Terraform Advanced — FAQ
Frequently asked questions about advanced Terraform usage.
Q: count or for_each?
A: Use count only for on/off toggles (count = var.enabled ? 1 : 0). Use for_each for everything else — it’s safer when items are added or removed.
Q: Workspaces or directories for environments?
A: Directories. Workspaces share the same code and backend config, making it easy to accidentally apply dev changes to prod. Directories give you full isolation.
Q: How big should a state file be?
A: Aim for 200-500 resources per state. Beyond that, plan times increase significantly. Split by layer (networking, data, compute) or by service.
Q: Should I use Terragrunt?
A: If you find yourself duplicating backend configs, provider blocks, and variable files across many directories — yes. Terragrunt eliminates that duplication. If you have a small project, it’s unnecessary overhead.
Q: Terraform or OpenTofu?
A: As of 2024, both work nearly identically. If licensing matters to your organization (BSL vs Apache 2.0), choose accordingly. Most tutorials and modules work with both.
Q: How do I handle secrets in Terraform?
A: Never hardcode secrets. Use sensitive = true on variables, read from Secrets Manager or Vault, and always encrypt your state backend. The secret is still in state — encryption is essential.
Q: Is terraform destroy safe in production?
A: No. Always use prevent_destroy on critical resources, require plan review before any destroy, and use separate CI/CD pipelines for destroy operations with manual approval gates.
Q: How do I migrate from one backend to another?
A: Change the backend configuration and run terraform init -migrate-state. Terraform will copy the state to the new backend. Always backup first with terraform state pull > backup.tfstate.
Q: What’s the best CI/CD for Terraform?
A: Depends on your setup:
- Small team: GitHub Actions or GitLab CI
- Medium team: Atlantis (PR-based workflow)
- Enterprise: Terraform Cloud/Enterprise or Spacelift
Congratulations! 🎉
You’ve completed the Terraform Advanced Tutorial. You now have the knowledge to:
- Write advanced HCL patterns with dynamic blocks and complex expressions
- Manage state at scale with remote backends and micro-states
- Build and publish reusable modules
- Use Terragrunt for DRY configurations
- Import existing infrastructure
- Test infrastructure code at every level
- Set up CI/CD pipelines for Terraform
- Secure your workflows with Vault, OPA, and least-privilege IAM
- Optimize performance for large deployments
- Debug and perform state surgery
- Apply production-grade patterns
