Terraform & IaC

init installs plugins, modules, and the backend into .terraform; safe teamwork needs remote state, locking, isolation, modules, and CI-gated applies.

CloudFormation is AWS-native with managed state and automatic rollback; Terraform is multi-cloud with a plugin ecosystem and self-managed state.

CloudFormation turns a YAML/JSON template into a managed Stack, with Change Sets to preview, Drift Detection to catch manual edits, StackSets for multi-account rollout, and SAM as serverless shorthand.

`UPDATE_ROLLBACK_FAILED` means the update failed AND the automatic undo also failed: you must fix or skip the offending resource, then run `continue-update-rollback`.

Terraform turns infrastructure into a version-controlled blueprint, and plan shows you the diff before apply makes it real.

Restore deleted state from S3 versioning or backup, or rebuild it with terraform import; for a half-finished apply, inspect state and re-run apply, using targeted apply and import to fix only the inconsistent resources.

-replace destroys and recreates a managed resource, import adopts an unmanaged one into state, and modules share data by wiring outputs into inputs or reading terraform_remote_state across configurations.

Import fills state, not config: you still hand-write accurate HCL until terraform plan shows zero drift.

Upgrade in small reviewed steps and read the plan like a hawk: a -/+ line means destroy-then-create, which for stateful resources is downtime or data loss.

Read the plan, know which attributes are immutable, pin versions, review in PRs, and guard stateful resources with prevent_destroy: IaC is a controlled change process, not just plan and apply.

Publish modules with SemVer, pin consumers so prod never auto-takes latest, and treat any input/output rename, required state move, or version floor as a MAJOR breaking change.

Modules are reusable parameterized infrastructure blueprints, workspaces are named state copies, and the safest multi-environment layout composes shared modules from thin per-environment roots with separate state.

Terraform declares infrastructure, the state file maps config to real resources, and remote state with locking keeps a single shared, uncorrupted source of truth so concurrent applies cannot clash.