule and explicitly relate the observation to TACOS.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A085. Cloud-Accounts

Task: document configuration and desired state and explicitly relate the observation to Cloud-Accounts.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A086. OIDC

Task: check provider requirement and explicitly relate the observation to OIDC.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A087. Remote State

Task: explain state impact and explicitly relate the observation to Remote State.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

A088. Provider Credentials

Task: assess plan diff and explicitly relate the observation to Provider Credentials.
Evidence: Write down at least one OpenTofu-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging, prod and CI?
Security question: Which credentials, state values, provider versions or outputs would be critical?
Recovery: Explain whether revert, state operation, import, backend restore, secret rotation or manual provider correction is required.

Official Sources and Scope

The material is aligned with public OpenTofu documentation. Cloud providers, TACOS platforms, policy engines and secret tools are mentioned only where they explain common OpenTofu workflows. Example artifacts are not instructions to execute against production cloud accounts.

OpenTofu: https://opentofu.org/
OpenTofu Language Documentation: https://opentofu.org/docs/language/
Provider Requirements: https://opentofu.org/docs/language/providers/requirements/
State: https://opentofu.org/docs/language/state/
Backend Configuration: https://opentofu.org/docs/language/settings/backends/configuration/
OpenTofu v1.x Compatibility Promises: https://opentofu.org/docs/language/v1-compatibility-promises/
OpenTofu at CNCF: https://www.cncf.io/projects/opentofu/
Linux Foundation: Getting Started with OpenTofu: https://training.linuxfoundation.org/express-learning/getting-started-with-opentofu-lfel1009/
Linux Foundation Certification Catalog: https://training.linuxfoundation.org/certification-catalog/

Additional Review Drills

Use these drills when the primary task is complete and the learner needs another pass over operational reasoning. They are intentionally evidence-oriented and can be answered with local OpenTofu artifacts.

Drill 01: root module

State which module, provider, backend or state boundary is affected by root module.
Name one command or HCL field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared IaC platform.

Drill 02: provider version

State which module, provider, backend or state boundary is affected by provider version.
Name one command or HCL field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared IaC platform.

Drill 03: state snapshot

State which module, provider, backend or state boundary is affected by state snapshot.
Name one command or HCL field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared IaC platform.

Drill 04: backend locking

State which module, provider, backend or state boundary is affected by backend locking.
Name one command or HCL field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared IaC platform.

Drill 05: plan diff

State which module, provider, backend or state boundary is affected by plan diff.
Name one command or HCL field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared IaC platform.

Drill 06: module output

State which module, provider, backend or state boundary is affected by module output.
Name one command or HCL field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared IaC platform.

Drill 07: sensitive value

State which module, provider, backend or state boundary is affected by sensitive value.
Name one command or HCL field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared IaC platform.

Drill 08: policy gate

State which module, provider, backend or state boundary is affected by policy gate.
Name one command or HCL field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared IaC platform.

Drill 09: import

State which module, provider, backend or state boundary is affected by import.
Name one command or HCL field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared IaC platform.

Drill 10: moved block

State which module, provider, backend or state boundary is affected by moved block.
Name one command or HCL field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared IaC platform.

Drill 11: TACOS run

State which module, provider, backend or state boundary is affected by TACOS run.
Name one command or HCL field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared IaC platform.

Drill 12: recovery

State which module, provider, backend or state boundary is affected by recovery.
Name one command or HCL field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared IaC platform.

Drill 13: root module

State which module, provider, backend or state boundary is affected by root module.
Name one command or HCL field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared IaC platform.

Drill 14: provider version

State which module, provider, backend or state boundary is affected by provider version.
Name one command or HCL field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared IaC platform.

Drill 15: state snapshot

State which module, provider, backend or state boundary is affected by state snapshot.
Name one command or HCL field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared IaC platform.

Drill 16: backend locking

State which module, provider, backend or state boundary is affected by backend locking.
Name one command or HCL field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared IaC platform.