Why Terraform

That’s what building by hand costs. Not the first time, which goes fine. Every time after.

This lesson is about writing infrastructure down as code, and why that fixes both Leo’s two lost days and the typo nobody could review.

Building by clicking in the console has a nickname: ClickOps. It’s the right way to learn, and to explore. The trouble starts when a whole environment exists only because someone clicked it into being.

What goes wrong with clicking

The idea: write it down as code

Infrastructure as code means you describe your infrastructure in text files. A tool reads the files and builds what they describe.

Terraform is the most widely used tool for this. You write files ending in .tf, like this:

resource "aws_ecr_repository" "orders" {
  name = "quickcart-orders"
}

That says: there should be an ECR repository called quickcart-orders. You’ll build exactly this in Your first resource.

Because the files are text, they go into git, like app code. So you get what app developers already rely on:

Declarative, not step by step

There are two ways to tell a computer what to do.

Terraform is declarative. You describe what should exist. Terraform works out the steps.

How Terraform knows what to do

Every run compares three things:

From the difference, it makes a plan: a list of what it would create, change or destroy.

The loop you’ll use every day

Then back to step 2. Because apply compares first, running it again with no changes does nothing. That’s called idempotent, and it’s why it’s safe to run as often as you like.

What Terraform doesn’t do

It doesn’t make clicking wrong. You’ll still use the console to look at things, to learn, and for the one bucket that holds Terraform’s own state. What changes is where the truth lives: in the code, not in someone’s memory.

Build QuickCart’s environment both ways. Then build a second copy in another region, and compare.

What to notice: the first build costs about the same either way. The difference only shows on the second copy: clicking is just as slow again and quietly misses a step, while code builds an identical copy by changing one value.

Free — everything runs on your laptop. Nothing is created in AWS.

You’ll install Terraform and run the whole loop — init, plan, apply, apply again, change, destroy — with a built-in resource that lives only in Terraform’s memory. No AWS account needed. About 15 minutes.

1. Install Terraform

   With Homebrew, on macOS, Linux or Windows (inside WSL), Terraform comes from HashiCorp’s own collection. Set up your computer installs Homebrew. First add the collection:

   TerminalCopy

   brew tap hashicorp/tap

   Part	What it means
   brew tap	add another collection of software that Homebrew can install from
   hashicorp/tap	HashiCorp’s own collection

   Then install Terraform from it:

   TerminalCopy

   brew install hashicorp/tap/terraform

   Part	What it means
   brew install	install a program
   hashicorp/tap/terraform	Terraform, from HashiCorp’s collection

   Check it worked:

   TerminalCopy

   terraform version

   Part	What it means
   terraform version	print the version of Terraform installed

   You should see

   Terraform v1.16.4
   on linux_amd64

   Yours may be newer. Anything from 1.10 upwards works for this course. The second line names your system: darwin_arm64 on a Mac with an Apple chip, linux_amd64 on most Linux and Windows computers.

   On Windows or Linux, follow the install page on HashiCorp’s developer site, then run terraform version the same way.

2. Make a folder and describe something

   Make a folder for this lesson:

   TerminalCopy

   mkdir quickcart-hello

   Part	What it means
   mkdir	make a directory
   quickcart-hello	its name

   TerminalCopy

   cd quickcart-hello

   Part	What it means
   cd	change directory. Every later command runs in here
   quickcart-hello	the folder you just made

   Create main.tf in that folder, in any text editor:

   main.tfCopy

   terraform {
     required_version = ">= 1.10.0"
   }
   
   resource "terraform_data" "environment" {
     input = {
       app    = "quickcart"
       region = "us-east-1"
       zones  = 2
     }
   }
   
   output "environment" {
     value = terraform_data.environment.output
   }

   terraform_data is a resource built into Terraform. It creates nothing outside Terraform: it just stores the values you give it. That makes it perfect for practising the loop without an AWS account.

   Setting	What it does	If you leave it out	When you’d change it
   terraform → required_version	Refuse to run on a Terraform older than 1.10	Any version runs it, and an old one may fail later with a confusing error	When your code starts relying on a newer feature
   resource "terraform_data" "environment"	Declare one resource. terraform_data is the type; environment is the name your code uses for it	—	—
   input	The values to store. Here, a small description of an environment	The resource stores nothing, and has nothing to show	Change it to see how a plan shows an update
   output "environment"	Print a value after apply	Nothing is printed after apply	Add one for anything you’ll want to see or use elsewhere
   value	What the output prints: the stored values, read back from the resource	Required — an output without a value is an error	Point it at whatever you want to see

3. Initialise the folder

   TerminalCopy

   terraform init

   Part	What it means
   terraform init	set up this folder: find and download any plugins the code needs

   You should see

   Initializing the backend...
   
   Initializing provider plugins...
   - terraform.io/builtin/terraform is built in to Terraform
   
   Terraform has been successfully initialized!

   terraform_data is built in, so there’s nothing to download. With AWS, this is where the AWS plugin would be downloaded.

4. Read the plan

   TerminalCopy

   terraform plan

   Part	What it means
   terraform plan	compare the code with what exists, and show what would change. Changes nothing

   You should see

   Terraform used the selected providers to generate the following execution
   plan. Resource actions are indicated with the following symbols:
     + create
   
   Terraform will perform the following actions:
   
     # terraform_data.environment will be created
     + resource "terraform_data" "environment" {
         + id     = (known after apply)
         + input  = {
             + app    = "quickcart"
             + region = "us-east-1"
             + zones  = 2
           }
         + output = (known after apply)
       }
   
   Plan: 1 to add, 0 to change, 0 to destroy.
   
   Changes to Outputs:
     + environment = (known after apply)

   Read it top to bottom:

   Line	What it tells you
   + create	the key: + means something will be created
   # terraform_data.environment will be created	which resource, and what will happen to it
   (known after apply)	a value that doesn’t exist until it’s created, like an ID
   Plan: 1 to add, 0 to change, 0 to destroy.	the summary. Always read this line

   It also warns you that the plan wasn’t saved. That’s fine here: you’ll use saved plans later, in pipelines.

5. Apply it, then apply again

   TerminalCopy

   terraform apply

   Part	What it means
   terraform apply	make the plan again, show it, and carry it out once you type yes

   It shows the same plan, then asks. Type yes:

   You should see

   Do you want to perform these actions?
     Terraform will perform the actions described above.
     Only 'yes' will be accepted to approve.
   
     Enter a value: yes
   
   terraform_data.environment: Creating...
   terraform_data.environment: Creation complete after 0s [id=2af1f034-bd2c-4555-3989-3189330c5de7]
   
   Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
   
   Outputs:
   
   environment = {
     "app" = "quickcart"
     "region" = "us-east-1"
     "zones" = 2
   }

   Your ID will be different. A new file has appeared in the folder: terraform.tfstate. That’s Terraform’s record of what it built.

   Now run exactly the same command again:

   TerminalCopy

   terraform apply

   Part	What it means
   terraform apply	the same command, with no change to the code

   You should see

   terraform_data.environment: Refreshing state... [id=2af1f034-bd2c-4555-3989-3189330c5de7]
   
   No changes. Your infrastructure matches the configuration.
   
   Terraform has compared your real infrastructure against your configuration
   and found no differences, so no changes are needed.
   
   Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

   Nothing was built twice. A script would have tried to create it again. Terraform compared, found everything matching, and did nothing. This is what makes it safe to run as often as you like.

6. Change the code, and read the plan

   QuickCart decides to run in three zones. In main.tf, change zones = 2 to zones = 3. The whole file now reads:

   main.tfCopy

   terraform {
     required_version = ">= 1.10.0"
   }
   
   resource "terraform_data" "environment" {
     input = {
       app    = "quickcart"
       region = "us-east-1"
       zones  = 3
     }
   }
   
   output "environment" {
     value = terraform_data.environment.output
   }

   TerminalCopy

   terraform plan

   Part	What it means
   terraform plan	compare the changed code with what was built

   You should see

   Terraform used the selected providers to generate the following execution
   plan. Resource actions are indicated with the following symbols:
     ~ update in-place
   
   Terraform will perform the following actions:
   
     # terraform_data.environment will be updated in-place
     ~ resource "terraform_data" "environment" {
           id     = "2af1f034-bd2c-4555-3989-3189330c5de7"
         ~ input  = {
             ~ zones  = 2 -> 3
               # (2 unchanged attributes hidden)
           }
         ~ output = {
             - app    = "quickcart"
             - region = "us-east-1"
             - zones  = 2
           } -> (known after apply)
       }
   
   Plan: 0 to add, 1 to change, 0 to destroy.

   ~ means change in place. The line zones = 2 -> 3 shows the old value, an arrow, and the new one. Only what you changed is planned: the two unchanged values are hidden.

   You don’t need to apply this. The point was to see how Terraform describes a change.

7. Clean-up step: Clean up

   TerminalCopy

   terraform destroy

   Part	What it means
   terraform destroy	plan the removal of everything this folder built, and carry it out once you type yes

   It shows a plan full of - lines and asks. Type yes:

   You should see

   Plan: 0 to add, 0 to change, 1 to destroy.
   
   Do you really want to destroy all resources?
     Terraform will destroy all your managed infrastructure, as shown above.
     There is no undo. Only 'yes' will be accepted to confirm.
   
     Enter a value: yes
   
   terraform_data.environment: Destroying... [id=2af1f034-bd2c-4555-3989-3189330c5de7]
   terraform_data.environment: Destruction complete after 0s
   
   Destroy complete! Resources: 1 destroyed.

   Nothing existed outside your laptop, so nothing else needs cleaning up. You can delete the quickcart-hello folder, or keep it to experiment with.