DevOps
Terraform
Terraform is an infrastructure as code tool: you describe cloud resources in configuration and it creates and changes them.
What it is
Terraform by HashiCorp lets you describe infrastructure (servers, networks, databases, DNS) in the declarative language HCL and manage it through providers for AWS, Azure, Google Cloud, Cloudflare and hundreds of other services.
The workflow: terraform plan shows what will change, terraform apply applies it. The current state is kept in a state file, usually moved to remote storage with locking. Configuration is split into modules for reuse.
About the license. In 2023 HashiCorp moved from MPL-2.0 to the Business Source License 1.1, which led to the OpenTofu fork under the Linux Foundation. In 2025 HashiCorp became part of IBM.
Use it when
- Infrastructure must be reproducible and versioned in Git.
- You manage several environments and clouds the same way.
- You need to review changes (plan) before applying.
- You automate provisioning through CI.
Avoid it when
- You need a fully open source license: consider OpenTofu.
- The task is configuring software inside servers rather than creating resources: use Ansible.
- One or two resources that are easier to create by hand.
Key concepts
- Provider
- A plugin that talks to a specific platform API (aws, google, cloudflare).
- State
- A file mapping configuration to real resources; it is protected and stored remotely.
- Plan / apply
- First show the changes, then execute them, so consequences are visible in advance.
- Module
- A reusable set of resources with input variables and outputs.
- Drift
- A mismatch between configured state and real infrastructure after manual changes.
Example
Cheat sheet
| Command or code | What it does |
|---|---|
terraform init | Download providers and initialize the directory |
terraform fmt | Format configuration files |
terraform validate | Validate configuration syntax |
terraform plan | Show what will change |
terraform apply | Apply the changes |
terraform destroy | Destroy all managed infrastructure |
terraform output | Show output values |
terraform state list | Resources tracked in state |
terraform import aws_s3_bucket.b my-bucket | Bring an existing resource under management |
terraform plan -out=tfplan && terraform apply tfplan | Apply exactly the plan you reviewed |
How to learn it
- Understand infrastructure as code: you describe the desired state and Terraform brings the cloud to it.
- Install Terraform and create a first resource through a provider (for example Docker or a local file) with no cloud.
- Learn the
init,plan,apply,destroycycle and read the plan before applying it. - Master variables, outputs, locals and
datablocks, and split config into files. - Understand state: why you must not lose or commit it, and move it to a remote backend with locking.
- Extract repeated code into modules and use a ready made module from the registry.
- Build real cloud infrastructure (VPC, server, database) in a separate test account.
- Run
planin CI on pull requests and manage environments with workspaces or separate state.
Interview questions
1. What is state and why does it matter?
State links resources in the configuration to real objects in the cloud. Without it Terraform does not know what is already created. It is stored in a remote backend with locking because it can hold secrets.
2. What does terraform plan do?
It compares configuration with state and reality and shows what will be created, changed or destroyed, without making changes. You can review consequences before apply.
3. How does Terraform differ from Ansible?
Terraform declaratively creates and changes infrastructure resources and keeps state. Ansible mostly configures software on servers with procedural playbooks and no state.
4. What changed with the Terraform license?
In 2023 HashiCorp moved from MPL-2.0 to BSL 1.1, which restricts competing commercial use. The community created the OpenTofu fork under MPL-2.0 at the Linux Foundation.
Interview questions from the bank
- At two in the morning an engineer fixed a security group by hand in the AWS console to bring prod back. The next morning a colleague ran
terraform applyfor a different change, the fix was silently reverted and the incident repeated. Why did that happen, and how do you prevent it?MiddleDevOps - How do you organize dev, staging and prod, where do config and secrets live, and what do you do when a key was committed to the repo?MiddleDevOps
- By what paths do secrets leak from a service, and is it enough to delete
.envfrom the repo in the next commit?MiddleWeb security
Comparisons with this technology
Related technologies
- OpenTofuOpenTofu is an open source fork of Terraform under MPL-2.0, developed under the Linux Foundation.
- AnsibleAnsible is an agentless automation tool: YAML playbooks configure servers and deploy software over SSH.
- AWSThe largest cloud platform, with hundreds of services from virtual machines and storage to databases, queues and ML.
- KubernetesKubernetes is a container orchestration system that deploys, scales and heals applications across a cluster of servers.
- GitHub ActionsGitHub Actions is CI/CD built into GitHub: YAML workflows run on repository events such as push or pull request.
Logos belong to their owners and are used for identification only. Icons: Simple Icons (CC0), Devicon (MIT).