Terraform is a safe and efficient open-source tool for building, changing, and versioning infrastructure safely and efficiently.

10 common gotchas in terraform

State File Is Critical
- Losing or corrupting your terraform.tfstate file can break your infrastructure management.

always back up your state file

terraform { backend “s3” { bucket = “my-tf-state” key = “state.tfstate” region = “us-east-1” } }

1
2
3
4
5
6
7

2. **Manual Changes to Managed Resources**
- Changing resources outside Terraform can cause drift and unexpected results.

```hcl
# avoid manually editing resources in the cloud provider console
# use 'terraform apply' to make changes

Provider Version Pinning

Not pinning provider versions can lead to breaking changes when providers update.

1
2
3
4
5
6
7
8
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

Sensitive Data in State
- Secrets and sensitive data may be stored in plain text in state files.
1
resource "aws_db_instance" "example" {

…

 password = var.db_password # This will be stored in state

}

1
2
3
4
5
6

5. **Resource Name Changes**
- Renaming resources in code can cause Terraform to destroy and recreate them.

```hcl
# renaming 'aws_instance.web' to 'aws_instance.web_server' will destroy and recreate

Implicit Dependencies
- Terraform may not know the correct order for resources unless you use depends_on.
1 2
resource "aws_instance" "app" { depends_on = [aws_db_instance.example]

…

}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

7. **Destroy Before Create**
- Some changes force Terraform to destroy a resource before creating a new one, causing downtime.

```hcl
# changing immutable fields (like ami id) may force replacement
resource "aws_instance" "example" {
  ami = "ami-123456"
}
# changing to a new ami will destroy and recreate the instance

Variable Defaults and Overrides
- Be careful with variable precedence; defaults can be overridden in unexpected ways.
1 2 3
variable "region" { default = "us-east-1" }

can be overridden by cli: terraform apply -var=“region=us-west-2”

1
2
3
4
5
6

9. **Plan vs. Apply Differences**
- The plan may differ from what is actually applied if the environment changes between commands.

```hcl
# always run 'terraform plan' immediately before 'terraform apply'

Resource Addressing
- Changing resource addresses (e.g., renaming modules) can orphan resources or cause errors.

renaming module or resource can break state association

use ’terraform state mv’ to move resources safely

```

These should be kept in mind to avoid common pitfalls when working with Terraform!

terraform gotchas: 10 common pitfalls and how to avoid them

Getting started with Terraform and avoiding common mistakes.