application · iac · devops

Declare it once,Terraform.

HashiCorp's infrastructure as code tool — describe servers, networks, and databases in HCL and let one workflow provision them across AWS, Azure, GCP, and hundreds of providers. This guide covers the init/plan/apply loop, HCL configuration basics, remote state with locking, and reusable modules.

Core workflow HCL basics State management

Infrastructure from version control

Instead of clicking through cloud consoles, you declare the end state you want in .tf files — the same config reproduces an environment identically every time, with a full change history in git.

Workflow — init, plan, apply, destroy.
State — remote backends with locking for teams.
Modules — package infrastructure once, reuse everywhere.

HCLLanguage

terraform planDry run

HundredsProviders

OpenTofuOSS fork

Core workflow

The four-command loop — init downloads providers, plan previews the diff, apply executes it, destroy tears it down.

HCL configuration

Providers, resources, variables, outputs, and data sources — the building blocks of every .tf file.

State management

Remote backends with locking and encryption keep team applies safe and the state file out of git.

Reusable modules

Parameterized bundles of config from the Terraform Registry or your own modules/ directory keep environments DRY.

Start here

Overview

Terraform is HashiCorp’s open-source infrastructure as code (IaC) tool. Instead of clicking through cloud consoles, you declare the resources you want — servers, networks, DNS records, databases — in .tf configuration files, and Terraform provisions them to match. The same config reproduces an environment identically every time, and version control gives you a full history of infrastructure changes.

Terraform is provider-agnostic: one workflow drives AWS, Azure, GCP, Kubernetes, Cloudflare, and hundreds more via a plugin ecosystem.

This guide covers the core workflow, HCL basics, state management, and reusable modules.

Four commands

Workflow

Terraform’s day-to-day loop is four commands:

terraform init Downloads the providers and modules your config references and prepares the working directory. Run it once per project and again whenever providers or backends change.
Terminal window
```
terraform init
```
terraform plan A dry run. Terraform reads current state, compares it to your config, and prints exactly what it would add, change, or destroy — without touching anything.
Terminal window
```
terraform plan -out=tfplan
```
terraform apply Executes the plan against real providers. With a saved plan file it applies without re-prompting; otherwise it shows the diff and waits for yes.
Terminal window
```
terraform apply tfplan
```
terraform destroy Tears down everything the configuration manages. Useful for ephemeral environments and test stacks.
Terminal window
```
terraform destroy
```

HCL basics

Configuration

Terraform files are written in HCL (HashiCorp Configuration Language). A minimal AWS example:

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = var.region
}

variable "region" {
  type    = string
  default = "us-east-1"
}

resource "aws_instance" "web" {
  ami           = "ami-0abcdef1234567890"
  instance_type = "t3.micro"

  tags = {
    Name = "kbve-web"
  }
}

output "public_ip" {
  value = aws_instance.web.public_ip
}

Block	Purpose
`terraform`	Provider requirements and backend config
`provider`	Configure a target platform (region, credentials)
`resource`	A managed piece of infrastructure
`variable`	Parameterize a configuration
`output`	Export values after apply
`data`	Read existing resources you don’t manage

Source of truth

State

Terraform records what it manages in a state file (terraform.tfstate). State maps your config to real resource IDs so Terraform can detect drift and compute minimal changes.

For teams, never commit local state to git — store it remotely with locking so two applies can’t race:

terraform {
  backend "s3" {
    bucket         = "kbve-tfstate"
    key            = "prod/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "tf-locks"
    encrypt        = true
  }
}

Stay DRY

Modules

A module is a reusable bundle of Terraform config. Package infrastructure once, call it many times with different inputs:

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.0.0"

  name = "kbve-prod"
  cidr = "10.0.0.0/16"
}

The Terraform Registry hosts thousands of community and verified modules. Wrap your own patterns into local modules under a modules/ directory to keep environments DRY.

Ecosystem tools

Wrappers

References

What is Terraform used for?

Terraform is an infrastructure as code tool that provisions and manages cloud and on-prem resources through declarative configuration files. You describe the desired end state in HCL, and Terraform figures out the create, update, and destroy actions needed to reach it across providers like AWS, Azure, and GCP.

What is the difference between terraform plan and terraform apply?

terraform plan is a dry run that shows what changes Terraform would make without touching any infrastructure, so you can review adds, changes, and destroys. terraform apply executes those changes against real providers after an optional confirmation prompt.

What is Terraform state and why does it matter?

State is a JSON file that maps your configuration to the real resources Terraform manages, tracking metadata and dependencies. It lets Terraform detect drift and plan minimal changes. In teams, store it remotely (e.g. an S3 bucket with locking) so no two people apply at once against a shared, stale state.

What is a Terraform module?

A module is a reusable, parameterized package of Terraform configuration. The root module is your working directory; child modules are called with a module block and inputs. Modules let you package a VPC, cluster, or service once and reuse it across environments with different variables.

Is Terraform free?

Terraform CLI is open source and free. HashiCorp also offers HCP Terraform (formerly Terraform Cloud) with paid tiers for remote state, run pipelines, and policy. OpenTofu is a community-driven, MPL-licensed fork of Terraform maintained under the Linux Foundation.