Terraform & IaC Vocabulary

In Terraform, terraform plan computes the difference between your declared configuration (desired state) and the recorded state (current reality), then shows exactly which resources will be created, updated, or destroyed — without changing anything. terraform apply takes that execution plan and actually carries it out against the providers' APIs, then updates the state file. This two-step workflow lets you review and approve infrastructure changes before they happen, a core safety feature of Infrastructure as Code. Plans can be saved and applied later to guarantee what runs matches what was reviewed.

Terraform state is the record (by default terraform.tfstate) that maps the resources defined in your configuration to the actual objects provisioned in the real world, storing their IDs and attributes. Terraform consults state to know what already exists so it can compute minimal changes. Because state can contain sensitive values and must be shared by a team, it is usually kept in a remote backend (S3, Terraform Cloud) with locking to prevent concurrent modifications. Corrupting or losing state can desynchronize Terraform from reality, so it is handled carefully.

A module is a reusable, self-contained package of Terraform configuration — a set of resources grouped together and exposed through input variables and outputs. Every configuration has a root module, and it can call child modules to encapsulate and reuse patterns (e.g. a "VPC" module instantiated in several environments). Modules promote DRY infrastructure code, consistency, and abstraction. They can be sourced locally, from Git, or from the Terraform Registry, and versioned so consumers pin to a known-good release.

Drift occurs when the actual state of infrastructure no longer matches what Terraform's state file records — typically because someone changed a resource manually in the cloud console or another tool modified it outside Terraform. On the next plan or with terraform refresh, Terraform detects the discrepancy and proposes changes to reconcile reality back to the configuration. Drift undermines the single-source-of-truth model of IaC, so teams discourage manual changes and may run automated drift detection to catch and correct it early.

A provider is a plugin that lets Terraform manage a specific platform — AWS, Azure, GCP, Kubernetes — by translating Terraform resource declarations into that platform's API calls. Providers are declared in the configuration and downloaded during terraform init. A workspace is a named, isolated instance of state for a single configuration, allowing you to manage multiple distinct deployments (for example dev and staging) from the same code without their states colliding. Each workspace tracks its own resources independently.