Terraform on AWS Free Tier: Complete Guide to Free Infrastructure (2026)

mkdir terraform-aws-free-tier && cd terraform-aws-free-tier

terraform {
  required_version = ">= 1.9"
 
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}
 
provider "aws" {
  region = var.aws_region
 
  default_tags {
    tags = {
      Project     = "terraform-free-tier"
      Environment = "learning"
      ManagedBy   = "terraform"
    }
  }
}

variable "aws_region" {
  description = "AWS region for resources"
  type        = string
  default     = "us-east-1"  # Most free tier resources available here
}
 
variable "project_name" {
  description = "Project name prefix for resource naming"
  type        = string
  default     = "free-tier-lab"
}

# Get the latest Amazon Linux 2023 AMI
data "aws_ami" "amazon_linux" {
  most_recent = true
  owners      = ["amazon"]
 
  filter {
    name   = "name"
    values = ["al2023-ami-*-x86_64"]
  }
 
  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }
}
 
# Security group allowing SSH
resource "aws_security_group" "web" {
  name_prefix = "${var.project_name}-web-"
  description = "Allow SSH and HTTP"
 
  ingress {
    description = "SSH"
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]  # Restrict to your IP in production
  }
 
  ingress {
    description = "HTTP"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
 
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
 
  tags = {
    Name = "${var.project_name}-web-sg"
  }
}
 
# EC2 instance — t2.micro is free tier eligible
resource "aws_instance" "web" {
  ami                    = data.aws_ami.amazon_linux.id
  instance_type          = "t2.micro"  # FREE TIER: 750 hours/month
  vpc_security_group_ids = [aws_security_group.web.id]
 
  root_block_device {
    volume_size = 8    # FREE TIER: up to 30 GB EBS
    volume_type = "gp3"
    encrypted   = true
  }
 
  user_data = <<-EOF
    #!/bin/bash
    yum update -y
    yum install -y httpd
    systemctl start httpd
    systemctl enable httpd
    echo "<h1>Hello from Terraform on AWS Free Tier!</h1>" > /var/www/html/index.html
  EOF
 
  tags = {
    Name = "${var.project_name}-web-server"
  }
}

resource "aws_s3_bucket" "data" {
  bucket_prefix = "${var.project_name}-data-"
 
  tags = {
    Name = "${var.project_name}-data"
  }
}
 
resource "aws_s3_bucket_versioning" "data" {
  bucket = aws_s3_bucket.data.id
  versioning_configuration {
    status = "Enabled"
  }
}
 
resource "aws_s3_bucket_server_side_encryption_configuration" "data" {
  bucket = aws_s3_bucket.data.id
 
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"  # Free — no KMS charges
    }
  }
}
 
# Block all public access (security best practice)
resource "aws_s3_bucket_public_access_block" "data" {
  bucket = aws_s3_bucket.data.id
 
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_dynamodb_table" "app" {
  name         = "${var.project_name}-sessions"
  billing_mode = "PROVISIONED"
 
  # FREE TIER: 25 RCU + 25 WCU
  read_capacity  = 5
  write_capacity = 5
 
  hash_key  = "session_id"
  range_key = "timestamp"
 
  attribute {
    name = "session_id"
    type = "S"
  }
 
  attribute {
    name = "timestamp"
    type = "N"
  }
 
  ttl {
    attribute_name = "expires_at"
    enabled        = true
  }
 
  tags = {
    Name = "${var.project_name}-sessions"
  }
}

data "archive_file" "lambda" {
  type        = "zip"
  output_path = "${path.module}/lambda.zip"
 
  source {
    content  = <<-EOF
      exports.handler = async (event) => {
        return {
          statusCode: 200,
          headers: { "Content-Type": "application/json" },
          body: JSON.stringify({
            message: "Hello from Terraform + Lambda!",
            timestamp: new Date().toISOString(),
            event: event
          })
        };
      };
    EOF
    filename = "index.js"
  }
}
 
resource "aws_iam_role" "lambda" {
  name_prefix = "${var.project_name}-lambda-"
 
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = {
        Service = "lambda.amazonaws.com"
      }
    }]
  })
}
 
resource "aws_iam_role_policy_attachment" "lambda_basic" {
  role       = aws_iam_role.lambda.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}
 
resource "aws_lambda_function" "api" {
  filename         = data.archive_file.lambda.output_path
  source_code_hash = data.archive_file.lambda.output_base64sha256
  function_name    = "${var.project_name}-api"
  role             = aws_iam_role.lambda.arn
  handler          = "index.handler"
  runtime          = "nodejs20.x"
  memory_size      = 128   # Minimum — saves free tier quota
  timeout          = 10
 
  tags = {
    Name = "${var.project_name}-api"
  }
}
 
# Function URL (free alternative to API Gateway)
resource "aws_lambda_function_url" "api" {
  function_name      = aws_lambda_function.api.function_name
  authorization_type = "NONE"
}

resource "aws_db_instance" "postgres" {
  identifier_prefix = "${var.project_name}-"
 
  engine         = "postgres"
  engine_version = "16.4"
  instance_class = "db.t3.micro"  # FREE TIER: 750 hours/month
 
  allocated_storage     = 20   # FREE TIER: up to 20 GB
  max_allocated_storage = 20   # Prevent auto-scaling beyond free tier
  storage_type          = "gp2"
  storage_encrypted     = true
 
  db_name  = "appdb"
  username = "dbadmin"
  password = var.db_password  # Use terraform.tfvars or env var
 
  skip_final_snapshot = true  # OK for learning environments
  publicly_accessible = false
 
  backup_retention_period = 0  # Disable backups (saves storage costs)
 
  tags = {
    Name = "${var.project_name}-postgres"
  }
}
 
variable "db_password" {
  description = "Database master password"
  type        = string
  sensitive   = true
  default     = "ChangeMe123!"  # Override with TF_VAR_db_password env var
}

output "ec2_public_ip" {
  description = "EC2 instance public IP"
  value       = aws_instance.web.public_ip
}
 
output "s3_bucket_name" {
  description = "S3 bucket name"
  value       = aws_s3_bucket.data.id
}
 
output "dynamodb_table_name" {
  description = "DynamoDB table name"
  value       = aws_dynamodb_table.app.name
}
 
output "lambda_url" {
  description = "Lambda function URL"
  value       = aws_lambda_function_url.api.function_url
}
 
output "rds_endpoint" {
  description = "RDS endpoint"
  value       = aws_db_instance.postgres.endpoint
}
 
output "estimated_monthly_cost" {
  description = "Estimated cost"
  value       = "$0.00 (within AWS Free Tier limits)"
}

# Initialize Terraform
terraform init
 
# Preview what will be created
terraform plan
 
# Deploy (type 'yes' when prompted)
terraform apply
 
# Test the Lambda function
curl $(terraform output -raw lambda_url)

resource "aws_budgets_budget" "free_tier" {
  name         = "free-tier-alert"
  budget_type  = "COST"
  limit_amount = "1"
  limit_unit   = "USD"
  time_unit    = "MONTHLY"
 
  notification {
    comparison_operator       = "GREATER_THAN"
    threshold                 = 80
    threshold_type            = "PERCENTAGE"
    notification_type         = "ACTUAL"
    subscriber_email_addresses = ["your-email@example.com"]
  }
}

terraform destroy

terraform destroy -auto-approve