DevOps in Terraform: 6.1 Introduction: The Execution Model 54 6.1.1 How Terraform Works 55 6.1.2 The Licensing Split 56 6.2 Providers 56 6.2.1 Version Pinning 56 6.2.2 Aliases and Multi-Region, Multi-Account 57 6.2.3 Authentication 57 6.3 State 58 6.3.1 Why It Exists 58 6.3.2

Learning Objectives

By the end of this chapter, you will be able to:

1. Explain Terraforms execution model — providers, the dependency graph, state, and the plan/apply cycle — and why state is the concept everything else depends on.
2. Design a state architecture that segments blast radius appropriately and connects stacks without creating brittle coupling.
3. Write modules that are reusable, versioned, and appropriately scoped, avoiding the two common failure modes of too thin and too parameterized.
4. Apply the language features that determine whether a change is safe: for_each versus count, lifecycle rules, and the refactoring blocks.
5. Construct a CI/CD pipeline for Terraform with plan-on-pull-request, policy evaluation, federated credentials, and gated application.
6. Implement a multi-cloud operating model that standardizes governance without imposing a lowest-common-denominator abstraction.
7. Handle secrets correctly, understanding precisely why state is the problem and what mitigations exist.
8. Manage drift, imports, and refactoring on a live estate without destroying resources.
9. Assess the Terraform-versus-OpenTofu licensing question as it affects enterprise adoption.
10. Recognize the anti-patterns that cause most enterprise Terraform failures.