Articles about Terraform from the ConsultorIA blog: cloud, applied AI and security in production.
Formatting and validation are free, static analysis is nearly free, policy on the plan is cheap, and real apply-and-destroy tests are expensive and slow. Spend accordingly, and know what each layer cannot catch.
The two failures are a module that wraps one resource and adds nothing, and a module that does everything and nobody dares change. A minimal interface, safe defaults and honest versioning are what separate them.
A plan is a thousand lines of diff in a terminal. The questions you actually want answered — what does this cost, what does it expose, what breaks if it fails — are not in that format. Here is how we made Skyline answer them from the code alone.
Loops, types and tests come free with a general-purpose language. What you give up is a plan a non-programmer can review, and a low floor for the people who have to maintain it at three in the morning.
The licence change matters differently to an end user, a software vendor and a consultancy. Compatibility is high and diverging, migration is cheap and returning is not. Here is the decision framework without the partisanship.
A pipeline runs when someone triggers it. A controller reconciles continuously, which fixes drift by construction. What you pay is another control plane to operate and a harder debugging story.
Most multi-account designs fail because nobody agreed what an account is for. Here is the account map we deploy, what lives in each one, and the three guardrails that make it hold.
Terraform creates the machine, Ansible decides what is on it. Where the boundary belongs, why provisioners are a trap, and what changes when your estate is mostly containers.
An agent with cloud credentials is the most useful and most dangerous automation you can build. The pattern that works is investigation with a read-only role and change as a reviewed plan.
Most Terraform pain is not HCL. It is one enormous state file, applies from laptops and three years of manual console changes nobody imported. Here is how we untangle it.
In GCP the project is the blast radius and the folder is where policy lives. Most estates we see have neither used deliberately. Here is the structure we deploy and the eight policies we set on day one.
The google provider has behaviours that will surprise you the first time — authoritative IAM resources that wipe bindings, projects that will not delete, APIs that must be enabled before anything works. Here is the setup we use.
The Cloud Adoption Framework reference architecture is large and most teams deploy a fraction of it. Here is the subset that carries the weight: management groups, subscription boundaries and the policies that hold it together.
Bicep is better at Azure than Terraform in several specific ways, and worse in several others. The right answer depends on whether Azure is your only cloud and who maintains the code.
Oracle ships a managed Terraform service that removes the backend and the runner. Here is when it is the right call, when to run your own pipeline, and the OCI-specific things that catch people.