Terraform: The IaC Workflow of Providers, Plans, Applies, and State

🌏 中文版

Terraform is declarative infrastructure as code. HCL configuration describes resources and dependencies, providers translate them into APIs such as AWS, Google Cloud, Cloudflare, or GitHub, and state maps Terraform addresses to real objects.

Write, Plan, and Apply form a change protocol

terraform init installs providers and modules and initializes the backend. validate checks structure. plan compares configuration, state, and remote objects to propose creates, updates, replacements, and destroys. apply performs them. A plan is a side-effecting change review artifact, not merely syntax validation.

CI should produce a speculative pull-request plan, then generate a final plan against latest state on a protected branch before authorized apply. Merge order, drift, provider data, and time can change the result. Saved plans are sensitive and must not cross commits, environments, or expired credentials.

State is binding data and a sensitive asset

State records resource identities, attributes, dependencies, and outputs. It is not a disposable cache. Losing it loses ownership mappings; using the wrong one can plan recreation or deletion.

Teams need a remote backend with access control, versioning, encryption, and locking. Locking prevents concurrent writers. Do not bypass waits with -lock=false or force-unlock before proving the lock owner is gone. Back up state, test restoration, and minimize access.

Marking values sensitive hides display but may still store them in plans and state. Ephemeral or write-only provider features can avoid persistence; otherwise inject through a secret manager and treat state like a secrets database. Never commit it.

A Module is an API, not copied code

Modules should expose small typed inputs, clear outputs, provider and version constraints, and upgrade contracts. Pin and review registry or Git sources. Boolean-heavy mega-modules are hard to test; compose smaller responsibility-focused modules.

Use moved blocks when refactoring addresses, import for adopting objects, and removed or state workflows to stop management without deletion. Direct state editing and -target belong to controlled recovery, not normal operation. prevent_destroy is a guardrail, not a backup.

Terraform fits cross-provider provisioning and long-lived network, IAM, database, and cluster resources. Kubernetes reconciles runtime workloads, Pulumi uses general-purpose languages, and SST focuses on application-cloud composition. Test replacement review, expired credentials, lock contention, drift, provider upgrades, module migration, state restoration, and audited break-glass access.

References

• Terraform overview
• Terraform core workflow
• Terraform resources
• Terraform state
• State backends and locking
• Managing sensitive data