Terraform Professional key terms

An integer meta-argument that creates a fixed number of instances of a resource or module, each addressed by a numeric index. Changing the number shifts indices, which can cause Terraform to replace objects unexpectedly.

A meta-argument that creates one instance per element of a map or set of strings, addressing each instance by key rather than by index, so removing one element destroys only that instance.

A block that generates repeated nested configuration blocks from a collection using for_each and a content block. It is an authoring convenience only and cannot produce top-level arguments or meta-arguments.

A nested block controlling how Terraform creates and destroys an object, offering settings such as create_before_destroy, prevent_destroy, ignore_changes, replace_triggered_by, and the condition checks.

Custom assertions placed in a resource's lifecycle block. Preconditions are evaluated before an object is created or updated, postconditions after. A failed assertion stops the operation with an error.

A validation block inside an input variable that tests the supplied value with a condition expression and error_message, rejecting invalid input during plan or apply instead of failing later in the run.

A top-level block that asserts conditions on every plan and apply, including for objects that are not changing. Failures are reported as warnings and do not block the rest of the run.

A configuration block that records a renamed resource or module address, telling Terraform to treat the existing object as the new address rather than planning to destroy and recreate it.

Terraform's record of which real infrastructure objects it manages and their last known attribute values, stored as JSON. It maps configuration addresses to the identifiers used by remote APIs.

A backend that keeps state in a shared remote system such as an object store or HCP Terraform, so several engineers and pipelines operate against the same state rather than local copies.

A mechanism where the backend takes an exclusive lock for the duration of an operation, preventing two applies from writing state at the same time. Most remote backends enable it by default.

A declarative block giving the remote identifier and target address of an existing object, so Terraform adopts it during a normal plan and apply instead of using the older imperative import command.

CLI commands that edit state directly. The mv form reassigns an object to a different address, while the rm form drops an object from state without destroying the real infrastructure.

The gap between attributes recorded in the state file and the actual attributes of the live object, revealed when Terraform refreshes resources before producing a plan.

A data source that reads output values from another configuration's state through its backend, letting separate configurations share results without copying or exposing the whole state.

Leaving the backend block empty or partly filled and passing the missing settings at init time with -backend-config, keeping environment-specific values such as bucket names out of version control.

A block that instantiates a child module, specifying where its code lives, optionally which versions are allowed, and the input variable values the child should receive.

The location string in a module block identifying where module code comes from, such as a local path, the public registry, a private registry, a Git or HTTP URL, or an object bucket.

A version argument in a module block that limits which published releases Terraform may install. It has no effect on modules sourced from local paths, Git, or plain URLs.

The root module is the configuration in the working directory that Terraform runs against. Child modules are any modules that root configuration calls, each with its own inputs, outputs, and resources.

A versioned, VCS-connected catalog of modules inside HCP Terraform or Terraform Enterprise that lets teams publish, discover, and pin approved modules by semantic version.

An isolated environment in HCP Terraform or Terraform Enterprise holding one configuration, its state, variables, run history, and access settings, usually mapping to one Terraform working directory.

A run started automatically when new commits reach the branch connected to a workspace, with Terraform executing remotely after the version control provider notifies HCP Terraform of the change.

A link that queues a run in a second workspace after a run in the source workspace finishes successfully, commonly used to chain infrastructure and application configurations in order.

A named group of Terraform and environment variables applied to many workspaces at once, optionally scoped by project or limited to specific workspaces, reducing duplicated configuration.

A run started from a local Terraform CLI but executed remotely in HCP Terraform, configured through a cloud block that names the organization and target workspace and requires terraform login.

A plan-only run triggered by a pull request or API call that shows what a change would do without applying it, typically used to review impact before merging code.

A terraform block section that declares each provider's local name, registry source address, and version constraint, telling Terraform where to download it and which releases are acceptable.

The .terraform.lock.hcl file that records the exact provider versions and package checksums selected for a configuration, so every machine installs identical provider builds.

A command that rewrites the dependency lock file to include checksums for specified platforms, so a configuration locked on one operating system also verifies on another.

A named additional configuration of the same provider, letting one module use several regions, accounts, or endpoints at once. Resources select a configuration through the provider argument.

A terraform block setting that constrains which Terraform CLI core versions may run the configuration, protecting it from features or behaviours introduced or removed in other releases.

An init flag that ignores versions already recorded and selects the newest provider and module releases permitted by the declared constraints, then rewrites the lock file.

An input variable flagged with sensitive so its value is redacted in plan output and CLI logs. The value still exists in plain text inside the state file.

A resource whose results exist only for the duration of a single operation and are never written to state or plan files, useful for short-lived credentials and connection tokens.

HashiCorp's policy-as-code framework used in HCP Terraform and Terraform Enterprise to evaluate plans against rules, with enforcement levels of advisory, soft-mandatory, and hard-mandatory.

A policy written in Rego for the Open Policy Agent engine, which HCP Terraform can evaluate against plans as an alternative to Sentinel for enforcing organizational rules.

The native testing framework that runs .tftest.hcl files, executing plan or apply commands against temporary state and asserting outcomes with condition expressions in run blocks.

A test-only construct that replaces a real provider with generated fake data during terraform test runs, allowing plans and applies to be verified without credentials or real infrastructure.

A terraform block configuration that encrypts state and plan files at rest using a chosen method and key provider, protecting stored attribute values if a backend bucket is exposed.