Terraform

What manual infrastructure management actually costs, why declarative beats procedural for provisioning, where Terraform sits relative to configuration management, and the two-part architecture that explains most of its behaviour.

The two blocks every configuration starts with, why pinning provider versions is not optional, how resource references build the dependency graph for free, and the lifecycle meta-arguments that control replacement.

The four plan symbols and which two should stop you, why 'forces replacement' is the most important string in the output, the graph and parallelism, and the difference between applying a saved plan file and using auto-approve.

All eight variable types including the structural ones, why declaring a type prevents a class of silent coercion bugs, validation blocks, and the assignment precedence order that decides which value actually wins.

The three constructs that stop a configuration repeating itself: named expressions, return values, and read-only lookups of infrastructure you do not manage — plus why you should never compute a value you could reference.

Conditional expressions, the built-in function library you actually reach for, heredoc strings, externalising policy files, and rendering templates with variables and loops.

How to create many resources from one block, why choosing count over for_each is the most common self-inflicted outage in Terraform, migrating between them safely, and when generating nested blocks stops being worth it.

The four reasons Terraform cannot work by reading the world on every run, what state actually contains, why it holds your secrets in plain text, and the inspection commands that tell you what Terraform believes.

Why local state stops working the moment a second person appears, the backend options and their locking mechanisms, partial configuration for keeping secrets out of the repo, and migrating an existing project without losing anything.

Bringing hand-built infrastructure under management, moving resources between projects without destroying them, detecting out-of-band changes, and why Terraform has no rollback command.

Packaging resources into reusable units, module inputs and outputs as a public interface, sourcing from registries and Git, why pinning with a ref tag is not optional, and how deep to nest before it stops paying.

How Terraform actually treats files and folders, the four ways to model dev/staging/prod and when each breaks down, and why splitting state along team boundaries is an organisational decision more than a technical one.

Multiple state instances from one configuration directory, referencing the active workspace in code, the delete command that removes state but not infrastructure, and the point at which workspaces stop scaling.

Why every source warns that provisioners are a last resort, the structural reason behind it, creation-time versus destroy-time behaviour, and the three better alternatives ranked.

The three testing tiers and which tool serves each, static analysis that costs nothing, and the pipeline design whose single most important property is passing a reviewed plan file to apply.

Writing compliance rules that evaluate a plan before it applies, the two policy ecosystems, and turning drift detection and audit logging into continuous compliance rather than an annual scramble.

The three places secrets leak in a Terraform workflow and the three different fixes, why sensitive = true is not a secrets strategy, and locking down the state backend as the production-admin boundary it actually is.

Managing several providers from one configuration, connecting on-premises networks to cloud, provisioning Kubernetes clusters and serverless functions, and where to draw the line between infrastructure and application delivery.

Encoding disaster recovery and high availability as code, automating backups and failover, the cost levers Terraform can pull, and wiring alerting alongside the resource it watches.

What slows down large estates and the four levers that fix it, managing state size, and writing a custom provider when nothing exists for the API you need.

A triage order that works, the eight root-cause classes behind virtually every Terraform error, a grouped catalogue of the hundred most common failures, and the resolution patterns that fix most of them.

Build a complete modular three-tier stack — network, compute, load balancer, database, artifacts — with remote state and locking, then migrate it from local state to a remote backend without recreating anything.