Sunday, 14 September 2025

Mastering Terraform CI/CD Integration: Automating Infrastructure Deployments (Part 10)

Standard

So far, we’ve run Terraform manually: init, plan, and apply. That works fine for learning or small projects, but in real-world teams you need automation:

  • Infrastructure changes go through version control
  • Every change is reviewed before deployment
  • Terraform runs automatically in CI/CD pipelines

This is where Terraform and CI/CD fit together perfectly.

Why CI/CD for Terraform?

  • Consistency → Every change follows the same workflow
  • Collaboration → Code reviews catch mistakes before they reach production
  • Automation → No more manual terraform apply on laptops
  • Security → Restrict who can approve and apply changes

Typical Terraform Workflow in CI/CD

  1. Developer pushes code → Terraform configs to GitHub/GitLab
  2. CI pipeline runs → terraform fmt, validate, and plan
  3. Reviewers approve → Pull Request reviewed and merged
  4. CD pipeline runs → terraform apply in staging/production

Example: GitHub Actions Workflow

A simple CI/CD pipeline using GitHub Actions:

name: Terraform CI/CD

on:
  pull_request:
    branches: [ "main" ]
  push:
    branches: [ "main" ]

jobs:
  terraform:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2

      - name: Terraform Format
        run: terraform fmt -check

      - name: Terraform Init
        run: terraform init

      - name: Terraform Validate
        run: terraform validate

      - name: Terraform Plan
        run: terraform plan

Here’s the flow:

  • On pull requests, Terraform runs checks and plan
  • On main branch push, you can extend this to run apply

Example: GitLab CI/CD

stages:
  - validate
  - plan
  - apply

validate:
  stage: validate
  script:
    - terraform init
    - terraform validate

plan:
  stage: plan
  script:
    - terraform plan -out=tfplan
  artifacts:
    paths:
      - tfplan

apply:
  stage: apply
  script:
    - terraform apply -auto-approve tfplan
  when: manual

Notice that apply is manual → requires approval before execution.

Best Practices for Terraform CI/CD

  1. Separate stages → validate, plan, apply.
  2. Require approval for terraform apply (especially in production).
  3. Store state remotely (S3, Terraform Cloud, or Azure Storage).
  4. Use workspaces or separate pipelines for dev, staging, and prod.
  5. Scan for security → run tools like tfsec or Checkov.

Case Study: Enterprise DevOps Team

A large enterprise adopted Terraform CI/CD:

  • Every change went through pull requests
  • Automated pipelines ran plan on PRs
  • Senior engineers approved apply in production

Impact:

  • Faster delivery cycles
  • Zero manual runs on laptops
  • Full audit history of infrastructure changes

Key Takeaways

  • Terraform + CI/CD = safe, automated, and auditable infrastructure deployments
  • Always separate plan and apply steps
  • Enforce approvals for production
  • Use security scanners for compliance

End of Beginner Series: Mastering Teraform 🎉

We’ve now covered:

  1. Basics of Terraform
  2. First Project
  3. Variables & Outputs
  4. Providers & Multiple Resources
  5. State Management
  6. Modules
  7. Workspaces & Environments
  8. Provisioners & Data Sources
  9. Best Practices & Pitfalls
  10. CI/CD Integration

With these 10 blogs, you can confidently go from Terraform beginner → production-ready workflows.

Bibliography