[Terraform](/glossary/terraform) for Beginners: Complete Getting Started Guide 2026

Infrastructure as Code (IaC) has transformed how we manage and provision cloud resources. Terraform, developed by HashiCorp, stands as the industry-leading IaC tool in 2026, supporting hundreds of cloud providers and services. This comprehensive guide will take you from complete beginner to confidently deploying infrastructure with Terraform. ## What is Terraform? Terraform is an open-source infrastructure as code tool that allows you to define and provision infrastructure using a declarative configuration language called HCL (HashiCorp Configuration Language). Instead of manually clicking through cloud provider consoles or writing imperative scripts, you describe your desired infrastructure state, and Terraform handles the rest. Key benefits include: - Version Control: Infrastructure configurations can be stored in Git

• Reproducibility: Create identical environments consistently
• Multi-Cloud Support: Manage resources across AWS, Azure, GCP, and more
• Dependency Management: Terraform automatically handles resource dependencies
• Plan Before Apply: Preview changes before executing them ## Installing Terraform ### macOS bash # Using Homebrew brew tap hashicorp/tap brew install hashicorp/tap/terraform # Verify installation terraform version ### Linux (Ubuntu/Debian) bash # Add HashiCorp GPG key wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg # Add repository echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list # Install Terraform sudo apt update && sudo apt install terraform # Verify installation terraform version ### Windows ```powershell # Using Chocolatey choco install terraform # Verify installation terraform version

- Azure ([Microsoft Azure](/hosts/azure))
- GCP ([Google Cloud Platform](/hosts/google-cloud))
- [Kubernetes](/glossary/kubernetes)
- [Docker](/glossary/docker)
- GitHub ### Resources Resources are the most important element in Terraform. Each resource block describes one or more infrastructure objects, such as virtual machines, networks, or DNS records. ### State Terraform maintains a state file that maps your configuration to real-world resources. This state file is crucial for Terraform to know what infrastructure it manages. ### Modules Modules are [containers](/glossary/containers) for multiple resources used together. They enable code reuse and organization. ## Your First Terraform Configuration Let's create a simple configuration that deploys a Docker [container](/glossary/container) locally. ### Project Structure ```
terraform-demo/
├── main.tf
├── variables.tf
├── outputs.tf
└── terraform.tfvars
``` ### main.tf ```hcl # Configure the Docker provider
terraform { required_providers { docker = { source = "kreuzwerker/docker" version = "~> 3.0" } } required_version = ">= 1.6"
} provider "docker" { host = "unix:///var/run/docker.sock"
} # Pull the nginx image
resource "docker_image" "nginx" { name = "nginx:latest" keep_locally = false
} # Create a container
resource "docker_container" "nginx" { image = docker_image.nginx.image_id name = var.container_name ports { internal = 80 external = var.external_port }
}
``` ### variables.tf ```hcl
variable "container_name" { description = "Name of the Docker container" type = string default = "nginx-demo"
} variable "external_port" { description = "External port for the container" type = number default = 8080 validation { condition = var.external_port > 1024 && var.external_port < 65535 error_message = "Port must be between 1024 and 65535." }
}
``` ### outputs.tf ```hcl
output "container_id" { description = "ID of the Docker container" value = docker_container.nginx.id
} output "container_url" { description = "URL to access the container" value = "http://localhost:${var.external_port}"
}
``` ### terraform.tfvars ```hcl
container_name = "my-nginx"
external_port = 8080
``` ### Running Terraform Commands ```bash # Initialize Terraform (downloads providers)
terraform init # Validate configuration
terraform validate # Format configuration files
terraform fmt # Preview changes
terraform plan # Apply changes
terraform apply # View outputs
terraform output # Destroy resources
terraform destroy
``` ## AWS Example: Deploying EC2 Instance Let's create a more practical example deploying infrastructure on AWS. ### Prerequisites ```bash # Install AWS CLI
brew install awscli # Configure AWS credentials
aws configure
``` ### main.tf ```hcl
terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 5.0" } } required_version = ">= 1.6"
} provider "aws" { region = var.aws_region
} # Create VPC
resource "aws_vpc" "main" { cidr_block = "10.0.0.0/16" enable_dns_hostnames = true enable_dns_support = true tags = { Name = "${var.project_name}-vpc" Environment = var.environment }
} # Create Internet Gateway
resource "aws_internet_gateway" "main" { vpc_id = aws_vpc.main.id tags = { Name = "${var.project_name}-igw" }
} # Create Subnet
resource "aws_subnet" "public" { vpc_id = aws_vpc.main.id cidr_block = "10.0.1.0/24" availability_zone = "${var.aws_region}a" map_public_ip_on_launch = true tags = { Name = "${var.project_name}-public-subnet" }
} # Create Route Table
resource "aws_route_table" "public" { vpc_id = aws_vpc.main.id route { cidr_block = "0.0.0.0/0" gateway_id = aws_internet_gateway.main.id } tags = { Name = "${var.project_name}-public-rt" }
} # Associate Route Table with Subnet
resource "aws_route_table_association" "public" { subnet_id = aws_subnet.public.id route_table_id = aws_route_table.public.id
} # Create Security Group
resource "aws_security_group" "web" { name = "${var.project_name}-web-sg" description = "Security group for web server" vpc_id = aws_vpc.main.id ingress { description = "HTTP from anywhere" from_port = 80 to_port = 80 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } ingress { description = "SSH from anywhere" from_port = 22 to_port = 22 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } tags = { Name = "${var.project_name}-web-sg" }
} # Get latest Amazon Linux 2 AMI
data "aws_ami" "amazon_linux_2" { most_recent = true owners = ["amazon"] filter { name = "name" values = ["amzn2-ami-hvm-*-x86_64-gp2"] }
} # Create EC2 Instance
resource "aws_instance" "web" { ami = data.aws_ami.amazon_linux_2.id instance_type = var.instance_type subnet_id = aws_subnet.public.id vpc_security_group_ids = [aws_security_group.web.id] user_data = <<-EOF #!/bin/bash yum update -y yum install -y httpd systemctl start httpd systemctl enable httpd echo "<h1>Hello from Terraform!</h1>" > /var/www/html/index.html EOF tags = { Name = "${var.project_name}-web-server" Environment = var.environment }
}
``` ### variables.tf ```hcl
variable "aws_region" { description = "AWS region" type = string default = "us-east-1"
} variable "project_name" { description = "Project name for resource naming" type = string
} variable "environment" { description = "Environment (dev, staging, prod)" type = string default = "dev" validation { condition = contains(["dev", "staging", "prod"], var.environment) error_message = "Environment must be dev, staging, or prod." }
} variable "instance_type" { description = "EC2 instance type" type = string default = "t2.micro"
}
``` ### outputs.tf ```hcl
output "vpc_id" { description = "ID of the VPC" value = aws_vpc.main.id
} output "instance_id" { description = "ID of the EC2 instance" value = aws_instance.web.id
} output "instance_public_ip" { description = "Public IP of the EC2 instance" value = aws_instance.web.public_ip
} output "website_url" { description = "URL to access the website" value = "http://${aws_instance.web.public_ip}"
}
``` ### terraform.tfvars ```hcl
project_name = "my-web-app"
environment = "dev"
aws_region = "us-east-1"
instance_type = "t2.micro"
``` ## State Management ### Local State By default, Terraform stores state locally in `terraform.tfstate`. This works for individual developers but doesn't scale for teams. ### Remote State For team collaboration, use remote state backends: ```hcl
terraform { backend "s3" { bucket = "my-terraform-state-bucket" key = "prod/terraform.tfstate" region = "us-east-1" encrypt = true dynamodb_table = "terraform-state-lock" }
}
``` Create the S3 bucket and DynamoDB table first: ```hcl # backend-resources.tf
resource "aws_s3_bucket" "terraform_state" { bucket = "my-terraform-state-bucket" lifecycle { prevent_destroy = true }
} resource "aws_s3_bucket_versioning" "terraform_state" { bucket = aws_s3_bucket.terraform_state.id versioning_configuration { status = "Enabled" }
} resource "aws_s3_bucket_server_side_encryption_configuration" "terraform_state" { bucket = aws_s3_bucket.terraform_state.id rule { apply_server_side_encryption_by_default { sse_algorithm = "AES256" } }
} resource "aws_dynamodb_table" "terraform_locks" { name = "terraform-state-lock" billing_mode = "PAY_PER_REQUEST" hash_key = "LockID" attribute { name = "LockID" type = "S" }
}
``` ## Working with Modules Modules enable code reuse and organization. ### Creating a Module ```
modules/
└── web-server/ ├── main.tf ├── variables.tf └── outputs.tf
``` ```hcl # modules/web-server/main.tf
resource "aws_instance" "web" { ami = var.ami instance_type = var.instance_type subnet_id = var.subnet_id vpc_security_group_ids = [aws_security_group.web.id] tags = { Name = var.server_name }
} resource "aws_security_group" "web" { name = "${var.server_name}-sg" vpc_id = var.vpc_id ingress { from_port = 80 to_port = 80 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] }
}
``` ### Using the Module ```hcl # main.tf
module "web_server_dev" { source = "./modules/web-server" ami = data.aws_ami.amazon_linux_2.id instance_type = "t2.micro" subnet_id = aws_subnet.public.id vpc_id = aws_vpc.main.id server_name = "dev-web-server"
} module "web_server_prod" { source = "./modules/web-server" ami = data.aws_ami.amazon_linux_2.id instance_type = "t3.medium" subnet_id = aws_subnet.public.id vpc_id = aws_vpc.main.id server_name = "prod-web-server"
}
``` ### Using Public Modules ```hcl # Using module from Terraform Registry
module "vpc" { source = "terraform-aws-modules/vpc/aws" version = "5.1.2" name = "my-vpc" cidr = "10.0.0.0/16" azs = ["us-east-1a", "us-east-1b", "us-east-1c"] private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] enable_nat_gateway = true enable_vpn_gateway = false tags = { Terraform = "true" Environment = "dev" }
}
``` ## Advanced Terraform Techniques ### Workspaces Manage multiple environments with workspaces: ```bash # Create and switch to dev workspace
terraform workspace new dev
terraform workspace select dev # Apply configuration for dev
terraform apply -var="environment=dev" # Create and switch to prod workspace
terraform workspace new prod
terraform workspace select prod # Apply configuration for prod
terraform apply -var="environment=prod" # List workspaces
terraform workspace list # Show current workspace
terraform workspace show
``` Use workspace in configuration: ```hcl
locals { environment = terraform.workspace instance_types = { dev = "t2.micro" staging = "t2.small" prod = "t3.medium" }
} resource "aws_instance" "app" { instance_type = local.instance_types[local.environment] # ... other configuration
}
``` ### Dynamic Blocks Create repeatable nested blocks: ```hcl
variable "ingress_rules" { type = list(object({ from_port = number to_port = number protocol = string cidr_blocks = list(string) description = string })) default = [ { from_port = 80 to_port = 80 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] description = "HTTP" }, { from_port = 443 to_port = 443 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] description = "HTTPS" } ]
} resource "aws_security_group" "web" { name = "web-sg" vpc_id = aws_vpc.main.id dynamic "ingress" { for_each = var.ingress_rules content { from_port = ingress.value.from_port to_port = ingress.value.to_port protocol = ingress.value.protocol cidr_blocks = ingress.value.cidr_blocks description = ingress.value.description } }
}
``` ### Count and For_Each Create multiple resources: ```hcl # Using count
variable "server_count" { default = 3
} resource "aws_instance" "app" { count = var.server_count ami = data.aws_ami.amazon_linux_2.id instance_type = "t2.micro" tags = { Name = "app-server-${count.index + 1}" }
} # Using for_each
variable "servers" { type = map(object({ instance_type = string ami = string })) default = { "web" = { instance_type = "t2.micro" ami = "ami-12345678" } "api" = { instance_type = "t2.small" ami = "ami-87654321" } }
} resource "aws_instance" "servers" { for_each = var.servers ami = each.value.ami instance_type = each.value.instance_type tags = { Name = "${each.key}-server" }
}
``` ### Conditionals ```hcl
variable "create_elastic_ip" { type = bool default = false
} resource "aws_eip" "web" { count = var.create_elastic_ip ? 1 : 0 instance = aws_instance.web.id domain = "vpc"
} # Conditional output
output "elastic_ip" { value = var.create_elastic_ip ? aws_eip.web[0].public_ip : "No Elastic IP created"
}
``` ## Best Practices ### 1. Use Version Control Always commit Terraform configurations to Git: ```bash
git init
echo ".terraform" >> .gitignore
echo "terraform.tfstate*" >> .gitignore
echo "*.tfvars" >> .gitignore
git add .
git commit -m "Initial Terraform configuration"
``` ### 2. Organize Files Logically ```
project/
├── main.tf # Primary resources
├── variables.tf # Variable declarations
├── outputs.tf # Output declarations
├── versions.tf # Provider versions
├── terraform.tfvars # Variable values (don't commit sensitive data)
└── modules/ # Custom modules
``` ### 3. Use Remote State Always use remote state for team collaboration and state locking. ### 4. Enable State Locking Prevent concurrent modifications: ```hcl
terraform { backend "s3" { bucket = "terraform-state" key = "prod/terraform.tfstate" region = "us-east-1" dynamodb_table = "terraform-locks" # Enables locking encrypt = true }
}
``` ### 5. Use Variables for Reusability Never hardcode values that might change: ```hcl # Bad
resource "aws_instance" "web" { instance_type = "t2.micro" ami = "ami-12345678"
} # Good
resource "aws_instance" "web" { instance_type = var.instance_type ami = data.aws_ami.amazon_linux_2.id
}
``` ### 6. Tag All Resources Implement consistent tagging: ```hcl
locals { common_tags = { Project = var.project_name Environment = var.environment ManagedBy = "Terraform" CreatedAt = timestamp() }
} resource "aws_instance" "web" { # ... configuration tags = merge( local.common_tags, { Name = "web-server" Role = "frontend" } )
}
``` ### 7. Use Data Sources Fetch existing resources instead of hardcoding: ```hcl
data "aws_vpc" "existing" { filter { name = "tag:Name" values = ["main-vpc"] }
} resource "aws_subnet" "new" { vpc_id = data.aws_vpc.existing.id # ... other configuration
}
``` ## Frequently Asked Questions ### What's the difference between Terraform and CloudFormation? **Terraform:**
- Multi-cloud support
- Open-source with larger community
- HCL language (more readable)
- State management required **CloudFormation:**
- AWS-only
- Tightly integrated with AWS
- [JSON](/glossary/json)/[YAML](/glossary/yaml) templates
- AWS manages state ### How do I manage secrets in Terraform? Never commit secrets to version control. Use: 1. Environment variables:
```bash
export TF_VAR_db_password="secret"
``` 2. AWS Secrets Manager:
```hcl
data "aws_secretsmanager_secret_version" "db_password" { secret_id = "prod/db/password"
}
``` 3. HashiCorp Vault:
```hcl
data "vault_generic_secret" "db_password" { path = "secret/database"
}
``` ### How do I handle Terraform state file conflicts? 1. Enable state locking with DynamoDB
2. Use Terraform Cloud/Enterprise
3. Implement proper team workflows
4. Never manually edit state files ### Can I import existing infrastructure into Terraform? Yes, using the `terraform import` command: ```bash
terraform import aws_instance.web i-1234567890abcdef0
``` Then manually write the configuration to match. ### How often should I run terraform plan? Before every `apply`:
```bash
terraform plan -out=tfplan
terraform apply tfplan
``` ## Conclusion Terraform has become the standard for infrastructure as code in 2026, and for good reason. Its declarative syntax, multi-cloud support, and robust ecosystem make it the ideal choice for managing infrastructure at any scale. This guide covered the fundamentals, but Terraform's true power emerges as you build more complex infrastructures. Start small, follow best practices, and gradually adopt advanced features as your needs grow. **Key Takeaways:** - Use version control for all Terraform configurations
- Implement remote state and state locking early
- use modules for code reuse
- Tag resources consistently
- Never commit secrets to version control
- Always run `terraform plan` before `apply` With these foundations, you're well-equipped to manage infrastructure as code effectively and confidently in 2026.