IBM HashiCorp Terraform

Why HashiCorp Terraform?

Infrastructure as code is the automation decision that changes who can answer the question “what is actually running”: a console where somebody has to look, or a repository where the answer is written down and versioned. Everything else — modules, providers, policy — is downstream of that shift.

Manual infrastructure provisioning is bottleneck. Point-and-click consoles don’t scale. Configuration drift between environments. No version control for infrastructure. Each cloud has different tools.

HashiCorp Terraform is industry-standard Infrastructure as Code. Declarative configuration - describe what you want, Terraform builds it. 3000+ providers - one language for all platforms. State management - Terraform knows what exists. Policy as Code - enforce standards automatically.

What matters for security is that describing infrastructure as code lets you review a change before it reaches production — at the cost of one new object to protect, the state file. We develop this below.

How does it work?

Declarative Config

Desired state approach:

• HCL syntax (HashiCorp Configuration Language)
• Define what, not how
• Idempotent execution
• Plan before apply
• Version control friendly

Providers

Universal infrastructure:

• AWS, Azure, GCP
• Kubernetes
• SaaS (Datadog, PagerDuty)
• Databases, DNS
• Custom providers

State Management

Infrastructure tracking:

• Current state storage
• Drift detection
• Remote state (S3, Consul)
• State locking
• Team collaboration

Main features

Core Workflow

1. Write - Define infrastructure in HCL
2. Plan - Preview changes
3. Apply - Execute changes
4. Destroy - Clean up

Modules

• Reusable components
• Public registry
• Private modules
• Versioning
• Composition

Workspaces

• Environment isolation
• Dev/staging/prod
• Variable sets
• State separation
• RBAC

Policy as Code

• Sentinel (HashiCorp)
• OPA (Open Policy Agent)
• Pre-apply checks
• Compliance enforcement
• Cost controls

Terraform vs Alternatives

Feature	Terraform	CloudFormation	ARM
Multi-cloud	Yes	AWS only	Azure only
Providers	3000+	AWS	Azure
State	Explicit	Managed	Managed
Language	HCL	JSON/YAML	JSON
Community	Huge	Limited	Limited

Deployment Options

Open Source:

• Full IaC capabilities
• CLI-based
• Community support
• Self-managed state

Terraform Cloud:

• Remote execution
• VCS integration
• RBAC
• Free tier available

Terraform Enterprise:

• Self-hosted
• Air-gapped support
• Audit logging
• Enterprise support

Use Cases

Multi-Cloud Infrastructure:

• AWS + Azure + GCP
• Consistent workflow
• Unified state

Kubernetes Platforms:

• Cluster provisioning
• Helm releases
• RBAC configuration

GitOps Workflow:

• Git as source of truth
• PR-based changes
• Automated apply

Ephemeral Environments:

• Spin up for testing
• Exact production clone
• Auto-destroy

For whom?

• DevOps engineers automating infrastructure
• Platform teams building internal platforms
• Cloud architects designing multi-cloud
• SRE teams managing production

Benefits

For DevOps: Automation-first, version control, repeatable deployments

For Security: Policy as Code, drift detection, audit trail

For Business: Faster provisioning, reduced errors, cost optimization

Specifications

Language	HCL (HashiCorp Configuration Language)
Providers	3000+
State	Local, Remote (S3, Consul, TFC)
Policy	Sentinel, OPA

State file and policy as code

Describing infrastructure as code gives security two things it usually lacks: repeatability and the ability to review a change before it happens. It also introduces one specific new object to protect.

• The state file holds sensitive data. It records the actual state of resources, including values marked as sensitive. Kept in a code repository or an unprotected bucket, it becomes a ready-made credential set.
• Policy as code. Rules rejecting a publicly exposed resource or an unencrypted disk act before the environment is created, not after an audit.
• Drift detection. A difference between code and reality means a change made by hand, outside the process. Sometimes that is an outage workaround, sometimes a trace of an incident.
• Deployment pipeline privileges. An account able to create any cloud resource is as valuable as an administrator account — and as rarely reviewed.

We verify cloud environment configuration as part of cloud security audit.

FAQ

Is Terraform free? Open source version yes. Terraform Cloud has free tier. Enterprise is paid.

What is state? Terraform’s knowledge of what exists. Compares desired state with current state.

How does remote state work? State stored in S3, GCS, Terraform Cloud. Locking prevents conflicts.

What is drift? Difference between state and actual infrastructure. Terraform detects and can remediate.

How to use with existing infrastructure? terraform import - import existing resources. Data sources for read-only access.

What is a module? Reusable Terraform configuration. Like a function. DRY principle for infrastructure.

What does CI/CD integration look like? GitHub Actions, GitLab CI, Jenkins. Plan on PR, apply on merge.

What is Sentinel? HashiCorp’s Policy as Code. Enforce rules before apply. “No public S3 buckets”.

How does Terraform Cloud differ? Remote execution, state management, VCS integration, collaboration features.

What does support look like? HashiCorp/IBM support. nFlo offers Terraform workshops, module development and best practices.