Terraform Overview

Terraform is an Infrastructure as Code (IaC) platform used to provision and manage infrastructure through declarative configuration. Instead of manually creating cloud resources, networks, virtual machines, Kubernetes clusters, databases, and DNS records, Terraform describes the desired state in HCL and reconciles infrastructure to match it. Terraform enables repeatable deployments, version control, peer review, automation, and consistent environments.

Terraform Architecture

Terraform consists of configuration files, providers, a state file, modules, and remote backends. Providers communicate with cloud APIs while state tracks managed infrastructure. Production environments should use remote state, locking, version control, and automated CI/CD pipelines.

Developer → Git → CI/CD → terraform init → terraform plan → approval → terraform apply
                     │
               Remote Backend (S3/Azure/GCS/Terraform Cloud)

Installation

terraform version
terraform init
terraform validate
terraform fmt -recursive

HCL Basics

terraform {
  required_version = ">= 1.8"
}

provider "aws" {
  region = var.region
}

resource "aws_s3_bucket" "logs" {
  bucket = "company-logs-prod"
}

Providers

Providers connect Terraform to platforms such as AWS, Azure, Google Cloud, Kubernetes, VMware, GitHub and many more. Pin provider versions to avoid unexpected behavior.

Resources

Resources are the infrastructure objects Terraform creates and manages.

resource "aws_instance" "web" {
  ami = var.ami
  instance_type = "t3.medium"
}

Variables and Outputs

variable "region" {
 type = string
}
output "instance_ip" {
 value = aws_instance.web.public_ip
}

State

The state file maps Terraform configuration to real infrastructure. Never edit state manually unless performing a controlled recovery. Protect it because it may contain sensitive information.

terraform state list
terraform state show aws_instance.web

Remote Backends

Use remote backends with state locking in production.

terraform {
 backend "s3" {
  bucket = "terraform-state"
  key = "prod/network.tfstate"
  region = "eu-central-1"
 }
}

Modules

Modules package reusable infrastructure. Create separate modules for networking, Kubernetes, IAM, databases, monitoring, and shared services.

module "network" {
 source = "./modules/network"
 cidr = "10.0.0.0/16"
}

Workspaces

Workspaces separate environments but should not replace good repository structure in large enterprises.

Lifecycle

lifecycle {
 prevent_destroy = true
 create_before_destroy = true
}

Provisioners

Provisioners exist but should generally be avoided. Prefer cloud-init, configuration management, or Kubernetes manifests after infrastructure provisioning.

CI/CD

Run terraform fmt, validate and plan in pull requests. Require human approval before apply. Store state remotely and protect credentials with a secrets manager.

Security Best Practices

• Use least privilege IAM.
• Protect state files.
• Use remote backends with locking.
• Pin provider versions.
• Store secrets outside Terraform code.
• Review plans before apply.

Performance

Split very large infrastructures into logical stacks and reusable modules. Avoid a single massive state file.

Troubleshooting

terraform validate
terraform plan
terraform graph
terraform providers
terraform refresh
terraform state list

Essential Commands

terraform init
terraform plan
terraform apply
terraform destroy
terraform fmt
terraform validate
terraform output
terraform import
terraform taint
terraform state list
terraform workspace list

Key Takeaways

Terraform enables repeatable infrastructure provisioning using declarative code. Success in production depends on remote state, modules, secure pipelines, version control, peer review, state protection, and disciplined change management.