Terraform — Infrastructure as Code in Practice

“Who created that server? What are its settings? Why is it different from staging?” — questions we asked ourselves too often. Terraform from HashiCorp gave us the answer: infrastructure described in code, versioned in Git.

The Problem: Snowflake Servers¶

Every server was a unique snowflake. Admin A configured the firewall one way, admin B another way. Documentation? Outdated or non-existent. Reproducing an environment for a new client meant days of manual work.

Terraform Basics¶

Terraform uses the declarative HCL language. You describe what you want, not how to create it. Terraform determines the current state, compares it with the desired state, and makes the necessary changes.

resource "aws_instance" "api_server" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.medium"
  vpc_security_group_ids = [aws_security_group.api.id]
  subnet_id              = aws_subnet.private.id
  tags = {
    Name        = "api-server"
    Environment = "production"
    ManagedBy   = "terraform"
  }
}

State Management¶

Terraform maintains state in a state file. In a team, you need remote state. We use an S3 bucket with DynamoDB locking.

Modules — DRY Principle¶

We have an internal module library: VPC, ECS cluster, RDS instance, S3 buckets. New environment for a client: compose modules together, terraform apply, done in 15 minutes.

Plan Before Apply¶

terraform plan is your safety belt. It shows exactly what will change, what will be created, and most importantly what will be destroyed. We have a rule: no apply without plan review.

What Terraform Doesn’t Do Well¶

• Configuration inside VMs — we use Ansible for that
• Drift detection — only detects drift during the next plan
• Complex logic — HCL is not a programming language
• Secrets — state file contains sensitive data

Infrastructure as Code Isn’t a Choice, It’s a Necessity¶

Terraform changed the way we think about infrastructure. Instead of “where is that button in the console” we ask “where is that .tf file in Git”.