Exercise 1: What Ansible Adds to a Terraform-Only Pipeline — Possible Solution
====================================================================

Explanation:

Terraform's own job, by design, stops the moment a server exists --
it can create a VM, attach a disk, open a firewall port, but per the
chapter's own explicit statement, it "has no concept of 'log in and
install a package.'" Once Terraform's apply finishes successfully,
the team has a running server, but that server is otherwise empty --
no application installed, no configuration files in place, no
services running, nothing hardened. Everything that has to happen
AFTER the machine exists -- installing the actual application and its
dependencies, writing out config files, starting and enabling
services, applying security hardening -- is structurally outside what
Terraform was ever built to do, no matter how the Terraform
configuration itself is written.

Ansible is exactly the tool built for that remaining half of the job.
It connects to the newly created server over SSH and runs the actual
configuration steps -- installing packages, templating config files,
restarting services -- turning a bare, freshly provisioned machine
into one that's actually doing useful work. Added to a Terraform-only
pipeline, Ansible would take over immediately after Terraform's own
apply step finishes, completing the setup Terraform was never
designed to perform in the first place.

WHY THIS WORKS AS AN ANSWER
------------------------------
This explains the gap by directly quoting the chapter's own stated
boundary on what Terraform can do ("no concept of... install a
package"), then describes concretely what remains undone after
Terraform finishes and how Ansible fills exactly that gap.