What is Terraform?
Updated: 3 days ago
Terraform is HashiCorp's Infrastructure as Code tool for defining, creating and changing infrastructure through version-controlled configuration files. It communicates with cloud platforms and other services through providers, compares the desired configuration with existing managed resources and produces a plan before making changes. Terraform is not a cloud provider, container runtime or automatic guarantee of safe deployments.
Teams use Terraform for cloud networking, virtual machines, databases, DNS, access policies and other resources. It can manage both cloud and on-premises infrastructure where a compatible provider exists. Terraform's source-available licensing differs from traditional open-source licensing for recent releases, so the precise edition and version matter.
This visual overview shows Terraform's configuration, planning and apply workflow, followed by the key operational concepts.
How does Terraform work?
Terraform uses providers to call APIs exposed by AWS, Azure, Google Cloud and many other platforms. A configuration declares resource types and properties, while Terraform determines dependencies and proposes changes to bring managed infrastructure towards that configuration.
Write configuration in Terraform's HCL language.
Run terraform init to initialise the working directory, providers and backend.
Run terraform fmt and terraform validate to check formatting and configuration.
Run terraform plan to inspect proposed resource additions, changes and deletions.
Approve and run terraform apply, ideally applying a reviewed saved plan.
Verify resources, monitor services and update configuration through version control.
Terraform may execute independent operations concurrently. A successful apply does not prove the application or its security controls are correct.
Terraform configuration and HCL
HashiCorp Configuration Language (HCL) is Terraform's primary configuration syntax. A resource block specifies a resource type, local name and arguments. Variables parameterise configurations, outputs expose selected values, and modules group reusable configurations.
A provider configuration tells Terraform which API integration to use. Credentials should be supplied securely through supported authentication methods, not embedded in committed configuration files.
What do terraform init, plan and apply do?
terraform init installs required providers and modules and initialises the configured backend. terraform validate checks configuration syntax and internal consistency, but it does not prove cloud permissions or proposed changes are safe.
terraform plan creates an execution plan showing intended changes. terraform apply performs the planned operations. Saved plans are particularly useful when a reviewed plan must be applied later without silently substituting a different set of changes.
What is Terraform state?
Terraform state maps configuration resource instances to actual infrastructure objects and stores metadata and attributes. Without the mapping, Terraform cannot reliably know which remote object a declared resource represents.
Local state is suitable for basic experimentation, but teams normally need protected shared state storage. State can contain sensitive values, so restrict access and use encryption and backups. Backend locking, where supported, helps prevent concurrent writers from corrupting state.
What is infrastructure drift?
Drift occurs when real infrastructure differs from the configuration or recorded state, such as when someone manually changes a firewall rule in a cloud console. A normal plan typically refreshes managed resource information before comparing it with configuration, although options and provider behaviour can affect what is observed.
Terraform may propose reversing manual changes, replacing resources or changing dependent objects. Review the plan rather than assuming drift correction is always harmless.
Providers, resources, data sources and modules
Providers integrate Terraform with platform APIs. Resources describe objects Terraform manages. Data sources read information about existing objects without necessarily managing their lifecycle. Modules package related configuration into reusable units.
Provider and module versions should be constrained and reviewed. The dependency lock file helps keep provider selections consistent across machines; it is not a substitute for security updates or testing.
Terraform vs Infrastructure as Code
Infrastructure as Code is the general practice of managing infrastructure through code. Terraform is one implementation. Alternatives and complementary tools include AWS CloudFormation, Azure Bicep, Pulumi and configuration management systems such as Ansible.
Terraform focuses on declarative resource management through providers and state. Ansible often performs ordered configuration tasks. Kubernetes continuously orchestrates workloads within a cluster. These tools can work together but solve different problems.
Terraform vs Docker and Kubernetes
Docker commonly builds and runs container images. Kubernetes orchestrates Pods and services. Terraform can provision the virtual machines, networking, managed cluster or other infrastructure supporting those workloads.
Terraform does not replace Kubernetes' ongoing workload controllers. Likewise, a Kubernetes cluster does not automatically provision all external cloud resources without additional integrations.
Using Terraform in a home lab
A home lab can use Terraform with supported virtualisation, DNS, container or infrastructure APIs. This allows repeatable creation of virtual machines, test networks and other resources without manually recreating every setting.
A local Terraform run does not require the public internet for every operation, but provider downloads, remote state and cloud APIs may need connectivity. Do not expose management interfaces directly to the internet simply to make remote provisioning easier.
Terraform and UK broadband
Terraform configuration files are generally small, so faster broadband alone rarely makes terraform plan substantially faster. Remote API latency, provider rate limits, number of resources and backend response times may matter more.
Large virtual machine images, container layers, backups and software artefacts are separate transfers. These can be constrained by upload speed, download speed, storage performance and remote service limits, particularly when managing a home lab over a UK broadband connection.
Techie Broadband calculation: configuration versus image transfer
Consider a hypothetical 2 GB decimal virtual machine image. Two gigabytes equals 16 gigabits. Uploading the full image at a sustained 20 Mbps would take at least 800 seconds, or 13 minutes 20 seconds; at 100 Mbps it would take 160 seconds, and at 1 Gbps it would take 16 seconds.
These are theoretical minima without protocol overhead or other bottlenecks. A Terraform configuration referencing an image already hosted by a cloud provider does not itself upload that image, so it would be misleading to equate every terraform apply with a multi-gigabyte transfer.
Terraform security and cost risks
Treat plans and state files as potentially sensitive.
Use least-privilege API credentials and separate production permissions.
Review additions, replacements and deletions before applying.
Pin and assess providers and modules from trusted sources.
Enable backend locking where available and maintain state backups.
Use cost estimation and policy checks where appropriate.
Avoid storing passwords or private keys directly in code.
Test recovery from failed or partial applies.
Terraform can provision insecure or expensive resources just as consistently as secure ones. A green plan or successful apply does not imply security compliance or cost control.
Common Terraform errors and troubleshooting
Initialisation fails: inspect backend access, provider registry connectivity and version constraints.
Validation fails: check HCL syntax, required arguments and provider schemas.
Authentication fails: confirm credentials, roles and account selection.
Plan proposes unexpected destruction: inspect drift, resource addresses, state and configuration changes.
State is locked: identify the legitimate writer before considering any unlock.
Apply fails partway: inspect completed resources and updated state before planning again.
Resources exist but applications fail: test networking, DNS, firewall rules, service health and dependencies.
Never force-unlock a state that another process is legitimately using. Avoid editing state files by hand or deleting resources blindly to make an error disappear.
Terraform licensing and OpenTofu
HashiCorp changed the licensing of newer Terraform releases from the earlier Mozilla Public License approach to the Business Source License. This means describing every current Terraform version simply as open source is inaccurate. OpenTofu is a separate open-source fork with its own governance and compatibility considerations.
Always check the actual licence, release and provider compatibility relevant to your environment before choosing a tool for commercial or embedded use.
Terraform FAQs
Is Terraform free to use?
Terraform Community Edition can be used without paying a subscription for many ordinary infrastructure management workflows, subject to its applicable licence terms. Managed services, enterprise features and third-party cloud resources may involve charges. A free Terraform executable does not make the infrastructure it creates free.
Does Terraform need an internet connection?
Not for every local operation. A locally installed provider can interact with an accessible on-premises API without public internet access. However, initial provider and module downloads, remote state services and cloud provider APIs generally require appropriate network connectivity. The requirements depend on the configured backend, providers and resources.
Is Terraform the same as Ansible?
No. Terraform primarily manages the desired state of infrastructure resources through providers and state. Ansible is commonly used for configuration management and task automation. A team might provision a server with Terraform and then configure software on it using Ansible. Their capabilities overlap, but they are not interchangeable.
Does Terraform automatically roll back a failed deployment?
No. Terraform can fail after creating or modifying some resources, and an apply is not generally an atomic transaction across every provider API. Recovery requires checking the actual resources, Terraform state and error output, then creating a safe new plan. Some providers offer their own rollback capabilities, but Terraform should not be assumed to reverse all changes automatically.
Can Terraform manage Kubernetes?
Yes, Terraform can provision Kubernetes clusters using cloud providers and can manage certain Kubernetes resources using suitable providers. Kubernetes itself remains responsible for scheduling and reconciling running workloads. Terraform is usually better suited to infrastructure lifecycle changes than high-frequency application reconciliation.
What happens if Terraform state is deleted?
Losing state breaks Terraform's normal mapping between configuration and managed resources. The real infrastructure may still exist, but Terraform may propose creating duplicate resources or otherwise behave unexpectedly. Recover a valid backup where possible, or carefully import existing objects into a new state. Protect state with access controls, backups and appropriate backend locking.
Key takeaway
Terraform turns infrastructure changes into a defined, reviewable workflow built around configuration, providers, state and execution plans. It can make infrastructure easier to reproduce and maintain, but safe use still requires sound access control, plan reviews, monitoring, backups and careful handling of state.
To explore the related technical concepts used in this Terraform guide, visit our broadband terminology guide.
