DevOps7 min read

Terraform

Declare cloud infrastructure as code with HCL - provision, change, and destroy AWS/GCP/Azure resources reproducibly and with version control.

TerraformInfrastructure as CodeAWSHCLDevOps

skill: Terraform category: DevOps tags: [Terraform, Infrastructure as Code, AWS, HCL, DevOps] readingTime: 7

Terraform is the standard IaC tool for multi-cloud environments. AWS CDK (TypeScript/Python) is a strong alternative if you're AWS-only and prefer programming languages over HCL. Pulumi is another code-first alternative. Ansible handles configuration management (software on existing servers) - Terraform handles infrastructure provisioning (the servers themselves).

Workflow

Write basic Terraform configurationHCL (HashiCorp Configuration Language) describes infrastructure resources declaratively - Terraform figures out what to create, change, or destroy.
Plan before applyingterraform plan shows exactly what Terraform will create, change, or destroy - always review before apply, especially in production.
Use variables and outputsVariables make configs reusable across environments; outputs expose resource attributes to other configs or CI pipelines.
Organize with modulesModules encapsulate reusable infrastructure components - a VPC module, an ECS module, a DB module - reducing duplication across environments.
Manage state safelyTerraform state tracks the real-world resources it manages. Corrupted or lost state = Terraform doesn't know what it owns. Remote state is essential for teams.

Output Format

Terraform project: providers, variables, modules, remote state, and CI/CD plan-and-apply.

infra/
├── main.tf         # Provider config, backend
├── variables.tf    # Input variables
├── outputs.tf      # Output values
├── versions.tf     # Version constraints
├── modules/
│   ├── vpc/
│   ├── ecs/
│   └── rds/
└── environments/
    ├── staging.tfvars
    └── prod.tfvars

Examples

Input

Output

Edge Cases & Gotchas

State lock contention - Two concurrent terraform applies deadlock on the DynamoDB state lock. Use Terraform Cloud or Atlantis for PR-based locking and serialized applies.
Sensitive values in state - Terraform state stores resource attributes in plaintext - including passwords and private keys. Use S3 SSE-KMS encryption for state buckets.
Provider version pinning - Unpinned provider versions break on major upgrades. Always pin: version = '~> 5.0' to allow patch updates but block major version changes.
Terraform drift - Manual console changes cause drift between state and reality. Run terraform plan regularly to detect drift. Enforce: no manual console changes in prod.

When to Break These Rules

Use AWS CDK instead of Terraform when your team is primarily TypeScript/Python developers and benefits from actual programming constructs (loops, conditionals, OOP) over HCL.
Use Pulumi for true multi-language IaC (Go, Java, Python, TypeScript) with real programming language capabilities instead of HCL's limited expressiveness.

Reference Files

https://developer.hashicorp.com/terraform/docs
https://registry.terraform.io/