Terraform & IaC

Terraform is a declarative Infrastructure-as-Code tool — you write desired state in HCL and it reconciles infrastructure to match. plan previews the config-vs-state diff without changing anything; apply executes that diff and records it in state.

State maps each resource in your config to the real object Terraform created, plus its attributes. It is the source of truth plan diffs against — so never lose it or hand-edit it. It stores those values in plaintext, secrets included, so it must be protected.

Drift is real infrastructure diverging from what state records — usually a change made outside Terraform, like a console edit. plan refreshes by reading each resource's live attributes, compares them to the config, and shows the difference it would reconcile.

count indexes resources by position, so removing or inserting a middle element shifts every later index — Terraform sees new addresses and destroys and recreates them. for_each keys resources by a stable set or map key, so one entry's change touches only that key and reordering does nothing.

import adopts an existing resource — it writes the real object into state under a config address, creating nothing. The CLI form mutates state at once; the newer import block is declarative and reviewable in code review. Either way you still write the matching resource block yourself.

A module is a reusable folder of resources with a defined interface — inputs and outputs. A good one is narrow and composable: it exposes only meaningful inputs, returns useful outputs, hardcodes nothing environment-specific, and is versioned so callers can pin a known release.

Remote state keeps the state file in a shared, encrypted backend instead of on local disk, so a team shares one source of truth. During apply Terraform locks it; without a lock two concurrent applies interleave writes and corrupt state, then track resources wrongly.

A workspace is a named separate state sharing one config and backend, so dev and prod stay separate. Isolation is weak, though — they share one backend and credentials, so a wrong-workspace apply still reaches prod. For strong separation, teams use separate configs per environment.

Terraform detected drift — the console set t3.large while the config still says t3.small, so plan reverts reality to code. To keep the console value, update the config to t3.large, or add ignore_changes for that attribute. To discard it, just apply and let Terraform revert. Never hand-edit state.

Factor shared infra into versioned modules pinned per environment. Give each environment its own root config and remote backend with locking and least-privilege credentials, so blast radius stays one env. Split state per service to cut lock contention, and promote by bumping pinned versions from dev to prod.

The backend lock protects state from concurrent writes. The cancelled run died before releasing its lease, so the lock is stale — nothing is applying. Verify no apply is live from the Who/Created fields, then terraform force-unlock with the shown ID. Never force it blindly.

Add a moved block mapping the old address aws_instance.web to the new aws_instance.app. On the next plan Terraform rewrites the state address in place, so nothing is destroyed or created. It is declarative and reviewable, unlike a one-off terraform state mv.

A provider major bump can change which attribute forces replacement — here engine_version now forces a replace. Read the upgrade guide first. Avoid the destroy with ignore_changes or prevent_destroy; if cosmetic, reconcile via -refresh-only. Never apply a live-DB replace blindly.