31 posts tagged with "Terraform"

The fastest way to create a security incident is to deploy infrastructure that was never reviewed for misconfigurations. A public S3 bucket, an open security group, an unencrypted RDS instance — these are not sophisticated attacks. They are configuration mistakes that tools can catch automatically. Security scanning for Terraform has matured to the point where there is no excuse for skipping it.

You would never deploy application code without tests, yet most teams push Terraform changes with nothing more than "the plan looks right." Infrastructure bugs are expensive — a misconfigured security group exposes your database, a wrong CIDR block breaks networking for every service, a missing tag violates compliance and triggers an audit. Terraform testing has matured significantly, and there is now a tool for every level of the testing pyramid.

Running terraform apply from your laptop works fine when you are the only engineer. The moment a second person joins the team, you need a pipeline. CI/CD for Terraform ensures every change is reviewed, planned, and applied through a consistent process — no more "I ran apply from my machine and forgot to commit the code."

Terraform's HCL language has no user-defined functions, but it ships with a rich library of built-in functions that handle everything from string manipulation to CIDR math. Knowing these functions is the difference between clean, maintainable configurations and sprawling hacks with hardcoded values everywhere.

Terraform is a provisioning tool, not a configuration management tool. It creates infrastructure — VMs, networks, databases — but it was never designed to install packages, configure services, or manage files on running machines. Provisioners exist as an escape hatch for those cases, and HashiCorp explicitly recommends using them only as a last resort.

Most teams do not start with Terraform on day one. They have existing EC2 instances, S3 buckets, Azure VNets, and GCP projects that were created manually through the console or with scripts. Terraform import lets you bring those resources under Terraform management without recreating them — no downtime, no data loss.