Skip to content

Terraform Workflows

Terraform follows a predictable, iterative workflow designed for consistency, safety, and collaboration.

Core Terraform Workflow

Terraform operates through three main steps:

  1. Write — Define infrastructure using code
  2. Plan — Preview changes before applying
  3. Apply — Provision reproducible infrastructure

Team Workflows — Individual Practitioner

I. Write

  1. Develop Terraform configuration locally
  2. Store code in a Git repository
  3. Use terraform plan and terraform validate for rapid feedback
  4. Tight edit → test → fix cycle

II. Plan

  1. Commit changes to your local Git repo
  2. Often use a single branch (e.g., main) for simplicity

III. Apply

  1. Run terraform apply locally, review the execution plan
  2. Approve and wait for provisioning
  3. Push commits to the remote Git repository after a successful apply

Team Workflows — Team-Based

I. Write

  1. Each engineer writes Terraform code locally
  2. Use separate Git branches per feature
  3. Smaller teams run terraform plan locally
  4. Larger teams rely on CI/CD pipelines to avoid distributing credentials
  5. Maintain fast local testing cycles when possible

II. Plan

  1. Open a Pull Request
  2. CI/CD generates and discards an execution plan for PR review

III. Apply

  1. Approve → Merge → CI/CD performs apply

Challenges:

  • CI/CD pipeline complexity
  • State management coordination
  • Different access controls for plan and apply
  • Secrets handling
  • Multi-environment management

Team Workflows — Terraform Cloud

I. Write

  1. Terraform Cloud is used as the remote backend
  2. Input variables stored securely in Terraform Cloud
  3. Built-in VCS (GitHub/GitLab/Bitbucket) integration for CI/CD
  4. Developers write code normally using branches

II. Plan

  1. PR opened → Terraform Cloud automatically generates the execution plan

III. Apply

  1. Approve PR → Merge → Terraform Cloud performs apply
  2. Team members can manually confirm applies when required

Advantages:

  • Simplifies CI/CD setup
  • Secure credentials & sensitive variable management
  • Easy audit logs and run history

Terraform Troubleshooting

Error types

  • Language → syntax errors for the terraform/hcl language (terraform fmt, validate)
  • State → resource drift (refresh, apply, -replace)
  • Core → internal bugs of the core library (TF_LOG)
  • Provider → API changes or edge cases (TF_LOG)

Debugging

Terraform has detailed logs which can be enabled by setting the TF_LOG environment variable (TRACE, DEBUG, INFO, WARN, ERROR, JSON - same as TRACE or higher, and uses parseable JSON encoding as the formatting).

Logging can be enabled separately (same values) for:

  • TF_LOG_CORE
  • TF_LOG_PROVIDER

TF_LOG_PATH environment variable can be used to log to a specific file.

Crash Log

If terraform ever crashes (a "panic" in the Go runtime), it saves a log file with the debug logs from the session as well as the panic message and backtrace to crash.log. This log file is meant to be parssed along to the Terraform developers via a GitHub issue.