Installing Terraform

The Terraform CLI is the binary that parses your configuration, talks to providers, and emits plans. Installing it is the first operational decision you make. Done wrong, every subsequent terraform plan runs against a hostile binary. Done right, the version is pinned, the binary is verified, and the install is reproducible.

Where to get Terraform

There are exactly two sources for the Terraform CLI you should trust:

1. The official HashiCorp package repositories. Linux distributions (APT, YUM, etc.) that contain terraform exist but are almost always outdated or unmaintained.
2. The official zip download from developer.hashicorp.com. The SHA-256 checksums are published alongside the binary.

Anything else — a Docker image, a Homebrew tap, a curl-bash installer, a coworker passing you a download — is a supply-chain attack surface. The Terraform binary reads your state and your provider credentials. Treat it like a kernel.

Installing on Linux (Debian / Ubuntu)

HashiCorp maintains an APT repository. The official install guide is the source of truth; the steps below are the canonical recipe.

# Install the prerequisites
sudo apt-get update && sudo apt-get install -y gnupg software-properties-common

# Add the HashiCorp GPG key
wget -O- https://apt.releases.hashicorp.com/gpg |
  sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg

# Verify the key fingerprint
gpg --no-default-keyring --keyring /usr/share/keyrings/hashicorp-archive-keyring.gpg \
  --fingerprint

# Add the repository
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] \
  https://apt.releases.hashicorp.com $(lsb_release -cs) main" |
  sudo tee /etc/apt/sources.list.d/hashicorp.list

# Install Terraform
sudo apt-get update && sudo apt-get install -y terraform

Verify the install:

terraform version

Expected:

Terraform v1.9.x
on linux_amd64

The version line is the only thing the install outputs by default. If the output mentions anything else — a network request, a license prompt, a download — you have the wrong binary.

Installing on Linux (RHEL / Fedora)

# Install the prerequisites
sudo dnf install -y dnf-plugins-core

# Add the HashiCorp repository
sudo dnf config-manager addrepo \
  --from-repofile=https://rpm.releases.hashicorp.com/fedora/hashicorp.repo

# Install Terraform
sudo dnf install -y terraform

Installing on macOS

The official Homebrew tap is supported but Homebrews own Tap policy is not always enforced. The most reliable install path is the official zip:

# Download the official zip
curl -fsSL -o terraform.zip \
  https://releases.hashicorp.com/terraform/1.9.8/terraform_1.9.8_darwin_amd64.zip

# Verify the SHA-256 checksum
echo "9dda404ba5b67b09d24a6c84a1..." | shasum -a 256 -c

# Unzip
unzip terraform.zip

# Move to a directory on PATH
sudo mv terraform /usr/local/bin/

Installing on Windows

The official installer is the recommended path. The PowerShell Chocolatey package is maintained by the community and may lag behind. Use the official .exe or .zip from the downloads page.

# Download via PowerShell
Invoke-WebRequest -OutFile terraform.zip `
  "https://releases.hashicorp.com/terraform/1.9.8/terraform_1.9.8_windows_amd64.zip"

# Verify the SHA-256 checksum
Get-FileHash -Algorithm SHA256 terraform.zip

# Unzip and add to PATH
Expand-Archive terraform.zip -DestinationPath C:\terraform
# Add C:\terraform to $env:PATH

Verifying the binary

The Terraform binary is a Go-compiled executable. The official checksums are published at the same URL as the zip:

curl -fsSL -o terraform_SHA256SUMS \
  https://releases.hashicorp.com/terraform/1.9.8/terraform_1.9.8_SHA256SUMS

# Verify
sha256sum -c terraform_SHA256SUMS 2>&1 | grep terraform

The output:

terraform: OK

If the checksum does not match, delete the binary and re-download. A mismatched checksum is a network failure, a man-in-the-middle, or a malicious mirror.

Pinning the version

The configuration should declare the required version:

terraform {
  required_version = ">= 1.9.0, < 2.0.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

The required_version constraint:

• Prevents terraform init from running on an incompatible version.
• Sets the floor for the operator workstation.
• Provides a clear migration path when the version is bumped.

The ~> 5.0 constraint for the AWS provider means “compatible release”: 5.0.x, 5.1.x, 5.2.x, but not 6.0.0. The bump to 6.0 will require an explicit version bump and a plan review.

Team installation

In a team, install Terraform the same way everywhere:

• One per workstation. The same version, the same install method, the same PATH.
• Same version pinning. All workstations on the same required_version. The CI pipeline uses the same version.

Do not install Terraform via:

• apt-get install terraform (almost always outdated).
• brew install terraform (Homebrew forges its own checksums).
• pip install terraform (does not exist).
• A Docker image other than the official hashicorp/terraform.

These are not necessarily malicious; they are simply uncontrolled. The version the team depends on is the version that should be installed, full stop.

Verifying the install

After the install, verify the install:

# Version matches the teams required_version
terraform version

# Help output is expected
terraform --help

# The init subcommand is available
terraform init --help

A binary that fails any of these is not the Terraform binary the team expects.

Upgrading Terraform

Upgrades are a managed change. The procedure:

1. Read the upgrade release notes.
2. Update the required_version in the configuration.
3. Run terraform init -upgrade to update the lockfile.
4. Run terraform plan in a test environment.
5. Verify the plan matches the expectation.
6. Apply in the test environment.
7. Apply in production.

The course has a dedicated runbook for upgrades (Part XCIV).

What comes next

The next lesson is the basic workflow: fmt, validate, plan, apply, destroy. Every later lesson assumes the workflow is understood.

Verification