Infrastructure as code: managing cloud resources with Terraform

In short: Infrastructure as code means servers, databases, networks and DNS records are described in code and versioned, instead of being clicked together in a web console. With Terraform or its open-source fork OpenTofu, your cloud environment becomes reproducible, traceable and reviewable. It pays off as soon as you have more than one environment or more than one person working on the infrastructure.

The problem with clicked-together infrastructure

Many projects start with a server created in the hosting provider's console. Later come a database, a load balancer, some firewall rules and a staging environment. A year on, nobody remembers which setting was changed and why, and staging differs from production in ways no one can explain.

Infrastructure as code fixes this by putting the desired state in files. Changes go through Git, get reviewed in a pull request and stay traceable. A new environment is built from the same code, not from a colleague's memory.

How Terraform works

Describe the target state

In Terraform you use the HCL language to describe what should exist: three servers of this size, a managed PostgreSQL database, these DNS records. Terraform handles how they get created, through providers. There are providers for the big clouds as well as for Hetzner, IONOS, Cloudflare, GitHub and many other services.

Plan and apply

terraform plan compares the code with reality and shows what would change. Only terraform apply makes the changes. That in-between step is where the safety comes from: you see in advance that a change would recreate the database, and you can stop it.

State

Terraform keeps a state file that maps real resources to your code. This file is critical. It belongs in remote storage with locking, such as an S3-compatible bucket or Terraform Cloud, so two people cannot run changes at the same time. Because state can contain passwords and other secrets in plain text, it must be encrypted and access-restricted.

Terraform or OpenTofu?

In 2023, HashiCorp moved Terraform to the Business Source License. OpenTofu was created in response as an open-source fork under the Linux Foundation. The two are largely compatible and use the same providers. For most companies managing their own infrastructure, the license change has no practical effect. If an open license matters to you, or you build a product on top of the tool, choose OpenTofu. Alternatives such as Pulumi let you write infrastructure in TypeScript or Python, which can suit teams without HCL experience.

Practical rules for a clean setup

Modules for anything repeated

Recurring building blocks, such as a web server with firewall and monitoring, are wrapped in a module. Staging and production use the same module with different parameters, so the environments stay structurally identical.

Changes only through the pipeline

If everyone can run apply locally, things drift fast. A better pattern: the plan is generated automatically and posted on the pull request, and the pipeline applies it after merge. Our post on CI/CD pipelines for web applications shows how this fits into deployment.

Detect drift

Manual changes in the console make code and reality diverge. A scheduled, automated plan reveals that drift before it surprises you during the next change.

Record location and cost in code

Region and data center are stated explicitly in code. That makes it verifiable that personal data stays in the EU, a topic we cover in our post on data hosting in Germany. Consistent tags on every resource also help with cost control, as described in our cloud cost optimization strategies.

Frequently asked questions (FAQ)

Is Terraform worth it for small projects?

Usually yes, once there is a second environment or a second person. For a single server without staging the benefit is smaller, but having the setup documented as code is often worth the modest effort on its own.

Can we bring existing infrastructure under Terraform?

Yes. With import blocks you pull existing resources into state. It takes some care, because the code must then match reality exactly, but it is very doable and a common way to start.

What happens if the state file is lost?

The resources keep running, but Terraform no longer knows what it manages, and you would have to import everything again. That is why state belongs in versioned, backed-up remote storage.

Does Terraform replace tools like Ansible or Docker?

No, they complement each other. Terraform creates infrastructure, Docker packages your application, and tools like Ansible configure software on servers where needed. Many modern setups get by with Terraform plus containers.

Conclusion

Infrastructure as code turns knowledge that lives in people's heads into reviewable code, which makes infrastructure transferable and safe to change. Start with one environment, a remote state and a pipeline that makes every plan visible. If you want to build a web application on well-managed infrastructure, talk to us about web development.