Infrastructure as Code

Terraform Learning Roadmap

Terraform is the most widely used Infrastructure as Code tool — it lets you define cloud infrastructure (servers, databases, networking, DNS) in code and apply it reproducibly across environments. Used by Airbnb, Shopify, Twitch, and thousands of companies to manage AWS, GCP, and Azure infrastructure. If you want to do DevOps, cloud engineering, or platform engineering seriously, Terraform is non-negotiable.

Total time

2–4 months

Stages

5 stages

Job-ready at

Stage 3

Career paths

2 paths

Before you start — Prerequisites

✓

Cloud fundamentals (AWS, GCP, or Azure)

Terraform manages cloud resources — you need to understand what you're creating (EC2, S3, VPCs) before writing code that creates them.

✓

Linux command line

Terraform runs from the CLI — you need comfort with terminal commands, file paths, and environment variables.

✓

Basic networking (VPC, subnets, security groups)

Most Terraform configurations provision networking resources. Understanding what a VPC and security group are prevents confusion.

Stage 1: HCL & Core Concepts

HashiCorp Configuration Language basics

1–2 weeks

Topics to cover

HCL syntax: blocks, arguments, expressionsproviders: configure AWS, GCP, or Azureresource blocks: create cloud resourcesdata sources: reference existing resourcesvariables: input with type and defaultoutputs: expose values after applylocals: intermediate computed valuesterraform init, plan, apply, destroy.terraform.lock.hcl and version pinningterraform fmt and terraform validate

Bold = especially important

Milestone

You write HCL that creates real cloud resources — variables, outputs, data sources — and use the CLI workflow confidently.

Project to build

AWS static website

Terraform creates S3 bucket, bucket policy for public read, uploads index.html via aws_s3_object, outputs the website URL — variables for bucket name and region.

Stage 2: State & Expressions

State management and HCL expressions

1–2 weeks

Topics to cover

terraform.tfstate: what it contains and why it mattersRemote state: S3 backend with DynamoDB lockingterraform state list, show, mv, rmcount and for_each for resource repetitionConditional expressions: condition ? a : bFunctions: toset(), merge(), lookup(), flatten()String interpolation and heredocSensitive values and masking in outputterraform import for existing resourcesLifecycle rules: create_before_destroy, prevent_destroy

Bold = especially important

Milestone

You store state remotely in S3, use for_each to create multiple resources, and manipulate state safely with CLI commands.

Project to build

Multi-environment S3 buckets

for_each creates dev/staging/prod buckets from a map, remote state in S3 + DynamoDB, sensitive output for access key, lifecycle prevent_destroy.

Stage 3: Networking & Compute

✓ Min. Job Ready

VPC, EC2, and RDS with Terraform

2–3 weeks

Topics to cover

VPC with public and private subnetsInternet Gateway and NAT GatewayRoute tables and associationsSecurity groups: ingress and egress rulesEC2 instances with user_data bootstrap scriptsApplication Load Balancer with target groupsRDS PostgreSQL in a private subnetSecrets Manager for RDS passwordIAM roles and instance profilesSSH key pairs and key management

Bold = especially important

Milestone

You provision a production-style 3-tier architecture (ALB → EC2 → RDS) entirely in Terraform with a proper VPC.

Project to build

3-tier web app infra

VPC with public/private subnets, ALB in public, EC2 in private with NAT, RDS PostgreSQL in private, security groups restricting traffic flow.

Stage 4: Modules & Reusability

DRY infrastructure with modules

2–3 weeks

Topics to cover

Module structure: main.tf, variables.tf, outputs.tfCalling modules: source, version, and input variablesModule outputs as inputs to other modulesTerraform Registry: official and community modulesVersioning modules with Git tagsModule composition: root module wires child modulesterraform-aws-modules/vpc, eks, rdsTesting modules with TerratestModule design principles: single responsibilityWorkspaces for environment separation

Bold = especially important

Milestone

You extract common infrastructure patterns into reusable modules and compose them in a root module for multiple environments.

Project to build

VPC + EKS module

Reusable VPC module and EKS cluster module, root module calls both with environment variables, dev and prod workspaces with different instance sizes.

Stage 5: CI/CD & Team Workflows

Automating infrastructure changes safely

2–3 weeks

Topics to cover

Atlantis: PR-based plan and apply workflowTerraform Cloud / HCP TerraformGitHub Actions: terraform plan on PR, apply on mergeOIDC authentication from GitHub Actions to AWStfsec and Checkov for security scanninginfracost for cost estimation on PRsSentinel or OPA for policy as codeDrift detection and auto-remediationState migration between backendsTerraform upgrade strategies

Bold = especially important

Milestone

You implement a GitOps workflow where every PR shows a plan and merge triggers apply — with security scanning and OIDC auth.

Project to build

GitOps Terraform pipeline

GitHub Actions: plan on PR with tfsec scan, apply on merge to main, OIDC auth (no AWS keys), remote state, Slack notification on apply.

What to learn next with Terraform

Skills that pair directly with Terraform in job postings

AWS

AWS is the most common Terraform target — deep AWS knowledge makes you a better Terraform user

Kubernetes

Terraform provisions EKS/GKE clusters — Terraform + K8s is the standard cloud-native stack

Docker

Understand what Terraform is deploying — container images and registries

Git

Terraform code lives in Git — GitOps workflows trigger plans and applies on PRs

Bash

Bash scripts are often used alongside Terraform for bootstrapping and automation

Career paths that use Terraform

DevOps Engineer Cloud Architect

Frequently asked questions

Terraform vs AWS CDK vs CloudFormation — which should I learn?

Terraform is cloud-agnostic (works with AWS, GCP, Azure, and 1000+ providers) and has the largest community — learn it first. CloudFormation is AWS-specific and verbose (YAML/JSON) but integrates natively with AWS. AWS CDK lets you write TypeScript/Python instead of YAML, generating CloudFormation. For multi-cloud or portability, Terraform. For AWS-only with strong AWS integration, CloudFormation or CDK. Terraform dominates DevOps job postings.

What is Terraform state and why is it important?

Terraform state is a JSON file (terraform.tfstate) that maps your configuration to real cloud resources. It tracks what Terraform created so it knows what to update or destroy. Without state, Terraform can't know what already exists. Always store state remotely (S3 + DynamoDB for AWS) in team environments — never commit local state to git. State corruption can cause Terraform to recreate or destroy infrastructure unexpectedly.

What is the difference between terraform plan and terraform apply?

`terraform plan` shows what Terraform WOULD do — it reads current state and compares to your configuration, showing adds/changes/destroys. `terraform apply` executes the plan. Always run plan first and review the output carefully before applying. In CI/CD, plan is run on PRs (for review) and apply runs after merge. Never skip plan in production.

What are Terraform modules?

Modules are reusable packages of Terraform configuration — like functions in programming. Instead of copy-pasting the same VPC + subnet + security group blocks across environments, you write a VPC module once and call it with different variables. Public modules on the Terraform Registry (registry.terraform.io) cover common patterns: VPC, EKS cluster, RDS. Writing and consuming modules is Stage 4 of this roadmap.

How do teams collaborate with Terraform?

Remote state storage (S3 + DynamoDB for AWS) prevents concurrent conflicts. Terraform Cloud or Atlantis run plans and applies in CI with PR-based workflow. State locking (DynamoDB) prevents simultaneous applies from corrupting state. Workspaces separate environments (dev/staging/prod). Sentinel or OPA policies enforce governance rules. Stage 5 of this roadmap covers the full team workflow.

Ready to start learning?

Browse our curated Terraform resources — every course, book, and video ranked by quality.

View Terraform Resources →