Yeah the key is to break it down into smaller components. Figure out what steps are needed, then focus on one at a time. Ideally each step should work stand alone with test data that you can feed it.
A real world example I'm working on right now is automating Letsencrypt wildcard cert renewal using acme.sh which is an alternative to Certbot. There is not much info online on how to do this as they all assume you're using a 3rd party DNS provider and tell you to use an API or tell you to use Certbot. The documentation says that it must be manually done and can't be automated. Challenge accepted.
So I broke it down in steps.
1: Get the validation key from Let's Encrypt using acme.sh
2: Put that key in a TXT DNS record
3: Run the 2nd part of the validation process, where Letsencrypt looks for that key in my DNS record and validates, and then generates the cert.
#1 can be broken down in further steps. 1A: Run the appropriate acme.sh command. The key ends up in the log file in addition to being displayed on screen. Normally you're suppose to just manually copy and paste it and update DNS manually. Once I have that log file, #1B is to extract it which involves parsing it out from the log file. I made this a separate script so it's easier to work out of and can call it stand alone, easier to test that way too. Let's Encrypt or acme.sh is not even involved in this step throughout code/testing phase.
#2 then involves setting up DNS to be dynamic which was a separate step I only had to do once. I then wrote a script so I can update the record using a single line. The way that script work is irrelevant to everything else going on, as long as it works stand alone.
#3 involves running the 2nd part of the validation process, which is just an acme.sh command again.
So once I put it all together, the auto renew script runs the acme.sh command to get the validation key, runs the script I made to extract the key from the log, runs the DNS updater script and passes the key to the script, then runs the 2nd part of validation process.