Terraform with AWS
Provision AWS resources through versioned Terraform configuration while keeping credentials, state and provider versions under explicit control.
Integration boundary
Use the AWS provider to translate Terraform resource declarations into authenticated AWS API operations, with state recording the resource identities Terraform manages.
Supported approaches
Local or CI execution
Run Terraform with an AWS identity supplied through the standard provider credential chain.
HCP Terraform dynamic credentials
Use workload identity federation to obtain short-lived AWS credentials for a workspace run.
Prerequisites
- An AWS account and deliberately scoped IAM role
- Terraform CLI or a managed Terraform runner
- A protected remote state backend for team use
- Pinned Terraform and AWS provider constraints
Implementation
Declare the provider
Set required provider source and version constraints; configure region without embedding credentials.
terraform init -upgrade
Select a credential flow
Prefer temporary role credentials or workload identity over static access keys.
Create and review a plan
Treat the plan as the proposed AWS change set and review destructive or replacement operations.
terraform plan -out=tfplan
Verification
Validate configuration
Check syntax and internal consistency.
terraform validate
Inspect caller identity
Confirm the AWS principal and account before applying.
aws sts get-caller-identity
Re-plan after apply
A no-change plan is one signal that declared configuration and observed resources converge.
Common failure modes
- Static credentials copied into configuration or state
- Concurrent state writes without locking
- Provider upgrades changing behaviour unexpectedly
- Applying to the wrong AWS account or region
Follow Terraform and Amazon Web Services failures and fixes
One useful weekly email with new error references, tools, integration notes and production lessons. No daily noise.