What Is Terraform and How It Works
SkillVeris Team
Cloud & Security Team
Terraform is an infrastructure-as-code tool that lets you define servers, networks, and cloud services in declarative configuration files and provision them with a single apply.
In this guide, you'll learn:
- You describe the desired end state; Terraform figures out what to create, change, or destroy to reach it.
- The state file records what Terraform manages, letting it detect drift and plan only the changes that are actually needed.
- terraform plan shows exactly what will change before anything happens, so applies are predictable and reviewable.
- Providers are plugins that let one workflow manage AWS, Azure, Google Cloud, Kubernetes, and hundreds of other platforms.
1What Is Terraform?
Terraform is an open-source infrastructure-as-code tool that lets you define cloud and on-premises resources in human-readable configuration files, then create and manage them automatically. Instead of clicking through a cloud console, you write what you want and Terraform builds it.
It is declarative: you describe the desired end state — three servers, a load balancer, a database — and Terraform works out the sequence of API calls needed to reach that state. Run it again and it changes only what has drifted, leaving everything else untouched.
2Why Infrastructure as Code
Managing infrastructure by hand does not scale. Clicks are not repeatable, undocumented, and easy to get subtly wrong. Infrastructure as code fixes this by treating your environment like source code.
- Repeatable: the same config produces the same environment every time, in every region.
- Reviewable: infrastructure changes go through pull requests just like application code.
- Versioned: Git history shows who changed what and when, and you can roll back.
- Documented: the configuration is the documentation — there is no separate wiki to fall out of date.
🔑Core Benefit
With Terraform, your infrastructure lives in Git. That means code review, history, and reproducibility for servers and networks, not just applications.
3How Terraform Works
Terraform follows a simple, repeatable loop. Understanding these three commands is most of what daily use requires.
- terraform init # download providers and set up the working directory
- terraform plan # preview the changes Terraform will make
- terraform apply # execute the plan and provision resources
- terraform destroy # tear down everything the config manages
The Plan and Apply Cycle
terraform plan compares your configuration against the recorded state and the real world, then prints a diff of what will be added, changed, or destroyed. Nothing happens until you run apply and approve it, which is what makes Terraform safe to run against production.
4Writing Configuration in HCL
Terraform configurations are written in HashiCorp Configuration Language (HCL), a readable declarative syntax built around blocks. A resource block describes one piece of infrastructure to create.
- provider "aws" { region = "us-east-1" } # which platform and settings
- resource "aws_instance" "web" { # a resource to create
- ami = "ami-0abc123"
- instance_type = "t3.micro"
- tags = { Name = "web-server" }
- }
💡Use Variables
Extract values that change between environments into variables (variable "region" {}) so one configuration serves dev, staging, and production without edits.
5The State File
Terraform keeps a state file that maps your configuration to the real resources it created. This is how it knows an aws_instance named web already exists and does not need to be recreated.
State is critical. If two people run apply at once with local state, they can corrupt it, so teams store state remotely — in an S3 bucket, Terraform Cloud, or an equivalent backend — with locking so only one apply runs at a time. Remote state also keeps sensitive values out of individual laptops.
Drift Detection
Because state records what Terraform believes exists, terraform plan can detect drift — when someone changed a resource manually in the console. Terraform will offer to bring reality back in line with your configuration.
6Providers and Modules
Two concepts make Terraform scale beyond a single file: providers and modules.
- Providers are plugins for a platform — AWS, Azure, Google Cloud, Kubernetes, Cloudflare, Datadog and hundreds more — each exposing resources you can declare.
- Modules are reusable bundles of configuration — a 'vpc' module or a 'web-service' module — that you call with different inputs.
- The public Terraform Registry hosts community modules and provider documentation.
- Modules keep configurations DRY: define a pattern once, reuse it across teams and environments.
Multi-Cloud in One Workflow
Because providers share the same plan-and-apply workflow, a single Terraform project can provision an AWS network, a Cloudflare DNS record, and a Datadog monitor together — one language for the whole stack.
7Best Practices
A handful of habits keep Terraform projects safe and maintainable as they grow.
- Use remote state with locking so concurrent applies cannot corrupt state.
- Never commit secrets or the state file to Git — state can contain sensitive values in plaintext.
- Always review terraform plan output before approving an apply, especially anything marked for destruction.
- Break large configurations into modules and separate environments into their own state.
- Pin provider versions in a required_providers block for reproducible builds.
8Common Mistakes to Avoid
Most Terraform incidents trace back to a few recurring errors rather than the tool.
- Editing resources by hand in the cloud console, causing drift Terraform then wants to undo.
- Storing state locally on one machine, so teammates overwrite each other's work.
- Committing terraform.tfstate to a public repo and leaking credentials.
- Running apply without reading the plan and accidentally destroying a database.
⚠️Read the Plan
A plan that shows '1 to destroy' next to a stateful resource like a database is a red flag. Always confirm what destruction means before approving an apply.
9Key Takeaways
The essentials of Terraform come down to a few durable principles.
- Terraform provisions infrastructure from declarative configuration files instead of manual clicks.
- You describe the desired end state; Terraform plans and applies the changes to reach it.
- The state file lets Terraform track resources, detect drift, and plan minimal changes.
- Providers extend Terraform to hundreds of platforms; modules make configurations reusable.
- Use remote state with locking, keep secrets out of Git, and always review the plan.
10Frequently Asked Questions
Q: Is Terraform only for AWS? A: No. Terraform is cloud-agnostic. Providers let it manage AWS, Azure, Google Cloud, Kubernetes, DNS services, monitoring tools, and hundreds of other platforms using the same workflow, and one project can span several at once.
Q: What is the difference between Terraform and Ansible? A: Terraform focuses on provisioning infrastructure — creating servers, networks, and cloud services declaratively. Ansible focuses on configuration management — installing software and configuring existing machines. Many teams use them together.
Q: Why is the Terraform state file so important? A: State maps your configuration to real resources, letting Terraform detect drift and plan only necessary changes. Because it can hold sensitive data and must not be corrupted, teams store it remotely with locking rather than on a laptop.
Q: What does terraform plan do? A: It previews changes without making them, printing a diff of what will be added, changed, or destroyed. Nothing is applied until you run apply and approve, which is what makes Terraform safe to run against live infrastructure.
Related Reading
Get The Print Version
Download a PDF of this article for offline reading.
About the Publisher
SkillVeris Team
Cloud & Security Team
Our cloud and security experts break down complex infrastructure topics into practical, beginner-friendly guides.
View all postsRelated Posts
Never miss an update
Get the latest tutorials and guides delivered to your inbox.
No spam. Unsubscribe anytime.