Terraform Tutorial — Terraform in the DevOps Toolchain

3 minute read

Terraform doesn’t exist in isolation. It’s one link in a chain of tools that take your application from code to production. Understanding where Terraform fits helps you see the big picture and build effective automation pipelines.

Where Terraform Fits

Here’s a typical DevOps toolchain and where Terraform plugs in:

┌─────────────┐    ┌─────────────┐    ┌─────────────┐    ┌─────────────┐
│   Code      │───▶│  Build      │───▶│  Deploy     │───▶│  Monitor    │
│  (Git)      │    │  (CI/CD)    │    │  (K8s/ECS)  │    │  (Datadog)  │
└─────────────┘    └─────────────┘    └─────────────┘    └─────────────┘
       │                  │                  │                  │
       ▼                  ▼                  ▼                  ▼
  Terraform          Terraform          Terraform          Terraform
  configs in         provisions          creates            provisions
  version            build infra         deployment          monitoring
  control            (CI runners)        targets            dashboards

Terraform provisions the infrastructure that everything else runs on:

  1. Terraform creates the VPC, subnets, load balancer, and EKS cluster
  2. Ansible configures any EC2 instances (installs packages, manages config files)
  3. Docker packages the application into containers
  4. Kubernetes orchestrates the containers on the cluster Terraform created
  5. Monitoring tools (Datadog, Prometheus) watch the infrastructure Terraform provisioned

CI/CD Pipeline Integration

In a mature team, nobody runs terraform apply from their laptop. Instead, Terraform runs inside a CI/CD pipeline:

The Pull Request Workflow

Developer                    CI/CD Pipeline              Cloud
─────────                    ──────────────              ─────
1. Edit .tf files
2. Push branch
3. Open PR          ──────▶  4. terraform plan
                             5. Post plan output
                                as PR comment
6. Team reviews plan
7. Approve + merge   ──────▶  8. terraform apply
                              9. Infrastructure updated

This workflow is critical because:

  • Every change is reviewed before it touches real infrastructure
  • The plan output shows exactly what will be created, changed, or destroyed
  • Automation applies the change — no human error from manual console clicks
  • Git history records every infrastructure change

Example GitHub Actions Pipeline

name: Terraform
on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  terraform:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3

      - name: Terraform Init
        run: terraform init

      - name: Terraform Plan
        if: github.event_name == 'pull_request'
        run: terraform plan -no-color

      - name: Terraform Apply
        if: github.ref == 'refs/heads/main'
        run: terraform apply -auto-approve

GitOps for Infrastructure

GitOps means Git is the single source of truth for both application code and infrastructure. With Terraform:

  • Your .tf files live in a Git repository
  • The main branch represents what should exist in production
  • Any difference between the Git config and real infrastructure is a drift that needs fixing
  • Changes flow through pull requests, code review, and automated pipelines

This is the same pattern used for application code — except now it applies to infrastructure too.

Team Workflow

In a team environment, the workflow typically looks like this:

Step Who What
1 Developer Creates a feature branch and edits .tf files
2 Developer Opens a pull request
3 CI pipeline Runs terraform plan and posts output to the PR
4 Team lead / reviewer Reviews the plan output — checks for unexpected changes
5 Reviewer Approves the PR
6 CI pipeline Merges to main and runs terraform apply
7 Monitoring Alerts team if any resources are unhealthy

This workflow prevents surprises. Nobody applies Terraform changes without the team seeing the plan first.

Automation Tools for Terraform

Several tools automate the PR-based Terraform workflow:

Tool Description
Atlantis Open-source tool that runs plan/apply from GitHub/GitLab PR comments
Terraform Cloud HashiCorp’s SaaS with VCS integration, remote runs, and policy enforcement
Spacelift CI/CD platform purpose-built for Terraform with policy-as-code
Env0 Remote run environment with cost estimation and governance
GitHub Actions General CI/CD that works well with setup-terraform action

For beginners, GitHub Actions or GitLab CI is a great starting point. As your team grows, you may upgrade to Atlantis or Terraform Cloud.

Security Considerations

When running Terraform in CI/CD, you need to handle credentials carefully:

  • Never hardcode AWS keys in .tf files or CI config
  • Use IAM roles for CI runners (e.g., EC2 instance profile, GitHub OIDC)
  • Store secrets in CI/CD secret variables (GitHub Secrets, GitLab CI Variables)
  • Use short-lived credentials whenever possible (AWS STS, Workload Identity)
  • Limit permissions — the CI runner should only have the IAM permissions Terraform needs

⚠️ Warning: If your Terraform state contains sensitive data (database passwords, API keys), make sure your remote backend (S3 bucket, Terraform Cloud) is encrypted and access-controlled.

What’s Next?

You know where Terraform fits in the toolchain. Next, let’s look at real-world use cases — concrete scenarios where teams use Terraform to solve infrastructure challenges.

← The Terraform Ecosystem Real-World Use Cases →

You may also enjoy