Terraform
Browse all articles, tutorials, and guides about Terraform
Guides
Introduction to Terraform
Learn Terraform 1.17 step by step: install it, write HCL, manage state, use variables and modules, set up S3 remote state with locking, and test your code.
A Practical Guide to FinOps for DevOps Engineers
FinOps for DevOps engineers: read FOCUS billing data, tag and allocate cloud costs, set budgets and anomaly alerts, and add cost checks to CI/CD.
Posts
We Tested AWS Emulator: It Blocks More Than Its Docs Say, and Less Than AWS Does
AWS Emulator passed all 40 of our workflow checks and caught two IAM mistakes in our own test code. It also let a user with no policies assume an admin role, ignored permissions boundaries and session policies, and with the default JavaScript SDK settings, one SQS request went to real AWS. Here is what we measured on a throwaway droplet.
Terraform 1.17's -minimal-refresh: 202 API Calls Down to Zero, and the Drift Goes Quiet Too
Terraform 1.17 can skip the refresh for every resource you did not change. We measured it on 202 real DigitalOcean resources: API calls went from 202 to 0 and plan time halved, and then we broke three records behind its back to see what it stops noticing.
SOC 2 Evidence From GitHub and Terraform, and the Part That Still Needs a Person
We pointed a small evidence collector at a repository whose main branch had a strict ruleset. The ruleset passed and three change-management controls failed. Here is which SOC 2 evidence you can pull from GitHub and Terraform, which still needs a person, and ten ways an evidence script can pass a control without evidence.
OpenTofu 1.13 Re-Encodes base64gzip and Drops WinRM. We Upgraded the Same State to See What Breaks
OpenTofu 1.13 shipped on September 30. We applied configs with 1.12.7 and planned them with 1.13.1 against the same state. Gzipped user data planned an update and a replacement with no config change. A WinRM provisioner passed validate and plan, then failed at apply. The new assume functions turned an Invalid count argument error into a clean plan. Here is what to check before you bump the version.
Terraform Module Outputs, Inputs and Sources: How Modules Pass Data to Each Other
How to get a value out of a Terraform module, pass a resource into another module, chain modules with for_each, pin a Git branch or tag as a module source, share providers and variables across modules, and fix the "Provider configuration not present" error that shows up when you refactor. The terminal examples were run on Terraform 1.15.
Terraform State: Remove, Move and Migrate Resources, and Set Up a Remote Backend
The state questions every Terraform team hits: how to stop managing a resource without deleting it, rename one without a rebuild, move it to another project, bootstrap a remote backend, and why the DynamoDB lock table is on its way out. Every command here was run on Terraform 1.15.
Gate Your Terraform Plans: Rules Decide, the Model Explains
A pull request says "3 to add, 1 to change, 1 to destroy" and everyone approves it. This is a GitHub Action that reads the plan JSON, fails the job on selected changes that risk data loss or public exposure, and uses DigitalOcean inference only to write the comment. Measured against twenty labelled plans, including the four it misses.
Who Owns the State File, and Other Questions That Decide Your Week
Most Terraform pain is not HCL. It is state: who is allowed to write it, how it is split, how you find out it no longer matches reality, and how a plan gets reviewed before it applies. Four decisions, a real drift run, and the tooling that exists for each.
Terraform Variables, Loops, and Outputs: The Complete Guide
Everything about moving values through Terraform in one place: declaring vs assigning variables, tfvars and TF_VAR_ precedence, locals, maps and lists, for_each and its pitfalls, splat outputs for counted resources, sensitive values, and the classic "variables may not be used here" error.
Terraform Strings and Conditionals: The Complete Guide
Building strings, checking substrings, ternaries, optional attributes and conditional resources, in one place.
Build and Deploy a Ticket Triage App with DigitalOcean Inference
Build a practical FastAPI ticket triage app with DigitalOcean Serverless Inference, then deploy it to App Platform with Terraform.
The DevOps Skills That Create Openings, Not Just Pass Filters
Most skill lists tell you what gets you past a screening. They do not tell you what makes a company decide to hire someone in the first place. Those are different lists, and the second one is shorter, more specific, and worth a lot more.
Build a Terraform Provider for Your API with the Plugin Framework
If your product has a REST API, a Terraform provider lets people manage it as code. Here is how to build one with the modern Terraform Plugin Framework, using a real email API as the example, from client to registry.
OpenTofu 1.12: destroy = false Retires the tofu state rm Ritual
OpenTofu 1.12 lets a resource declare that it should be forgotten instead of destroyed, makes prevent_destroy dynamic, and quietly ends the manual providers lock step. Here is what each change does, plus the footguns the release notes will not warn you about.
OpenTofu in 2026: Should You Switch from Terraform (and What It Actually Costs You)
OpenTofu has matured into a real Terraform alternative in 2026. Here is what the fork gives you, why the migration is easier than you think, and where the actual lock-in hides.
Best Claude Code Plugins for DevOps Engineers in 2026
A curated guide to Claude Code plugins built for DevOps workflows - from Terraform validation and Kubernetes troubleshooting to security scanning and CI/CD pipeline optimization.
Infrastructure as Code: A Beginner's Guide to IaC Fundamentals
Learn the fundamentals of Infrastructure as Code - what it is, why it matters, key concepts, popular tools, and best practices for managing infrastructure with code.
The Hidden Costs of Over-Automation in DevOps
Automation speeds things up, but too much of it can hide failures, slow incident response, and add fragile layers you have to maintain.
Experimenting Locally With Terraform, and Re-Running on File Changes
Try Terraform changes without touching shared state: providers that need no account, terraform console, local backends via override files, mock providers, local AWS emulators, and what to do instead of a watch mode when files change.
How to Save Terraform Plan and Apply Output to a File
Learn how to save Terraform plan output for review, share readable apply logs, and use the -out flag for safe two-step deployments.
How to Run Terraform From a Different Directory and in Scripts
Use terraform -chdir to run init, plan and apply against another folder, run Terraform without interactive prompts, limit a run to one resource with -target, and destroy everything except one resource without losing it.
How to Set Up Fargate Execution Roles and IAM Policies in Terraform
Create the ECS Fargate task execution role and task role with Terraform, attach several IAM policies to one role, fix "MalformedPolicyDocument: Has prohibited field Resource", and find the minimum AWS permissions that Terraform itself needs.
Should .terraform.lock.hcl Be in .gitignore? Checksums and Versions
No: commit .terraform.lock.hcl. Learn what the lock file records, how version constraints work, how to fix checksum mismatch and "Invalid legacy provider address" errors, how to install a specific Terraform version, and which providers manage on-premises servers.
How to Apply SQL Scripts to RDS and Read Secrets With Terraform
Terraform has no SQL resource. Compare the three ways to run SQL against RDS (local-exec, a database provider, a migration tool), and learn how to read secrets from AWS Secrets Manager without storing them in the Terraform state.
How to Configure CloudWatch Logs Subscription Filter to Lambda With Terraform
Learn how to stream CloudWatch Logs to a Lambda function using Terraform, including permissions and error handling, and how to run a Lambda function on a schedule with EventBridge.
How to Organize a Terraform Repository: Environments, Modules, Files
A practical layout for a Terraform repository: one root folder per environment and component, small reusable modules, and clear file names. Also covers dev, staging and production, workspaces, and how to split main.tf into several files.
How to Read a .env File in Terraform, and Where path.module Points
Terraform reads only TF_VAR_ environment variables and never a .env file. Learn how to load one safely, how path.module, path.root and path.cwd differ, and how to upload a local folder or create an empty folder in S3.
How to Reference for_each Resources in Terraform: Keys, Indexes and Import
A resource with for_each is a map of instances. Learn how to reference one instance or all of them, how to get a list index inside for_each, and how to import existing objects into for_each addresses without quoting errors.
Terraform Infrastructure as Code Best Practices
Practical Terraform best practices for 2026: repository layout, remote state with native S3 locking, version pins and the lock file, data sources instead of hardcoded IDs, secrets kept out of state, terraform test, and a CI pipeline that applies the plan you reviewed.