Infrastructure as Code (Terraform basics)

Infrastructure as Code (IaC) is the practice of defining cloud infrastructure (servers, databases, networks, DNS, IAM policies) using declarative configuration files rather than manual console operations. Terraform, by HashiCorp, is the most widely adopted IaC tool, using HCL (HashiCorp Configuration Language) to define resources across multiple cloud providers. This approach makes infrastructure reproducible, version-controlled, peer-reviewed, and auditable.

Terraform works by comparing the desired state (defined in .tf files) with the current state (stored in a state file) and computing a plan of changes needed to reconcile the difference. The plan is reviewed before applying, preventing unexpected changes. State files should be stored remotely (S3 + DynamoDB for locking, Terraform Cloud, or similar) and never committed to version control, as they may contain sensitive values.

Best practices include organizing code into modules for reusability, using workspaces or directory-based environments for dev/staging/prod separation, pinning provider and module versions, using data sources to reference existing infrastructure, implementing policy-as-code with tools like Sentinel or OPA, and running terraform plan in CI with the output saved for review. Variables should be typed and validated, secrets should come from a secret manager (not tfvars files), and outputs should expose values needed by other systems. Terraform Cloud or Atlantis can automate plan-on-PR and apply-on-merge workflows.