Terraform Architecture

Let's think about this for a second

Configuration (your `.tf` files) is where you write the desired state — 'here's what I want my infrastructure to look like' — using HCL. State (the `terraform.tfstate` file) is a database Terraform itself keeps to track 'what I've already created' — every time Terraform runs, it compares the state against the configuration and decides what needs to change. Provider (`aws`, `azurerm`, `google`, `kubernetes`, etc.) is the plugin that translates your Terraform configuration into actual API calls (AWS API, Azure API) — without a provider, Terraform can't connect to any service at all.

Let's connect this to a real scenario

Say your configuration says 'I want one AWS EC2 server' — Terraform checks the state file (does the server already exist?), and if not, it sends a 'create this server' request through the AWS provider to the AWS API, then records in the state file that 'this server has been created.' The next time you run `terraform apply`, since it's already in the state, Terraform won't create it again (idempotent).

Configuration (.tf) = the desired state, written in HCL
State (terraform.tfstate) = a database Terraform itself keeps of 'what has been created'
Provider = the plugin that turns configuration into actual API calls

Let's look at an example

text

Terraform Core Concepts
=========================

.tf files (Configuration)
  "I want 1 server, 1 database" — desired state, written in HCL

terraform.tfstate (State)
  "Here's what actually exists right now" — Terraform's own record

Provider (e.g. aws, azurerm, google)
  Translates configuration into real API calls to the cloud

apply = compare Configuration vs State -> make API calls to close the gap

You should see

Be able to explain how Configuration, State, and Provider relate to each other.

5-minute try-it

Think about why the state file matters (what could go wrong if it were lost), and write 2 lines about it.

A quick word of caution

The state file can contain not just resource IDs but also passwords/secrets in plain text — never commit the state file to a git repository (we'll cover remote state in a later chapter).