Terraform Tutorial with Examples.
Terraform tutorial for infrastructure as code: provision and manage cloud resources across AWS, Azure and GCP with HCL.
Architecture at a glance
Click any box to open the lesson that teaches it
Terraform architecture at a glance
config (.tf) → init → validate → plan → apply → provider → cloud, backed by state
How it fits together (5 steps)
- Start at Terraform Fundamentals, writing a first
.tffile; the workflow runsinit → validate → plan → apply, and it's the provider plugin that turnsapplyinto the real create/update/delete calls against a cloud API — the same mechanism behind multi-cloud patterns. - The configuration language: variables and outputs, locals and modules for reuse, count and for_each to repeat resources safely, the lifecycle block's meta-arguments, and data sources for reading what Terraform doesn't manage.
- State is what actually exists and what
plandiffs the configuration against; a remote backend adds locking so two runs can't corrupt it, workspaces give one config a separate state per environment, and import brings infrastructure created outside Terraform under its management. - Shipping it: IaC vs. configuration management is why this is declarative in the first place, terraform test checks a plan or apply against a real assertion, not just that it ran, and CI/CD with GitHub Actions runs plan on every pull request and gates apply behind review.
- Guardrails:
sensitive = truemasks a secret in plan output but state still keeps it in plain text; provisioners are a last resort HashiCorp itself warns against; and Checkov plus policy as code with conftest catch what review alone can miss.
Beginner
Start here — no prior experience needed
Terraform Fundamentals (IaC)
Write a first Terraform config, apply it, change it and destroy it, seeing the real plan each time and why Terraform compares config, state and reality.
Terraform Workflow (init → validate → plan → apply)
What terraform init, fmt, validate, plan -out and apply each guarantee, with real output, including the errors each step catches and a stale saved plan.
Terraform State (tfstate, remote state, locking)
What terraform.tfstate holds, what happens when it is lost or a resource is renamed, and how state mv, state rm and moved blocks fix it, with real output.
Terraform Variables and Outputs
Input variables with types, defaults and validation, the order -var, tfvars and TF_VAR_ values win in, and outputs that scripts read, with real output.
Providers and Resources (the building blocks of Terraform)
How providers supply resource types, how arguments differ from attributes, how references order an apply, and what a provider version mismatch looks like.
Terraform Locals: Computed Values Without Repetition
A locals block computes a value once from variables or other locals, so one edit cascades everywhere, shown with the real replacement plan it causes.
Terraform Modules (reuse, composition, and clean structure)
Build a local Terraform module with inputs, validation and outputs, call it twice, then move it to for_each with moved blocks, all with real plan output.
Intermediate
For developers with core concepts down
Terraform count and for_each (repeat resources safely)
count keys instances by position, for_each by name. See the real plan when an item is removed from the middle, and the for_each error on unknown keys.
The lifecycle Block: prevent_destroy, create_before_destroy, ignore_changes
Three lifecycle settings with real plans: a change that never applies, a destroy that fails, and create_before_destroy deleting the file it just created.
Data Sources and Dependencies (read existing infrastructure)
Data sources read what Terraform doesn't manage. See when they're read, a hidden dependency that fails, the reference and depends_on fixes, and a cycle.
sensitive = true: What It Hides, and What It Doesn't
sensitive = true masks a secret in plan output, but state keeps it in plain text. Real runs show both, plus why an ephemeral variable is refused.
Remote State Safety (locking, drift, and recovery)
A second Terraform run blocked by the state lock, -lock-timeout waiting it out, and a hand-made hotfix that plan would silently revert, all from real runs.
Workspaces and Environments (dev/stage/prod patterns)
Terraform workspaces give one config separate state per environment. See them work, fail on an unknown workspace, and compare with a directory per env.
Terraform CI/CD with GitHub Actions (plan/apply)
A GitHub Actions workflow for Terraform, with the real output of each step it runs: fmt -check, init, validate, plan -detailed-exitcode and a saved plan.
Advanced
Production-grade patterns for experienced engineers
Provisioners: A Last Resort, and Why HashiCorp Calls It That
local-exec runs a command Terraform can't track: a provisioner that silently goes stale, a justified validation step, and a failure that taints it.
terraform import: Bringing Existing Infrastructure Under Management
An import that succeeds and then plans to replace what it imported, the import-block and -generate-config-out fix, and the review the generated code needs.
terraform test: Catching a Wrong Assertion, Not Just a Wrong Plan
Terraform's test runner checks real plans and applies from .tftest.hcl files. It catches a bug in the test, a deleted validation, and mocks a provider.
Also part of Terraform
Taught in other topics. Each link opens the lesson in its home topic.
Terraform vs. Ansible: A Weighted Decision Framework
Score Terraform, Ansible, and using both against the same four factors — provisioning, host configuration, state tracking, and operational simplicity — across three real scenarios.
Multi-Cloud Terraform: One Pattern, Three Providers
One root module, three provider blocks — AWS, Azure, GCP — provisioning the same storage bucket, plus the state and naming decisions behind it.
Scanning Terraform for Misconfiguration with Checkov
Catch a public S3 bucket and SSH open to the internet in Terraform before anything is deployed: run Checkov, gate on the checks that matter, fix, re-scan.
Policy as Code: Testing Terraform Plans with OPA and Conftest
Write Rego rules and run them on a real terraform plan: untagged resources and SSH open to the internet fail, the fix passes, the policy has its own tests.