Lab 3: partial-import recovery, forward-looking commit note, state-lock aside

[abdie-grcengineer]

Documentation fixes for Lab 3 (labs/03-foundation), all found while running the lab end to end on a fresh free subscription. Two core fixes, one optional polish, plus one open question for you.

1. Step 2 — partial/missing imports surface as whack-a-mole (core)

If any of the four terraform import commands doesn't land (an interrupted run, a skipped line), a later terraform apply fails with ... already exists - to be managed via Terraform this resource needs to be imported into the State — but only for the independent resources first, and the dependents (mg-grc-sandbox needs mg-grc; the workspace needs the RG) after those are fixed. So you fix two, re-apply, and get two more. It reads like the lab is broken.

Fix: added a note after the import block telling students to run terraform state list up front and re-import everything still missing in one pass, instead of reacting to errors one wave at a time.

2. Verify section — "Committed and pushed" contradicts the steps (core)

## Verify, 4th item:
- [ ] Committed and pushed — from here on: changes go through the repo, never the portal

Following Steps 1–4 exactly (bootstrap.sh, import the four existing resources, terraform apply, deny test), nothing edits a tracked file. The stage Terraform ships in the starter — you apply it, you don't write it — and backend.hcl + the evidence JSON are gitignored. So git status is clean and there is literally nothing to commit. A student following the instructions cannot truthfully check that box.

Fix: reworded the item as a forward-looking workflow principle, and noted that committable work actually begins in Lab 4.

3. Step 2 — stuck Acquiring state lock… (optional polish)

An interrupted run leaves a lease on the state blob, and the next plan/apply hangs on Acquiring state lock forever. Added a short aside: take the lock ID from the error and terraform force-unlock <ID>, or break the blob lease. Drop this hunk if you consider it too generic-Terraform for the lab.

Open question — Step 4 "Save the error JSON" (no change made)

Step 4 says: "Read the full error ... Save the error JSON — it's a preventive-control evidence artifact." But az doesn't return clean JSON on a policy deny — it prints a text error with an embedded Policy identifiers: [...] array. So "save the error JSON" doesn't map to a real command as written, and I didn't want to guess your intent with a file change.

Which did you mean? (a) save the raw error text (... 2> lab3-deny-evidence.txt), (b) extract just the policy-identifiers JSON, or (c) pull the structured denial record from somewhere else (e.g., the Activity Log)? Whichever it is, the step should include the exact command — happy to add it once you confirm.

Scope

• One file changed: labs/03-foundation/README.md.
• No script or command behavior changed — documentation only.

🤖 Generated with Claude Code

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 7d411664-5c15-4740-86fb-dd2aac95eac4

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}