Post

Let's talk about Terraform/OpenTofu - the tools that promised to revolutionize infrastructure management but instead gave us a masterclass in why "declarative" doesn't mean "predictable." After 10+ years in the trenches, here are the real issues nobody talks about.

Your tfstate is simultaneously the most critical and most fragile part of your entire infrastructure. One corrupted state file and you're manually rebuilding production at 2 AM while explaining to executives why "Infrastructure as Code" just broke everything that was working fine.

Then there's the Plan vs Apply Russian Roulette. terraform plan cheerfully shows you'll create 5 resources. terraform apply somehow destroys half your infrastructure and creates 3 resources you never asked for.

The gap between plan and reality is where careers go to die, and we've all learned to hold our breath during every apply.

Provider inconsistency is another nightmare. Each cloud provider implements Terraform differently. AWS provider works one way, Azure has its own special interpretation, GCP throws curveballs. "Multi-cloud" they promised. "Consistent experience" they said.

What we got was learning three different flavors of the same broken abstraction. My personal favorite error: "Provider produced inconsistent final plan." This is Terraform's way of saying "I have no idea what I'm doing, but it's definitely your fault.

" Hours of debugging later, you discover it's a known provider bug from 2019 that's still not fixed, but somehow it's your configuration that's wrong.

The Import Circus deserves special mention. Need to import existing infrastructure? Hope you enjoy playing "guess the exact configuration that matches your existing resource." Get one attribute wrong? Start over.

No autocomplete, no hints, just pure archaeological guesswork until you match whatever the provider thinks that resource should look like.

But Here's The Real Issue: We're Using It Wrong Most Terraform disasters happen because we've bought into the myth that everything must be "Infrastructure as Code." This is like using a hammer for every job because someone told you "everything is a nail."

Here's what Terraform/OpenTofu is actually good at: Core Infrastructure - VPCs, subnets, security groups, load balancers. The foundational stuff that changes rarely and has clear dependencies.

Stateful Resources - Databases, storage buckets, DNS zones. Things you absolutely need to recreate identically if disaster strikes. Foundation Layer - IAM roles, policies, networking backbone. The plumbing that everything else depends on.

Where you should stop fighting the tool: Application Deployments - Use proper deployment tools like Helm or Nomad. Terraform doesn't understand application lifecycles.

Configuration Management - Use Ansible, Salt, or good old bash scripts. Don't try to manage application configs through infrastructure tools. Secrets Management - Use dedicated secret stores, not Terraform state files. Your database passwords have no business being in a state file.

Frequent Changes - If it changes daily, weekly, or even monthly, it probably shouldn't be in Terraform. The overhead isn't worth it.