Terraform Architecture, Internals, AWS and GCP
Module 4: An end-to-end field guide for intermediate-to-senior platform, infrastructure and cloud engineers.
Terraform is most useful when an engineer understands more than resource syntax. This module explains the execution graph, resource identity and state, cloud provider APIs, HCL design, safe refactoring, IAM, security policy, CI and partial-failure recovery. AWS and Google Cloud examples are parallel but preserve important provider differences.
Public engineering examples
Cloud names, service IDs and incidents in this guide are illustrative. They are not reports of a particular employer's infrastructure. Version-specific provider resource schemas, Terraform language features and cloud service support should be checked against the deployed versions.
Prerequisites
- Basic infrastructure-as-code, Git and command-line usage.
- Familiarity with cloud networking, IAM and Kubernetes concepts.
- Read-only cloud access or a disposable AWS/GCP sandbox for exercises.
- Prior experience reading Terraform plans is helpful but not required.
Learning objectives
By completing the guide, you should be able to:
- Explain Terraform Core, provider plugins, state and the complete plan/apply lifecycle.
- Reason about graph dependencies, unknown values, replacements and partial success.
- Design maintainable typed HCL and reusable versioned modules.
- Operate secure state backends and safely coordinate concurrent writers.
- Provision AWS and GCP foundations with provider-appropriate networking and IAM.
- Refactor/import resources without unintended recreation.
- Diagnose drift, API errors, provider incompatibility and state recovery scenarios.
- Build a secure Terraform PR pipeline with tests, policy checks and cost review.
- Design low-friction but governable infrastructure self-service for product teams.
Chapters
- Terraform fundamentals and execution architecture
HCL, provider plugins, backend state, init/plan/apply, declarative versus imperative operations. - Dependency graph and apply internals
Ordering, unknown values, parallelism, replacement and partial failure. - HCL expressions and resource identity
Variables, collections, data sources, for_each/count, dynamic and lifecycle. - State, backends and locking
S3/GCS, concurrency, sensitive state and state recovery. - Providers, modules and multi-environment architecture
Aliases, root/child configuration, versioning, accounts/projects and workspaces. - Terraform on AWS
VPC, subnets, NAT, IAM trust, EKS and database lifecycle. - Terraform on Google Cloud
Global VPC, Pod secondary ranges, Cloud NAT, IAM ownership, GKE and federation. - Import, refactoring and state migration
Import, moved, removed, module moves and cross-state handoffs. - Drift, failures and disaster recovery
Lifecycle ownership, partial apply, refresh-only, state recovery. - Security, secrets and policy
OIDC federation, provider trust, plan-time checks and cost governance. - CI/CD, Atlantis, GitOps and testing
PR plans, approval, two different locks, test and apply safety. - Enterprise Terraform platform and incident response
Platform APIs, ownership, risk and production network recovery.
technical learning and practice
Recommended learning sequence
Start with Q1-Q4 to understand Terraform's execution and state model. Study Q5 before using Q6-Q7 provider-specific examples. Then work through lifecycle and safe change topics in Q8-Q11. Finish with the lead-level system design in Q12, execute the labs in a sandbox and rehearse the follow-up bank aloud.