Terraform Errors Are Usually Telling You Exactly What’s Wrong Here’s the thing about Terraform errors: they look scary but they’re almost always specific. Wrong argument name, missing required field, provider API rejection with a reason attached. Before you reach for…

Quick Primer: What Is a Workspace? A Terraform workspace is an isolated execution context with its own state file. Think of it as a boundary: everything declared in this directory of .tf files, backed by this state file, is one unit of infrastructure. Most…

State Is Not Read-Only Most engineers treat the state file like it’s radioactive. And look, healthy respect is good — it IS the single source of truth for what Terraform manages. But it’s not untouchable. Terraform gives you safe, auditable…

The Default Will Hurt You in Production By default, Terraform stores state locally in . For learning and solo projects? Fine. In any environment where more than one person touches the infrastructure? It’s a disaster waiting to happen. Three ways the…

Don’t Build What Already Exists I’ve watched engineers spend two weeks writing a custom VPC module. Handcrafting subnet logic, NAT gateway failover, route table associations. Beautiful code. Then I showed them terraform-aws-modules/vpc/aws — a module that’s been downloaded millions of times and…

Why Modules Exist Your networking config quietly grew to 300 lines. Your compute config references half of it. Staging needs the same setup as prod, but with smaller instances. And you’ve been copy-pasting blocks between directories like it’s 2005. That’s…

Validation & Checks: Failing Fast Before You Break Prod The Cost of Discovering Errors Late You run terraform apply. It successfully provisions 15 resources. On resource 16, it errors — the instance type is invalid for the selected region, or…

Secrets in Terraform: Never Hardcode, Never Regret The Fastest Way to Get Paged at 2am # DO NOT DO THIS resource "aws_db_instance" "main" { password = "SuperSecret123!" } That password is now in your .tf file. It’s in your Git…

Provisioners & null_resource: The Last Resort HashiCorp’s Own Warning — And Why You Should Listen HashiCorp explicitly documents provisioners as a “last resort.” This isn’t just a suggestion buried in footnotes — it’s a design philosophy statement. Provisioners break the…

Built-in Functions & Dynamic Expressions HCL Is Not a Programming Language — But It’s Surprisingly Capable You can’t write arbitrary loops, define custom functions, or implement object-oriented patterns in HCL. It’s a configuration language, not a general-purpose one. But it…