What Is Terraform? Configuration, State, Plan, and Apply

Terraform is an infrastructure-as-code tool: write configuration describing resources, review a plan, and apply the approved changes through provider APIs. Its state connects configuration addresses to the infrastructure it manages.

The workflow is shared across providers, but AWS and Google Cloud resources are not interchangeable. A storage bucket, IAM policy, and network each retain the rules of their cloud platform. HashiCorp's Terraform introduction explains the configuration, provider, and lifecycle model.

The parts you need to understand

Install Terraform through the official instructions and authenticate the target provider separately. A Terraform backend login is not the same as AWS credentials.

A small private S3 example

Create a dedicated exercise directory and save main.tf:

COPY
terraform {
  required_version = ">= 1.5.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "files" {
  bucket_prefix = "terraform-intro-"
  tags = {
    Environment = "learning"
  }
}

resource "aws_s3_bucket_public_access_block" "files" {
  bucket                  = aws_s3_bucket.files.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

output "bucket_name" {
  value = aws_s3_bucket.files.id
}

The provider chooses a unique suffix for the bucket prefix. No account-specific AMI, default VPC, or SSH setup is required. This is a configuration example, not a recorded cloud deployment. Storage and API usage can incur charges.

Review before applying

COPY
terraform init
terraform fmt -check
terraform validate
terraform plan -out=exercise.tfplan

Confirm your AWS identity and region and read the plan. If it matches your intention, terraform apply exercise.tfplan applies that saved plan. Keep plan files private: they can include configuration values and secrets. Commit .terraform.lock.hcl so the provider selection is reproducible; do not commit state files or local credentials.

A normal plan refreshes tracked resources, so it can reveal changes made outside Terraform. It does not automatically adopt unrelated infrastructure. Importing an existing resource requires explicit ownership and configuration decisions.

State, cleanup, and next steps

Protect state with an appropriate backend and access controls. Sensitive values can remain in state even when terminal output is redacted. Choose locking and recovery practices before multiple people or CI systems manage the same environment.

Review a destroy plan only for this exercise configuration. A nonempty bucket may block deletion; inspect its data rather than enabling forced deletion casually. Destroy does not delete every resource in an account, and removing a local directory does not clean up cloud infrastructure.

Continue with GCP instance schedules in Terraform. For a TypeScript-based workflow, compare Pulumi's small storage exercises and the AWS CDK learning path.