We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design and AI Engineering, by Roni Das. 984 interactive lessons.
Start LearningIntermediate · Cloud Infrastructure
An open-source IaC tool by HashiCorp that provisions infrastructure across any cloud provider using declarative HCL configuration. Plan, apply, destroy.
In short
Terraform is an open-source infrastructure-as-code tool from HashiCorp that lets you define cloud and on-premise resources in declarative configuration files and create, change, or delete them with a predictable workflow. You write what you want the infrastructure to look like in HCL, Terraform compares that to the current real state, and it makes only the changes needed to match.
In short
Terraform is an open-source infrastructure-as-code tool from HashiCorp that lets you define cloud and on-premise resources in declarative configuration files and create, change, or delete them with a predictable workflow. You write what you want the infrastructure to look like in HCL, Terraform compares that to the current real state, and it makes only the changes needed to match.
Learn it in the course
This page is the free part.
₹1,111 in India$25 everywhere elseonce, for the whole course
The System Design course covers Terraform across a run of lessons, not one page. These 4 alone are about 81 minutes of step-by-step reading, every one with a quiz.
Defining servers, networks, databases, and cloud resources in declarative code files instead of clicking through consoles.
Define infrastructure in version-controlled code. Terraform, Pulumi, and reproducible environments.
Defining what your infrastructure should look like and letting systems converge toward it automatically.
Managing application and infrastructure configuration in version-controlled files instead of manual settings.
all part of
System Design Masterclass
770 lessons · about 287 hours · 18 free to read
₹1,111in India, by UPI
$25everywhere else, by PayPal
It is really nice and good Please join the course
You own this course
Continue with Infrastructure as Code (IaC)pay once,
yours for life
Terraform is a command-line tool that turns text files into running infrastructure. Instead of clicking through the AWS console to create a server, a database, and a load balancer, you describe them in a file and run one command. Terraform talks to the provider's API and builds everything for you.
The configuration language is called HCL (HashiCorp Configuration Language). It is declarative, which means you describe the end result you want, not the step-by-step instructions to get there. You say I want three EC2 instances and an S3 bucket, and Terraform figures out the order to create them and the dependencies between them.
Terraform is provider-agnostic. The same tool manages AWS, Google Cloud, Azure, Cloudflare, Datadog, GitHub, Kubernetes, and over 3,000 other services through plugins called providers. One workflow covers your whole stack, not just one vendor.
The core of Terraform is the state file, usually named terraform.tfstate. It is a JSON record of every resource Terraform created and the real-world IDs that map to your config. When you run terraform plan, it reads your config, reads the state, queries the live providers, and computes the difference. The output is an exact list of what it will add, change, or destroy before anything happens.
terraform apply executes that plan. Terraform builds a dependency graph so it knows that a subnet must exist before the instance that lives in it, and it parallelizes everything that has no dependency on each other. terraform destroy walks the graph in reverse to tear it all down.
Because the state file is the source of truth, teams almost never keep it on a laptop. They store it in a remote backend like an S3 bucket with DynamoDB locking, Terraform Cloud, or Google Cloud Storage. The lock stops two engineers from running apply at the same time and corrupting the state. Sensitive values like passwords end up in this file in plain text, so the backend must be encrypted and access-controlled.
Reach for Terraform when you provision infrastructure repeatedly, across environments, or as a team. Spinning up identical staging and production setups, version-controlling your network design, and reviewing infrastructure changes in a pull request are all things Terraform does well. The plan output alone, showing exactly what will change before it changes, prevents a lot of 2 AM mistakes.
The main trade-offs are state management and drift. The state file is fragile. If someone changes a resource by hand in the console, Terraform sees drift on the next plan and may try to undo it. Importing existing resources into state is tedious. And HCL is good at provisioning but weak at procedural logic, so complex loops and conditionals get awkward.
Terraform provisions infrastructure but does not configure what runs inside it. It will create a server, but installing and starting your application is a job for Ansible, cloud-init, or a container image. People often confuse Terraform with configuration management tools like Ansible or Chef. They solve different parts of the problem and are frequently used together. Note that since version 1.6 HashiCorp moved Terraform to the Business Source License, which prompted the community fork OpenTofu, a drop-in open-source replacement.
Suppose a startup runs the same web app in dev, staging, and production. Without Terraform, an engineer clicks through three sets of VPCs, subnets, security groups, RDS databases, and EC2 instances, and the three environments slowly drift apart. With Terraform, the whole stack lives in a few .tf files, and a variable switches the environment name and instance size.
To launch a fresh staging environment, the engineer runs terraform workspace select staging, then terraform plan to preview, then terraform apply. In a couple of minutes the entire environment exists and is byte-for-byte identical in shape to production. To save money overnight, terraform destroy removes it, and the same apply rebuilds it tomorrow.
Reusable pieces are packaged as modules. A team might publish a vpc module and a database module, then every project consumes them with a few lines, so a network change made once propagates everywhere it is used. This is how companies manage thousands of resources without losing track of any of them.
Amazon Web Services
The most common Terraform provider; teams provision VPCs, EC2, S3, RDS, and IAM declaratively instead of clicking the console.
Kubernetes
Terraform provisions managed clusters such as EKS, GKE, and AKS, and the Kubernetes provider can manage namespaces and deployments inside them.
Cloudflare
DNS records, page rules, WAF settings, and Workers are managed as code through the official Cloudflare Terraform provider.
HashiCorp
The creator of Terraform; HashiCorp Terraform Cloud and Terraform Enterprise host remote state, run plans on shared workers, and enforce policy.
Terraform provisions infrastructure (creates the servers, networks, and databases) and is declarative. Ansible configures what runs inside that infrastructure (installs packages, edits config files, starts services) and is procedural. They overlap a little but are usually used together: Terraform builds the box, Ansible sets it up.
It is the JSON record that maps your config to the real resources Terraform created. Terraform reads it on every plan to know what already exists. If you lose or corrupt it, Terraform forgets it owns your infrastructure. Always store it in a remote, encrypted, locked backend like S3 with DynamoDB, never just on a laptop or in Git.
As of version 1.6 in 2023, HashiCorp changed Terraform from the Mozilla Public License to the Business Source License, which restricts commercial competing use. In response the community created OpenTofu, a fully open-source fork under the Linux Foundation that is a drop-in replacement for most use cases.
It performs a dry run. Terraform reads your config and the current state, queries the live providers, and prints the exact set of resources it would add, change, or destroy, without touching anything. You review that output, then run terraform apply to make it real.
A module is a reusable, self-contained package of Terraform config, for example a standard VPC or database setup. You write it once and call it from many places with different inputs, which keeps configurations consistent and lets a single change propagate everywhere the module is used.
Infrastructure as Code
Managing servers, networks, and cloud resources through declarative configuration files instead of manual setup. Terraform, Pulumi, and CloudFormation are IaC tools.
Ansible
An agentless automation tool for configuration management, application deployment, and orchestration. Uses YAML playbooks and connects over SSH.
GitOps
Using Git as the single source of truth for infrastructure and application configuration. Changes are made via pull requests and automatically reconciled by tools like ArgoCD or Flux.
Virtual Machine
A software emulation of a physical computer running its own OS on shared hardware. Heavier than containers but provides stronger isolation.
Hypervisor
Software that creates and manages virtual machines by abstracting physical hardware. Type 1 (bare-metal) runs directly on hardware; Type 2 runs on an OS.
Cloud Region
A geographic area containing one or more data centers (availability zones). Choosing the right region reduces latency and satisfies data residency requirements.
This page explains the idea. The "Infrastructure as Code (IaC)" lesson builds it up step by step, with diagrams. It is part of the System Design Masterclass course, which has 770 lessons. 18 of them are free to read. You pay once and keep it for life, with no subscription.
Open the Infrastructure as Code (IaC) lessoncourse 1
From absolute beginner to principal engineer, drawn step by step.
Asked about Terraform in an interview?
Each question has why it is asked, a full answer, what the interviewer listens for, the follow-ups, the common mistakes and a diagram (268 diagrams in all). A PDF you keep, junior to staff level.
India: UPI, cards or netbanking through Razorpay. Elsewhere: card or PayPal. Download at once from My packs.
