Terraform Overview (Infrastructure)

Before you start: basic cloud concepts (what a virtual machine or a network is, conceptually) and command-line comfort are assumed. No prior Infrastructure-as-Code experience is needed.

Terraform in the Infrastructure Context

Infrastructure as Code (IaC) means describing servers, networks, and other infrastructure in a text file instead of creating them by hand through a cloud provider's web console — the file becomes the record of what should exist, and re-running it reproduces (or corrects) that exact setup. Terraform is the de facto standard tool for this in DevOps and cloud engineering. It enables teams to define, provision (actually create the described infrastructure), and version infrastructure the same way developers version application code — enabling repeatable, auditable, and consistent environments, instead of undocumented manual changes that are hard to reproduce or review.

Why Terraform Over Alternatives

vs CloudFormation (AWS only):
  Terraform: multi-cloud, 1000+ providers, cleaner HCL syntax
  CloudFormation: AWS-native, no state file management needed, native AWS integration
  
vs Ansible:
  Terraform: declarative (define end state), better for provisioning
  Ansible: imperative (define steps), better for configuration management
  Best practice: Terraform to provision, Ansible to configure
  
vs Pulumi:
  Terraform: HCL domain-specific language, larger community
  Pulumi: use general-purpose languages (Python, TypeScript, Go)
  Choose Pulumi if: team prefers code, complex logic needed in IaC

vs CDK (Cloud Development Kit):
  CDK (AWS): generates CloudFormation; TypeScript/Python/Java/Go
  CDK for Terraform (CDKTF): generates Terraform; use general-purpose languages

Core Workflow

bash

# Project structure (recommended)
my-infrastructure/
├── main.tf           # main resources
├── variables.tf      # input variables
├── outputs.tf        # output values
├── providers.tf      # provider configuration
├── terraform.tfvars  # variable values (not in Git if has secrets)
├── versions.tf       # required versions
└── modules/          # reusable modules
    └── vpc/
        ├── main.tf
        ├── variables.tf
        └── outputs.tf

# Workflow
terraform init        # download providers, configure backend
terraform plan        # show what will change
terraform apply       # make the changes
terraform destroy     # destroy all resources

# State operations
terraform state list                    # list all managed resources
terraform state show aws_s3_bucket.main # inspect a resource
terraform state mv old_name new_name    # rename resource in state
terraform import aws_s3_bucket.main mybucket  # import existing resource
terraform state rm aws_instance.old     # remove from state (NOT from cloud)

Remote State and Collaboration

hcl

# terraform/providers.tf
terraform {
  required_version = ">= 1.6.0"
  
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
  
  # Remote state — REQUIRED for teams
  backend "s3" {
    bucket         = "my-company-terraform-state"
    key            = "prod/us-east-1/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "terraform-state-lock"  # prevents concurrent applies
    encrypt        = true
  }
}

provider "aws" {
  region = var.aws_region
  
  default_tags {  # apply to all resources
    tags = {
      ManagedBy   = "Terraform"
      Environment = var.environment
      Repository  = "github.com/company/infrastructure"
    }
  }
}

Security Best Practices

SECRETS IN TERRAFORM:
  Never: hardcode secrets in .tf files
  Use: environment variables (TF_VAR_db_password)
  Use: AWS Secrets Manager / Azure Key Vault data sources
  Use: HashiCorp Vault provider
  Use: .tfvars files marked in .gitignore

STATE FILE SECURITY:
  Contains sensitive values (passwords, keys may be in outputs)
  Encrypt backend: enable S3 encryption, use KMS key
  Control access: only CI/CD pipeline and senior engineers
  Audit: CloudTrail logs all S3 state file access

IAM FOR TERRAFORM:
  CI/CD: use OIDC federation (GitHub Actions → AWS, no static keys)
  Local: use IAM roles with SSO / short-lived credentials
  Never: use root account for Terraform

Study Resources

•Terraform: Up and Running (Yevgeniy Brikman) — best book, covers real patterns

•HashiCorp Learn (developer.hashicorp.com/terraform/tutorials) — free official tutorials

•Terraform Associate (003) — entry-level certification; practical exam

•Gruntwork IaC Library — production-grade Terraform modules, patterns guide free online

•awesome-terraform (github.com/shuaibiyy/awesome-terraform) — curated resource list

Terraform — Overview