Terraform

Terraform is an infrastructure-as-code tool for provisioning and managing infrastructure declaratively.

It enables consistent, versioned, repeatable infrastructure changes across providers.

Managing infrastructure through code definitions rather than manual console actions.

HCL (HashiCorp Configuration Language).

Plugin that translates Terraform resources into API calls for a platform/service.

A managed infrastructure object (VM, VPC, bucket, DNS record, etc.).

Read-only lookup of existing external information/resources.

Resource creates/manages objects; data source reads existing state.

Reusable collection of Terraform configurations.

Reduce duplication and standardize infrastructure patterns.

Top-level configuration in current working directory.

Module called by another module.

Input parameter for configurable module behavior.

Exposed value from a module for consumption elsewhere.

Named expression for reuse within module.

Initializes working directory, downloads providers/modules, configures backend.

Shows execution plan of proposed changes.

Executes approved plan to modify infrastructure.

Deletes managed infrastructure resources.

Terraform’s mapping of real resources to configuration metadata.

Terraform uses it to calculate diffs and track managed objects.

Team conflicts and no central locking/history.

Centralized state storage (S3, GCS, Terraform Cloud, etc.).

Collaboration, locking, durability, and governance.

Prevents concurrent conflicting operations on same state.

Avoids race conditions and state corruption.

Real infrastructure diverges from Terraform state/configuration.

Run plan/refresh workflows and compare expected vs actual resources.

Repeated applies converge infrastructure toward same declared state.

Directed graph determining resource creation/update/destroy order.

From attribute references between resources.

Manual dependency declaration when implicit reference is absent.

Dynamic value construction using references/functions.

Meta-argument to create multiple instances by numeric count.

Meta-argument creating instances from map/set keys (stable addressing).

for_each preferred for keyed identity stability.

Rules controlling create/destroy behavior (create_{beforedestroy}, prevent_destroy, ignore_changes).

Attempts replacement creation before deleting old resource.

Blocks accidental resource destruction unless explicitly changed.

Ignores selected attribute drift during diff/apply.

Can hide important drift and configuration issues.

Formats Terraform files consistently.

Checks configuration syntax/internal validity.

Displays output values from state.

Displays state or plan details in human-readable form.

Variable values file for environment-specific inputs.

Avoid accidental cross-environment parameter mixing.

Named state isolation within same configuration (with caveats).

Not a full substitute for strong environment isolation architecture.

Value flagged to reduce accidental display in CLI output.

Doesn’t encrypt secrets inside state automatically.

Putting many unrelated systems in one giant state.

Hardcoding secrets in .tf files.

Remote encrypted state + least-privilege credentials + secret manager integration.

Plan before apply and use locking-enabled backend.

Version control + pull request reviews for all IaC changes.

Keep modules focused and provider calls efficient.

Never apply unreviewed changes directly to production.

Use shared conventions for naming, tagging, and module structure.

Document rollback and break-glass procedures.

Managed platform for runs, state, policy, and team governance.

Infrastructure mistakes can have high blast radius/cost.

Replace resources instead of mutating in place where practical.

Validate/fmt/plan in CI for every change.

Start small, modular, and state-safe from day one.

Defining clear inputs/outputs and minimal assumptions.

Enables reuse without breaking downstream consumers.

Locking module versions to avoid unexpected behavior changes.

Controlled version range for provider plugin compatibility/stability.

Reproducible runs and safer upgrade management.

Declares provider sources and version requirements.

Constrains Terraform CLI versions for compatibility.

Keep sensitive/backend-specific values outside static code.

Reads outputs from another Terraform state snapshot.

Tight coupling between stacks and hidden dependencies.

Publish explicit outputs to registry/config systems where possible.

Bring existing unmanaged resource under Terraform state.

State entry created, but config still must match resource attributes.

Declaratively map old addresses to new addresses during refactors.

Safer refactoring without destructive recreation.

Mark resource for forced recreation (modern workflows often prefer -replace).

Explicitly force replacement of selected resource instance during apply.

Useful for recovery, but can bypass full graph intent if overused.

Update state to reflect real infra without proposing config changes.

Saved immutable execution plan for later controlled apply.

Ensures reviewed plan is exact plan executed.

Detect drift, classify intentional/unintentional, reconcile via code.

Ternary-style logic for dynamic values.

Construct complex collections/maps from iteration logic.

Programmatically generate nested blocks based on input collections.

Overuse can reduce readability/maintainability.

Often indicates unset/omitted semantics depending context/provider.

Custom input constraints with error messages.

Fail fast on invalid configuration input.

Assertions for resources/outputs to enforce assumptions (version dependent).

Non-blocking or configurable assertions for operational validation (version dependent).

Enforce governance/security/compliance rules on Terraform runs.

Mandatory tags, approved regions, restricted instance sizes, no public storage.

Forecast infra cost impact before apply.

Prevent budget surprises and improve design decisions.

Visual representation of resource dependency graph.

Controls concurrent operations during apply.

Faster applies vs API throttling/race sensitivity.

Cloud APIs may throttle; provider logic handles retries variably.

Contains infrastructure metadata and potentially sensitive values.

Encryption at rest, access control, audit logs, minimal exposure.

Environment selection through many conditionals in one module.

Separate root stacks/workspaces with explicit tfvars and pipelines.

Central consistency vs team autonomy and blast radius boundaries.

Group resources by lifecycle/ownership/blast-radius characteristics.

Different change cadence and risk profile.

Provision parallel environment and switch traffic.

Apply change to subset resources/accounts/regions first.

Track run duration, failure causes, drift frequency, apply success rates.

Automated plan checks + tested rollback/recovery paths.

Ephemeral credentials, least privilege, secret manager integration.

Mandatory policy checks and approval gates for production applies.

Teams can refactor modules/state safely without downtime surprises.

Treat Terraform failures as production incidents with RCA.

Prefer composition of small modules over giant universal modules.

Platform team curates modules; product teams consume with contracts.

Automate module testing, docs, and version publishing pipelines.

Keep immutable audit trail of plans/applies and approvals.

Tagging + budget alerts + lifecycle cleanup automation.

Design state/backends for failure and recovery, not convenience.

Incrementally import/adopt legacy resources with clear ownership transitions.

Promote reviewed plan artifacts across environments consistently.

Enforce linting, formatting, validation, and policy tests by default.

Rotate credentials and minimize long-lived cloud keys.

Optimize for safe repeatability over one-time provisioning speed.

Building standardized modules, pipelines, policy controls, and self-service workflows at scale.

Controlled distribution/versioning of approved modules.

Curated module implementing best-practice defaults and guardrails.

Excess abstraction can reduce flexibility and slow adoption.

Clear extension points and semantic versioning discipline.

Split state by domain/environment/ownership to reduce blast radius.

Faster plans, safer concurrency, clearer ownership boundaries.

Dependency ordering and change coordination without tight coupling.

Pipeline DAGs, explicit contracts, event-driven promotion.

Standardized baseline governance/network/security across many cloud accounts.

Manage multiple regions/accounts/providers in same configuration safely.

Scheduled plan/refresh analysis with automated triage classification.

Blind remediation can revert intentional emergency hotfixes.

Approval workflows and drift reason annotation.

Compromised providers/modules or tampered pipeline artifacts.

Provider checksums/signatures, trusted registries, pinned versions, artifact attestation.

Unauthorized modifications can hide or force destructive actions.

Strict backend IAM, versioning, lock enforcement, audit monitoring.

No implicit trust: strongly authenticated, short-lived, scoped runtime identities.

Securely obtaining initial auth for cloud/secret manager access.

OIDC/workload identity federation with minimal static credentials.

Org-level mandatory policies + team-level contextual policies.

Time-bound, approved, auditable waivers with renewal controls.

Provider API limits, run queueing, and cross-stack dependency contention.

State sharding, targeted pipelines, parallel plans, provider rate-limit tuning.

Pre-apply analysis estimating impacted resources/services.

Prioritize review rigor and rollout sequencing for risky changes.

Canary account/region rollout before global apply.

Back up state/backend metadata, module registry, and pipeline configs; rehearse restore.

Recovery assumptions fail without tested end-to-end drills.

Freeze applies, assess state integrity, execute controlled rollback/forward fix.

Backend/workspace/address changes without resource recreation.

moved blocks, state mv/rm/import with peer-reviewed runbooks.

Versioned code, plan artifacts, approvals, policy results, apply logs.

Different actors for code authoring, approval, and production execution.

Using Terraform to run imperative scripts as primary orchestration engine.

Use Terraform for declarative resource lifecycle; use config/orchestration tools for runtime config.

Provision cluster infrastructure with Terraform; deploy workloads via GitOps/Helm controllers.

Different cadence, ownership, and rollback mechanics.

Cost policy gates, tagging enforcement, and change-cost visibility in PRs.

Targets for successful plan/apply rates and recovery times.

Percent of applies causing incidents, rollbacks, or emergency fixes.

Every infrastructure change must be testable, reviewable, and recoverable.

Protect state, identity, and supply chain as critical control-plane assets.

Automate policy enforcement and track exceptions transparently.

Design modules/states for ownership clarity and minimal blast radius.

Operate Terraform platform with runbooks, SLOs, and incident drills.

Shared contracts between platform and product teams enable safe self-service.

Standardize interfaces, decentralize execution, centralize guardrails.

Treat cost impact as first-class output of every infrastructure change.

Ensure reproducible audit trails from intent to applied infrastructure.

Assume backend/provider failures and design graceful recovery paths.

Continuously test modules and policies like application software.

Prioritize high-value, low-risk automation sequencing.

Terraform excellence is secure, governed, and scalable infrastructure delivery as code.