Infrastructure as Code on AWS with Terraform

Every resource you create by clicking through the AWS console is a resource that exists in no version control system, has no review history, and can't be reproduced in a new account. Infrastructure as Code (IaC) fixes all three.

Why Terraform

Terraform is cloud-agnostic, declarative, and has the largest provider ecosystem. You describe the desired state; Terraform figures out the diff and applies it.

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "private" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

State is the hard part

Terraform stores state — a JSON snapshot of your infrastructure. Store it remotely (S3 + DynamoDB locking), never in git, and never let two people apply the same state concurrently.

terraform {
  backend "s3" {
    bucket         = "my-tf-state"
    key            = "prod/terraform.tfstate"
    region         = "ap-south-1"
    dynamodb_table = "tf-locks"
    encrypt        = true
  }
}

Workspaces for environments

Use workspaces or separate state files per environment. Never let prod and staging share state — a typo in a variable can destroy production resources.

Review infrastructure like code

Because your infra is code, it can go through pull requests. A teammate reviews the plan output (terraform plan) before it's applied. This catches mistakes the console never would.

The payoff

When your infrastructure is code, spinning up a replica environment takes minutes. Recovering from a region outage means re-running a pipeline, not remembering which checkboxes you clicked two years ago.

Treat infrastructure with the same rigor as application code, and your ops life gets dramatically calmer.