Introduction
Terraform remains a dominant Infrastructure as Code tool for AWS workloads because it combines declarative configuration with broad provider coverage and operational workflows that reduce manual overhead. When Terraform runs locally or in a self-managed CI/CD pipeline, teams must provision remote state storage, locking mechanisms, execution runners, and credential management themselves. Terraform Cloud centralizes those operational concerns while the Terraform AWS Cloud Control Provider accelerates access to new AWS features through the Cloud Control API. Together they form a managed workflow for provisioning, securing, and governing AWS infrastructure as code.
Terraform with AWS Fundamentals
Terraform is a high-level configuration language for describing infrastructure declaratively.
Advantages of using Terraform for AWS include:
- Terraform is platform agnostic. You can use it with any cloud services provider. You can configure, test, and deploy infrastructure across AWS and many other cloud providers. If your organization uses multiple cloud providers, Terraform can be a single, unified, consistent solution to manage cloud infrastructure.
- Terraform is agentless. It doesn't require any software to be installed on the managed infrastructure.
- Terraform modules are a powerful way to reuse code and stick to the Don't Repeat Yourself principle. For example, you might have a specific configuration for an application which contains an Amazon Elastic Compute Cloud instance, Amazon Elastic Block Store volumes, and other resources that are logically grouped. If you need to create multiple copies of this configuration or application, you can package the resources into a Terraform module and create multiple instances of the module rather than copying the entire code multiple times. These modules can help you to organize, encapsulate, and reuse configurations.
Terraform's integration with AWS provides a powerful, scalable solution for managing infrastructure.
Key benefits are:
- Automation and Efficiency: By automating infrastructure provisioning, Terraform reduces manual work and errors.
- Scalability: Scaling your infrastructure up or down based on demand is straightforward.
- Version Control: Using IaC, you can track changes and revert to previous states if necessary.
To get started, you’ll need to set up credentials so Terraform can access your AWS account to create, update, and delete resources.
- Log in to your AWS Management Console.
- Go to Identity and Access Management.
- Create a new IAM user with programmatic access, which will give you an access key ID and a secret access key.
Pro Tip: Store your credentials securely.
Remote state storage is essential for team workflows.
terraform
terraform {
backend "s3" {
bucket = "my-terraform-state-bucket"
key = "state"
region = "us-east-1"
}
}
With the S3 backend, any changes to the infrastructure state will be saved and versioned automatically in the bucket.
It’s important not to hardcode sensitive data like database passwords or API keys into your Terraform files. AWS Secrets Manager can help here by securely storing secrets.
```terraform
data "awssecretsmanagersecretversion" "mysecret" {
secretid = "mysecretname"
}
resource "awsdbinstance" "mydatabase" {
other configuration...
password = data.awssecretsmanagersecretversion.mysecret.secret_string
}
```
In this example, Terraform retrieves the database password from Secrets Manager, keeping your sensitive data secure and out of the configuration files.
Terraform AWS Cloud Control Provider
Today, the AWS CC provider supports 950+ AWS resources and data sources, with more support being added as AWS service teams continue to adopt the Cloud Control API standard.
The Terraform AWS Cloud Control Provider was announced as generally available to enable customers to take advantage of AWS innovations faster.
AWS has been continually expanding its services to support virtually any cloud workload; supporting over 200 fully featured services and delighting customers through its rapid pace of innovation with over 3,400 significant new features in 2023. Our customers use Infrastructure as Code tools such as HashiCorp Terraform among others as a best-practice to provision and manage these AWS features and services as part of their cloud infrastructure at scale. With the Terraform AWS CC Provider launch, AWS customers using Terraform as their IaC tool can now benefit from faster time-to-market by building cloud infrastructure with the latest AWS innovations that are typically available on the Terraform AWS CC Provider on the day of launch.
For example, AWS customer Meta’s Oculus Studios was able to quickly leverage Amazon GameLift to support their game development.
As a Terraform practitioner, using the AWS CC Provider would feel familiar to the existing workflow. You can employ the configuration blocks shown below, while specifying your preferred region.
During Terraform plan or apply, the AWS CC Terraform provider interacts with AWS Cloud Control API to provision the resources by calling its consistent Create, Read, Update, Delete, or List APIs.
AWS Cloud Control API
AWS service teams own, publish, and maintain resources on the AWS CloudFormation Registry using a standardized resource model. This resource model uses uniform JSON schemas and provisioning logic that codifies the expected behavior and error handling associated with CRUD-L operations. This resource model enables AWS service teams to expose their service features in an easily discoverable, intuitive, and uniform format with standardized behavior. Launched in September 2021, AWS Cloud Control API exposes these resources through a set of five consistent CRUD-L operations without any additional work from service teams. Using Cloud Control API, developers can manage the lifecycle of hundreds of AWS and third-party resources with consistent resource-oriented API instead of using distinct service-specific APIs.
Table: Terraform AWS provider capabilities overview
| Capability | Local Terraform | Terraform Cloud | AWS CC Provider |
|---|---|---|---|
| Remote state management | Manual S3/DynamoDB | Built-in managed | Compatible |
| State locking | Manual DynamoDB | Built-in | Compatible |
| Execution | Self-hosted runners | HashiCorp infrastructure | Provider level |
| Feature adoption speed | Provider release cycle | Immediate via VCS runs | Day-of-launch via Cloud Control API |
| Resource coverage | Service specific APIs | Same as provider | 950+ resources and data sources |
Terraform Cloud for AWS Workflows
Running Terraform locally or in your own CI/CD pipeline works, but it comes with operational overhead - managing state storage, handling locking, setting up runners, and dealing with credentials. Terraform Cloud handles all of that for you. It provides remote state management, remote execution, VCS-driven workflows, and policy enforcement in a managed service.
This guide covers setting up Terraform Cloud for AWS infrastructure, from workspace creation to production workflows.
What Terraform Cloud Provides
Terraform Cloud replaces several things you'd otherwise manage yourself:
- Remote state storage - No need for S3 buckets and DynamoDB tables
- State locking - Built-in, no configuration needed
- Remote execution - Runs Terraform on HashiCorp's infrastructure
- VCS integration - Speculative plans on PRs, standard runs on merge
- Policy enforcement - Sentinel policies for governance
- Team management - Granular access control
- Cost estimation - Can show expected cost changes before apply
- Private registry - Share modules within your organization
The free tier supports up to 500 resources, which is enough for small to medium setups.
Setting Up Your Organization
Create a Terraform Cloud account at app.terraform.io and set up your organization.
```bash
Install the Terraform CLI (if not already installed)
brew install terraform
Login to Terraform Cloud
terraform login
```
This opens your browser to generate an API token.
Credential Management with Terraform Cloud and AWS
There are two approaches.
Environment Variables (Simple)
In the Terraform Cloud workspace settings, add environment variables.
- AWSACCESSKEY_ID = AKIAIOSFODNN7EXAMPLE (sensitive)
- AWSSECRETACCESS_KEY = wJalrXUtnFEMI/K7MDENG... (sensitive)
Dynamic Credentials with OIDC (Recommended)
Terraform Cloud supports OIDC federation with AWS, eliminating static credentials.
Set up the OIDC provider in AWS.
One-time setup in your AWS account
terraform
data "tls_certificate" "tfc" {
url = "https://app.terraform.io"
}
resource "aws_iam_openid_connect_provider" "tfc" {
url = "https://app.terraform.io"
client_id_list = ["aws.workload.identity"]
thumbprint_list = [data.tls_certificate.tfc.certificates[0].sha1_fingerprint]
}
resource "aws_iam_role" "tfc_role" {
name = "TerraformCloudRole"
assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [{
Effect = "Allow"
Principal = {
Federated = aws_iam_openid_connect_provider.tfc.arn
}
Action = "sts:AssumeRoleWithWebIdentity"
Condition = {
StringEquals = {
"app.terraform.io:aud" = "aws.workload.identity"
}
StringLike = {
"app.terraform.io:sub" = "organization:my-company:project:*:workspace:aws-*:run_phase:*"
}
}
}]
})
}
resource "aws_iam_role_policy_attachment" "tfc_admin" {
role = aws_iam_role.tfc_role.name
policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
}
Then configure the workspace to use dynamic credentials.
Operational Practices for Secure AWS Terraform
Setting up Terraform with AWS provides a powerful framework for efficiently managing cloud infrastructure as code. By following these practices—like using IAM roles for access, remote state storage, and securely managing sensitive data—you’ll establish a robust, scalable, and secure foundation for your infrastructure management. Now you’re ready to explore Terraform’s more advanced features to enhance your AWS setup even further!
Best practices include:
- Avoid hardcoding credentials in configuration files.
- Use IAM roles with least privilege for Terraform execution.
- Store state remotely with versioning enabled.
- Use Terraform Cloud for policy enforcement and team audit trails.
- Prefer OIDC federation over long-lived access keys.
- Retrieve secrets from AWS Secrets Manager rather than plaintext variables.
Table: Credential method comparison
| Method | Static keys | OIDC federation |
|---|---|---|
| Credential rotation | Manual | Automatic via token |
| Exposure risk | Higher if leaked | No long-lived secrets |
| Setup complexity | Low | Medium, one-time IAM role |
| Recommended for | Quick tests | Production Terraform Cloud |
Conclusion
Terraform Cloud with AWS combines managed operational control with accelerated feature access. Terraform Cloud eliminates the burden of state storage, locking, runners, and VCS integration while providing policy enforcement, cost estimation, and team management in a single service. The free tier supports up to 500 resources for small to medium setups, making adoption low risk.
The Terraform AWS Cloud Control Provider complements this by exposing 950+ AWS resources and data sources through the Cloud Control API, a standardized CRUD-L interface launched in September 2021. This enables day-of-launch availability for new AWS services, as demonstrated by Meta’s Oculus Studios leveraging Amazon GameLift quickly. With over 200 fully featured AWS services and over 3,400 significant new features in 2023 alone, the speed of adoption matters.
Together, platform agnostic Terraform modules, agentless execution, remote state with S3 backend or Terraform Cloud, and secure credential patterns using IAM programmatic access or OIDC federation create a durable foundation. Secrets are retrieved via AWS Secrets Manager to keep sensitive data out of configuration, and infrastructure changes remain versioned and auditable. The result is automation and efficiency, scalability on demand, and version control for AWS infrastructure at scale.