Glossary

136 terms from Terraform, in plain words, each with the chapter that teaches it.

Search the glossary

#

(known after apply): What a plan prints for a value that doesn't exist until the object is created, such as a new ID.
-auto-approve: An `apply` option that skips the `yes` prompt on a fresh plan. Use it only where someone has already reviewed the plan.
-generate-config-out: A `terraform plan` option that writes the resource block for an `import` block into a file you then review. The file must not already exist, and the feature is experimental.
-target: An option that plans only one resource. Terraform warns it is not for routine use, since it skips the rest of your configuration.
-var-file: Command-line options for setting input variables. `-var-file=prod.tfvars` loads values from a file, and `-var 'env=prod'` sets one value directly.
.gitignore: A file that tells Git which files never to save. Kettle & Crane's lists state files, saved plans and secrets.tfvars so secrets stay out of Git.
.terraform.lock.hcl: A file written by `terraform init` that records the exact provider versions and checksums chosen. You commit it to Git so everyone on the team uses the same providers.
.tfvars file: A file of variable values, such as `connection_limit = 50` in prod.tfvars. `terraform.tfvars` and `*.auto.tfvars` load automatically; other files are loaded with `-var-file`.

A

Access key: A secret ID and key pair that proves who you are to your cloud account. Keep it out of `.tf` files and delete it when no longer needed.
Amazon Web Services: The cloud service where Kettle & Crane's product images will live. Resources there cost money, so practice sessions end with `terraform destroy`.
API: The set of requests a service accepts from programs rather than people. Terraform providers use each service's API to create and change things.
Apply: Making the changes shown in a plan. `terraform apply` shows the plan and asks for `yes` first, unless you apply a saved plan.
Argument: A `name = value` setting inside a block, such as `length = 2` in a `random_pet` resource.
Attribute: A value about a resource that the provider or service fills in after creation, such as `id`. Until then a plan shows it as `(known after apply)`.
AWS CLI: Amazon's command-line tool. `aws login` or `aws configure` stores credentials where the Terraform AWS provider finds them, so no keys go in your files; the `AWS_PROFILE` environment variable picks a named set if you have several.

B

Backend: The place where Terraform keeps state. The local backend is a file in your folder; a remote backend, such as `pg` or `s3`, is shared storage a team can use.
Block: The basic HCL building unit: a type, optional quoted labels, and a body in curly braces holding arguments. `resource "local_file" "welcome" { ... }` is one.
Bootstrap: A tiny separate configuration that creates what the main one needs first, such as the `tfstate` database or the state bucket, because the place holding state must exist before it can be used.
Bucket: An S3 container for files (objects), such as Kettle & Crane's product images. Its name must be unique across all AWS accounts.
BUSL: The license HashiCorp moved Terraform to in August 2023. It forbids using the code in products that compete with HashiCorp, but running Terraform for your own systems is still allowed.

C

check block: A block that tests something about the whole configuration and only prints a warning when it fails. Kettle & Crane uses one to warn when someone runs in the `default` workspace.
Child module: A module that the root module calls, such as shop-db.
Click-ops: Setting up infrastructure by clicking through web pages. It's hard to repeat or review, since nobody remembers every setting chosen.
Condition: An expression like `var.env == "prod" ? 50 : 5` that picks one of two values. The same word names the true/false test inside a validation, precondition or assert.
Configuration: All the `.tf` files in one folder, which Terraform reads together as a single description of your infrastructure.
Configuration drift: When real infrastructure slowly stops matching what your configuration says, for example after someone deletes the shop database by hand. Terraform shows it in the next plan.
Container: A sealed box that runs a program apart from the rest of your computer. Docker runs the practice PostgreSQL server this way.
count: An older way to make several copies of a resource, numbered from 0 with addresses like `local_file.note[0]`. Removing a middle item shifts the rest, so it suits only identical copies or `count = var.enabled ? 1 : 0` switches.
create_before_destroy: A `lifecycle` setting that builds the replacement first and then removes the old object, shown as `+/-`. It only works when two copies can exist at once.
Credentials: The secret details that prove who you are to a service, such as an AWS access key.

D

data source: A `data` block that reads an object that already exists, such as Jo's `menu.txt`, without creating, changing or deleting it. You read it as `data.TYPE.NAME.ATTRIBUTE`.
Declarative: Describing the result you want (the desired state) instead of the steps to get there. Terraform works out whether to create, change or do nothing.
default workspace: The workspace that every Terraform working folder starts in, named `default`. Using it for named environments is risky because resource names built from `terraform.workspace` would come out like `shop_default`.
Dependency graph: The order Terraform works out from references and `depends_on`. Things that don't depend on each other are created at the same time.
depends_on: An argument listing resource addresses that must be created first, for when one thing must wait for another without referring to it. Use it rarely, since a reference shows why.
DNS: The system that turns a name like kettleandcrane.com into a server's address.
docker exec: A Docker command that runs a command inside an already running container. For example, `docker exec kc-pg psql -U postgres -l` runs `psql` inside the `kc-pg` container to list its databases.

E

each.key / each.value: The current item inside `for_each`. For a map, `each.key` is its key and `each.value` its value; for a set, both are the same.
Environment: One complete copy of your system for one purpose: dev for Sam's experiments, staging for a last check, and prod for the live shop.
Environment variable: A named value your terminal hands to every program it runs, such as `PGPASSWORD`, used to keep secrets out of files.
Ephemeral: A value that exists only while one command runs and is never saved to state or plans. An ephemeral resource produces such a value.
expect_failures: A setting in a test `run` block that lists checks which should fail, so the test passes only when bad input is rejected.

F

for_each: An argument that creates one copy of a resource or module per item of a set or map, with addresses like `local_file.cafe["bloom"]`. Removing one item touches only that copy.
force-unlock: A command that removes a stuck state lock left by a crashed run, using the lock ID from the error. Make sure no one is running first.
force_destroy: An S3 bucket setting that lets `terraform destroy` delete the bucket even when it holds files. Use it only on practice buckets.
Fork: A separate project started from a copy of another's code. OpenTofu is a fork of Terraform's last MPL version.
Function: A built-in operation, such as `lower()` or `join()`, called with values in brackets and giving back a result.

G

Git: A tool that records every version of your files, so changes can be reviewed and history kept. Secrets committed to it stay in its history.

H

HashiCorp: The company that makes Terraform.
HCL: The language Terraform files are written in; they end in `.tf` and are made of blocks and arguments.
HCP Terraform: HashiCorp's hosted service for running Terraform, which can also keep state and run Sentinel policies.
Homebrew: A package installer for macOS used to install Terraform and OpenTofu.
Host addresses (127.0.0.1, localhost): `localhost` and `127.0.0.1` mean your own computer. Publishing the database port as `127.0.0.1:5432` keeps it reachable only from your machine.

I

IAM: The AWS service that manages users, access keys and permissions.
ignore_changes: A `lifecycle` setting listing arguments Terraform should stop comparing, for when a person or tool is expected to change them.
Implicit dependency: A dependency that comes from one resource referring to another, so Terraform creates the referenced one first.
Import: Bringing an existing, hand-made object, like `legacy_reports`, under Terraform's management by recording it in state. An `import` block with `to` and `id` does it with a plan to review.
Infrastructure: Everything a program needs to run: servers, databases, file storage, networks and DNS.
Infrastructure as code (IaC): Describing infrastructure in text files that can be kept in Git, reviewed and rerun to build the same setup every time.
Init: `terraform init` prepares a folder by downloading providers and modules and setting up the backend. `-upgrade` moves to newer allowed provider versions and `-migrate-state` copies state into a new backend.
Input variable: A value set from outside a configuration and read as `var.name`, so one set of files can build dev and prod. It has a type, optional default and description.

J

JSON: A common text format of names and values. The state file and `terraform show -json` output use it.

K

Key provider / method: In OpenTofu state encryption, a key provider turns a passphrase into a key and a method (like AES-GCM, a standard cipher) encrypts with it.

L

lifecycle: A block inside a resource holding rules for how Terraform treats it, such as `prevent_destroy`, `create_before_destroy`, `ignore_changes` and conditions.
List: An ordered collection of values written in square brackets, like `["sam", "jo"]`.
Local value: A named expression defined in a `locals` block and read as `local.name`, so you don't repeat it.
local_sensitive_file: A resource from the `local` provider that works like `local_file` but hides its content in plans and makes the file readable only by its owner. It suits files that hold secrets, such as `.env` files with passwords.

M

Map: A collection of named values, like `{ bloom = "Portland" }`, where each name is a key.
Mock provider: A pretend provider that makes up values like IDs, so tests can run without a real server.
Module: A folder of `.tf` files that can be called as a reusable unit, like shop-db, which bundles a database, owner role and password.
moved block: A block telling Terraform that an object has a new address, so renaming a resource doesn't destroy and rebuild it.
MPL: The open-source license Terraform used until August 2023, and the one OpenTofu uses.

N

Namespace: The first part of a provider's source address, saying who publishes it, such as `cyrilgdn` in `cyrilgdn/postgresql`.

O

Object: A collection type holding a fixed group of named values of different types, such as `object({ name = string, size = number })`. In S3, an object is a stored file.
Open Policy Agent (OPA): A general tool for checking rules written as code, which can check `terraform show -json` output.
OpenTofu: The open-source fork of Terraform run by the Linux Foundation. It reads the same files and uses the same commands, with `tofu` in place of `terraform`.
Output: A value a configuration prints after apply or a module passes back to its caller. `terraform output -raw NAME` prints one value without quotes.

P

PATH: The list of folders your terminal searches for programs. Terraform must be in one of them to run.
pg backend: A backend that keeps state in PostgreSQL. It reads its connection address from the `PG_CONN_STR` environment variable, such as `postgres://postgres@localhost/tfstate?sslmode=disable`.
PGPASSWORD: The environment variable holding the PostgreSQL password, read by the provider and by `psql`.
Plan: The list of changes Terraform would make, shown before it changes anything. Symbols like `+`, `-`, `~` and `-/+` show create, destroy, update and replace.
Plan symbols (+, -, ~, -/+, +/-, <=): Marks in a plan: `+` create, `-` destroy, `~` update in place, `-/+` destroy then create, `+/-` create then destroy, and `<=` read a data source.
Policy as code: Writing team rules, such as "no public buckets", as checks that every change must pass.
PostgreSQL: A free database server, used here to store Kettle & Crane's shop data and as a practice target for Terraform.
Precondition / postcondition: Checks in a `lifecycle` block that run before or after a resource changes; failing stops the run. Inside a postcondition, `self` means the resource itself.
prevent_destroy: A `lifecycle` setting that makes any plan that would destroy the resource fail, protecting things like the shop database.
Provider: A plugin that talks to one service's API, such as AWS, PostgreSQL or the local file system. A `provider` block holds its settings, such as the PostgreSQL provider's `host` and `sslmode` (`disable` turns off encryption, fine for a local practice server).
psql: PostgreSQL's command-line program, used to run commands like `DROP DATABASE` or list databases.

R

random provider: A provider that makes random values stored in state: `random_pet` a two-word name, `random_password` a password, and `random_id` a suffix to make names unique.
Reference: A name that points at a value, such as `random_pet.cafe.id`. References link resources and create dependencies.
Refresh: Terraform asking the provider what real objects look like now to update state before a plan. `-refresh-only` records outside changes without planning fixes.
Region: One of a cloud's separate groups of data centers, such as `us-west-2` in Oregon. Everything you create lives in one region.
Registry: A public catalog of providers and modules at registry.terraform.io.
removed block: A block that makes Terraform stop managing an object without destroying it, using `destroy = false`. `terraform state rm` does the same at once with no plan.
replace_triggered_by: A `lifecycle` argument that replaces a resource whenever another listed resource is replaced.
Replacement: Destroying an object and creating a new one, shown as `-/+` and `# forces replacement`. Replacing a database deletes its data.
required_version: A setting in the `terraform` block that constrains which Terraform versions may run the configuration, so older ones fail with a clear error.
Resource: A block describing one thing Terraform creates and manages, such as a database or file.
Resource address: A resource's name in Terraform, made of type and name, such as `postgresql_database.shop` or `module.db["shop"].postgresql_database.this`.
Resource type: What kind of thing a resource is, such as `local_file` or `random_pet`.
Role: A PostgreSQL user account. With `login = true`, programs can sign in with it.
Root module: The folder where you run Terraform commands. It calls child modules.
Rotate: Replacing a secret with a new one. With `password_wo`, you set a new value and raise `password_wo_version`.

S

S3: AWS's file storage service, where files live in named buckets. It can also hold Terraform state.
s3 backend: A backend that keeps state in an S3 bucket, using `use_lockfile = true` for locking.
S3 public access block: A separate S3 resource whose four settings together keep a bucket private, so nobody on the internet can read it.
S3 versioning: A bucket setting that keeps old copies of each file; it is strongly recommended for the state bucket so an old state can be recovered.
Saved plan: A plan written to a file with `plan -out=tfplan`, so `apply tfplan` applies exactly what was reviewed. It fails as stale if state changed meanwhile, and may contain secrets, so never commit it.
Secret: Anything that lets someone in, such as a password, access key or token.
Secret manager: A service that stores secrets, such as AWS Secrets Manager or HashiCorp Vault, from which Terraform can receive them.
Sensitive: A marking that makes Terraform hide a value on screen. It is still stored in plain text in state.
Sentinel: HashiCorp's policy language, run by HCP Terraform against each plan.
Set: A collection of values with no order and no repeats. `toset()` converts a list so it can be used with `for_each`.
Source address: Where a provider comes from, written namespace/name such as `hashicorp/local`. A module's `source` is the path or registry address of its code.
State: Terraform's record, a JSON file, of which real object belongs to each block in your code. It can hold secrets in plain text, so protect it and never edit it by hand.
State locking: Stopping two runs from changing state at once: while one run works it holds a lock and others must wait.
String interpolation: Using `${ }` inside a string to insert a value, so `"the ${random_pet.cafe.id} café"` becomes `"the glad-arachnid café"`.

T

Tags: Labels on cloud resources, such as `project = "kc-shop"`, which help show on the AWS bill what Terraform made. A `default_tags` block in the AWS provider puts the same tags on every resource it creates.
Terminal: The window where you type commands: Terminal on macOS and Linux, PowerShell on Windows.
Terraform: A free command-line tool from HashiCorp that creates and changes infrastructure from files. It uses providers to talk to each service.
terraform console: A command that opens a `>` prompt where you can type expressions and functions and see their results using your variables.
terraform destroy: A command that removes everything the configuration created in the current state, after showing a plan and asking for `yes`.
terraform fmt: A command that rewrites your files in the standard layout. `-check` only lists badly laid out files, and `-recursive` includes subfolders.
terraform state list / show: Commands that read state: `state list` prints every resource address, and `state show ADDR` prints one resource's attributes.
terraform test: A command that runs `.tftest.hcl` files, where each `run` block plans or applies with set inputs and checks the results with assertions.
terraform validate: A command that checks the configuration makes sense: references exist and values have the right types. It needs `init` first and contacts no server.
terraform.workspace: An expression giving the name of the current workspace, used to build names like `shop_dev`.
terraform_data: A resource built into Terraform that needs no provider and creates nothing outside Terraform. Its `triggers_replace` argument forces replacement when the value changes; older code uses `null_resource` from the null provider for the same job.
Test: A `.tftest.hcl` file in a `tests/` folder made of `run` blocks, each planning or applying with set inputs and checking `assert` conditions, run by `terraform test`.
TF_LOG: An environment variable which, set to `DEBUG`, makes Terraform print what it is doing when a problem is hard to find.
TF_VAR_NAME: An environment variable named `TF_VAR_` plus a variable's name, which sets that input variable, for example `TF_VAR_env`.

U

use_lockfile: An S3 backend setting that turns on locking by writing a small `.tflock` file next to the state while Terraform works. It replaces the older DynamoDB table (`dynamodb_table`) approach, now deprecated.

V

Validation: A rule on an input variable that rejects bad values before anything changes and prints your own error message, such as requiring `env` to be dev, staging or prod.
Version constraint: A rule for allowed versions: `= 2.9.1` exactly, `>= 2.9` or newer, and `~> 2.9` meaning 2.9 or newer but below 3.0. Pinning fixes versions so every run matches.

W

Workspace: A named state for the same configuration, so dev and prod can come from the same files without sharing state. Every folder starts in one called `default`.
Write-only argument: An argument sent to the provider but never stored in state, such as `password_wo`. Terraform can't tell if it changed, so you raise `password_wo_version` to resend it.