Category Terraform Notes

The Default Will Hurt You in Production By default, Terraform stores state locally in . For learning and solo projects? Fine. In any environment where more than one person touches the infrastructure? It’s a disaster waiting to happen. Three ways the…

Don’t Build What Already Exists I’ve watched engineers spend two weeks writing a custom VPC module. Handcrafting subnet logic, NAT gateway failover, route table associations. Beautiful code. Then I showed them terraform-aws-modules/vpc/aws — a module that’s been downloaded millions of times and…

Why Modules Exist Your networking config quietly grew to 300 lines. Your compute config references half of it. Staging needs the same setup as prod, but with smaller instances. And you’ve been copy-pasting blocks between directories like it’s 2005. That’s…

Validation & Checks: Failing Fast Before You Break Prod The Cost of Discovering Errors Late You run terraform apply. It successfully provisions 15 resources. On resource 16, it errors — the instance type is invalid for the selected region, or…

Secrets in Terraform: Never Hardcode, Never Regret The Fastest Way to Get Paged at 2am # DO NOT DO THIS resource "aws_db_instance" "main" { password = "SuperSecret123!" } That password is now in your .tf file. It’s in your Git…

Provisioners & null_resource: The Last Resort HashiCorp’s Own Warning — And Why You Should Listen HashiCorp explicitly documents provisioners as a “last resort.” This isn’t just a suggestion buried in footnotes — it’s a design philosophy statement. Provisioners break the…

Built-in Functions & Dynamic Expressions HCL Is Not a Programming Language — But It’s Surprisingly Capable You can’t write arbitrary loops, define custom functions, or implement object-oriented patterns in HCL. It’s a configuration language, not a general-purpose one. But it…

lifecycle Meta-Arguments: Guard Your Infrastructure The Default Behavior Will Surprise You When Terraform needs to replace a resource — because a changed attribute is marked as ForceNew by the provider — the default behavior is: destroy the old resource first,…

count & for_each: Dynamic Resource Creation Done Right The Problem: Copy-Pasting Resource Blocks resource "aws_instance" "web_1" { … } resource "aws_instance" "web_2" { … } resource "aws_instance" "web_3" { … } When you need a fourth, you add another block.…

References, Dependencies & the Resource Graph Terraform Knows the Order — That’s the Point One of Terraform’s most powerful properties is that you don’t write step-by-step provisioning scripts. You don’t say “create the VPC, then create the subnet, then create…