Welcome to Terraform for Production Sysadmins

Terraform is easy to start and unusually easy to cause damage with. The gap between those two facts is what this course is about.

A first terraform apply takes about ten minutes to write. The same command, aimed at the wrong backend with the wrong credentials, can recreate a hundred production databases in those same ten minutes — and report success while doing it. Nothing in the syntax distinguishes the two runs. The difference lives entirely in the parts most tutorials skip: where the state is, what the variables resolved to, whether the plan was reviewed, and how many resources could be affected before someone noticed.

What this course is not

It is not a syntax reference. The Terraform documentation is excellent, exhaustive, and one search away; reproducing it here would waste your time and go stale faster than this page can be updated.

The course assumes you will look up a resource types arguments when you need them. It concerns itself with the questions the documentation does not answer:

• Which resources will this actually change?
• What will it change on them?
• Is the plan safe to apply?
• What happens if apply fails halfway through?
• How do I prove afterwards what changed?
• Can I undo it?
• Where is state, and what does it really know?

Terraform multiplies capability and blast radius equally

This is the sentence the rest of the course elaborates.

Writing a local-exec shell loop over 500 cloud resources and writing a Terraform configuration that manages 500 resources give you the same reach. Terraform gives you better tools for restricting that reach — state boundaries, -target, saved plans, preconditions, policy — but it does not apply them for you. A configuration with no state boundary and no plan review is a fleet-wide simultaneous change with better error reporting than a shell loop.

So the curriculum is ordered by control, not by feature. State is taught in depth, resource lifecycle is taught before any abstraction, and CI/CD is taught only after plan review is treated as a habit.

What this course is

It is a production-first Terraform course that takes a systems administrator from “I can run terraform apply” to “I can be trusted to operate Terraform against production infrastructure that controls hundreds of business-critical resources.”

The course explicitly assumes that the reader will operate Terraform against environments where mistakes have consequences. Sections are organised around the controls that make those consequences smaller:

State boundaries          — what one state can affect
Plan review               — what apply will change
Module interfaces         — what reusable code can do
Environment architecture  — how production is isolated
Saved plans               — how apply can be reproducible
CI/CD guardrails          — how plans become applies
Policy and supply chain   — what code can run at all
Recovery drills           — what happens when state is wrong

Verified against

The course targets Terraform 1.9.x as the verified version. The 1.9.x series is the first to ship terraform test as a stable feature, mature check blocks, and the import block in the same CLI. The course also references OpenTofu 1.7.x as an open-source alternative that the reader can substitute once they understand the equivalence.

+----------------------------+----------------------------+
| Component                  | Version                    |
+----------------------------+----------------------------+
| Terraform CLI              | 1.9.x                      |
| OpenTofu (referenced)      | 1.7.x                      |
| HCL                        | 2.0                        |
| terraform test             | native, 1.6+               |
| check blocks               | native, 1.5+               |
| moved blocks               | native, 1.1+               |
| import blocks              | native, 1.5+               |
| bpg/proxmox provider       | 0.66+                      |
| hashicorp/local provider   | 2.5+                       |
| hashicorp/null provider    | 3.2+                       |
| hashicorp/random provider  | 3.6+                       |
| hashicorp/http provider    | 3.4+                       |
| tflint                     | latest                     |
| Trivy IaC                  | latest                     |
| OPA / Conftest             | latest                     |
| Linux                      | Ubuntu 24.04 LTS / Debian 12|
+----------------------------+----------------------------+

The course does not depend on HashiCorp Cloud Platform or Terraform Enterprise. Those are introduced as one option in a vendor-neutral landscape, not as a prerequisite.

What you should already be able to do

The course assumes you are comfortable on the Linux command line, can manage SSH keys, and can use Git at a working level (branches, commits, pull requests). It assumes you have read or completed the Linux for Production Sysadmins course, or its equivalent — Terraform almost always operates Linux infrastructure, and reading the platforms Linux course makes the later modules substantially faster.

It does not assume you have used Terraform before.

How the course is structured

The course is divided into nine conceptual arcs:

Foundations                  Why IaC; Terraforms place; version control
Configuration & State        HCL, providers, resources, state, modules
Operations                   plan, apply, drift, environment architecture
Safety & Governance          Secrets, supply chain, policy, guardrails
CI/CD                        review, saved plans, automated apply
Fleet & Scale                multi-account, multi-region, multi-team
Troubleshooting              every failure pattern in the platform
Recovery                     state loss, partial apply, wrong backend
Mission-Critical Operations  the 3 am test, the production plan test

The capstone exercises every arc end-to-end against a small production environment.

The repeating question

Every lesson should leave you able to answer at least some of:

• What exactly will Terraform change?
• Why does Terraform believe that change is necessary?
• What dependencies are involved?
• Will anything be replaced?
• Could data be destroyed?
• How large is the blast radius?
• Is state healthy?
• Are credentials protected?
• What happens if the provider API fails halfway through?
• What happens if Terraform itself crashes?
• Can this change be rolled back?
• How do we validate the result?
• What happens if infrastructure changes outside Terraform?
• How do we safely make this change across multiple environments?

If you cannot answer the question for a tool you are using, you are not ready to use that tool against production.

Note on Cloud / Enterprise

This course does not require HashiCorp Cloud Platform or Terraform Enterprise. HCP and Enterprise are introduced as one option in a vendor-neutral landscape in Part XCII. The course is deliberately useful to teams operating Terraform entirely with open/local tooling.

A note on OpenTofu

OpenTofu is the open-source fork of Terraform. It uses the same HCL, the same workflow, and the same providers. The course introduces OpenTofu where the two implementations differ — primarily around state encryption, provider lock-file behaviour, and a small set of features that have not yet been re-merged. Most of the course is identical across both.

What you will take away

By the end of the course, a competent engineer should be able to:

• Design a Terraform estate that does not put production in one fifty-thousand-line state.
• Read a plan and identify what will change, what will be replaced, and what will be destroyed.
• Refactor a Terraform configuration without recreating infrastructure.
• Recover lost or corrupted state without making the outage worse.
• Recover a partial apply.
• Recognise when Terraform is the wrong tool.

The courses standard, drawn from the production plan test in the final assessment, is:

A competent infrastructure engineer who completes this course, performs its hands-on labs, resolves its failure scenarios, completes its production capstone, and passes its practical assessments has been given the technical knowledge and operational judgement required to safely design, review, deploy, maintain, troubleshoot and recover Terraform-managed infrastructure supporting business-critical production workloads.

Verification

Verification

Verification

Verification