--- title: "Deploying Infrastructure with Terraform in CI/CD Pipelines" lang: "en" author: "Mohammad Abu Mattar" canonical: https://mkabumattar.com/post/deploying-infrastructure-with-terraform-in-ci-cd-pipelines --- ![Blog post image for Deploying Infrastructure with Terraform in CI/CD Pipelines - How to deploy infrastructure using Terraform in a CI/CD pipeline: where Terraform fits into DevOps workflows and how to build a GitHub Actions pipeline for Terraform automation.](/_astro/hero.NEjisJ89_1Sjdc2.webp) [Home](/)›[Blog](/blog)›[All Categories](/blog/categories)›[DevOps](/blog/categories/devops) Blog [Prev in DevOpsDatabase DevOps: Making PostgreSQL and MongoDB CI/CD Feel Natural](/blog/post/database-devops-ci-cd-postgresql-mongodb)[Next in DevOpsDeploying Serverless Applications with AWS SAM](/blog/post/deploying-serverless-applications-with-aws-sam) [DevOps](/blog/categories/devops)[Infrastructure as Code](/blog/categories/infrastructure-as-code)[CI/CD](/blog/categories/cicd)[Terraform](/blog/categories/terraform)[Cloud Automation](/blog/categories/cloud-automation) # Deploying Infrastructure with Terraform in CI/CD Pipelines [Mohammad Abu Mattar](/authors/mohammad-abu-mattar)Published: 22 Sept 202404 Mins read10 Mins listen [Markdown for AI(opens in a new tab)](/post/deploying-infrastructure-with-terraform-in-ci-cd-pipelines/index.md "Open the plain-Markdown version of this page, for pasting into an AI tool") TL;DR How to deploy infrastructure using Terraform in a CI/CD pipeline: where Terraform fits into DevOps workflows and how to build a GitHub Actions pipeline for Terraform automation. Series [Mastering Terraform](/series/mastering-terraform)1/6 [NextStreamlining GitHub Organization Management with Terraform](/blog/post/streamlining-github-organization-management-with-terraform) All posts in this series (6) Blog6 1. [Deploying Infrastructure with Terraform in CI/CD PipelinesYou are here](/blog/post/deploying-infrastructure-with-terraform-in-ci-cd-pipelines) 2. [Streamlining GitHub Organization Management with Terraform](/blog/post/streamlining-github-organization-management-with-terraform) 3. [Compliance as Code: Making Security Easier with Terraform and InSpec](/blog/post/compliance-as-code-nist-iso-27001-gdpr-terraform-inspec) 4. [Modular Terraform for Scalable Infrastructure as Code](/blog/post/modular-terraform-scalable-iac-guide) 5. [Building Resilient Systems: Immutable Infrastructure with Packer and Terraform](/blog/post/immutable-infrastructure-packer-terraform-guide) 6. [Testing Terraform: Static Analysis, Native Tests, and Terratest](/blog/post/terraform-testing-terratest-native-tests) ### Deploying Infrastructure with Terraform in CI/CD Pipelines Contents [Is Terraform good for CI/CD?](#is-terraform-good-for-cicd)[Benefits of Terraform in CI/CD](#benefits-of-terraform-in-cicd)[How do you deploy your infrastructure in CI/CD using Terraform?](#how-do-you-deploy-your-infrastructure-in-cicd-using-terraform)[Step 1: write your Terraform code](#step-1-write-your-terraform-code)[Step 2: store your code in version control](#step-2-store-your-code-in-version-control)[Step 3: automate the workflow with a CI/CD tool](#step-3-automate-the-workflow-with-a-cicd-tool)[Where does Terraform fit in DevOps?](#where-does-terraform-fit-in-devops)[Benefits in a DevOps workflow](#benefits-in-a-devops-workflow)[How do you create a CI/CD pipeline in GitHub Actions for Terraform?](#how-do-you-create-a-cicd-pipeline-in-github-actions-for-terraform)[Step 1: define a workflow](#step-1-define-a-workflow)[Step 2: add security and secrets](#step-2-add-security-and-secrets)[Step 3: trigger the pipeline](#step-3-trigger-the-pipeline)[Best practices for Terraform in CI/CD pipelines](#best-practices-for-terraform-in-cicd-pipelines)[1\. Use remote state storage](#1-use-remote-state-storage)[2\. Perform security and compliance checks](#2-perform-security-and-compliance-checks)[3\. Test infrastructure changes in staging](#3-test-infrastructure-changes-in-staging)[4\. Automate rollbacks](#4-automate-rollbacks)[Conclusion](#conclusion)[References](#references) In fast-paced DevOps environments, Infrastructure as Code (IaC) has become a cornerstone for managing and scaling infrastructure efficiently. **Terraform**, a leading open-source IaC tool, is widely adopted for its ability to automate infrastructure deployment across multiple cloud platforms. One question comes up again and again: _what’s the best way to deploy Terraform configurations using CI/CD pipelines?_ This post covers how Terraform fits into CI/CD workflows, how to deploy infrastructure using CI/CD pipelines, and the questions that come up when you integrate Terraform into your DevOps practices. ## [Is Terraform good for CI/CD?](#is-terraform-good-for-cicd) Yes. Terraform works well for CI/CD pipelines because it lets teams automate the entire infrastructure deployment lifecycle. It works with most CI/CD tools and supports reusable infrastructure modules. The primary benefit of using Terraform in CI/CD pipelines is **automation**. Whether you’re managing a multi-cloud environment or a single platform, Terraform keeps your infrastructure consistent, repeatable, and version-controlled. ### [Benefits of Terraform in CI/CD](#benefits-of-terraform-in-cicd) - **Consistency:** Every infrastructure change is recorded and can be repeated with precision. - **Scalability:** Terraform supports large-scale deployments, which suits cloud-native architectures. - **Flexibility:** It works across different cloud platforms (AWS, Azure, GCP), which means you don’t have to depend on provider-specific tools. - **Collaboration:** By storing your infrastructure code in Git repositories, teams can collaborate, review, and approve infrastructure changes through pull requests. **FAQ:** _Why is Terraform particularly well-suited for CI/CD?_ Terraform’s declarative syntax lets you define your infrastructure much like application code. Once it’s wired into CI/CD pipelines, you can deploy changes, enforce policy checks, and verify compliance without touching anything by hand. ## [How do you deploy your infrastructure in CI/CD using Terraform?](#how-do-you-deploy-your-infrastructure-in-cicd-using-terraform) Terraform’s design philosophy makes it relatively simple to deploy infrastructure using any CI/CD system. Here’s the general approach: ### [Step 1: write your Terraform code](#step-1-write-your-terraform-code) Begin by writing the Terraform code that describes the infrastructure. Whether it’s provisioning servers, databases, or networking components, you define the desired state of your environment. ### [Step 2: store your code in version control](#step-2-store-your-code-in-version-control) Next, store your Terraform configurations in a version control system like GitHub or GitLab. This enables collaboration and means changes to the infrastructure get reviewed and approved through pull requests. ### [Step 3: automate the workflow with a CI/CD tool](#step-3-automate-the-workflow-with-a-cicd-tool) Integrate a CI/CD tool such as Jenkins, GitLab CI, CircleCI, or GitHub Actions to automate the Terraform workflow. The CI/CD tool will perform the following tasks: - **Terraform Init:** Initialize the Terraform environment. - **Terraform Plan:** Show what changes will be made to the infrastructure. - **Terraform Apply:** Apply the changes and update the infrastructure. **FAQ:** _How do CI/CD tools manage state in Terraform?_ Terraform uses a **state file** to keep track of the current infrastructure. Terraform needs this state to know what actually exists versus what’s defined in code. Store the state file securely (e.g., using an S3 bucket or Terraform Cloud) so that CI/CD pipelines have access to the latest state during deployments. ## [Where does Terraform fit in DevOps?](#where-does-terraform-fit-in-devops) Terraform is a critical tool in the **DevOps toolkit** because it bridges the gap between infrastructure and development pipelines. It allows developers to treat infrastructure as code, enabling them to provision and manage infrastructure through automated, repeatable processes. ### [Benefits in a DevOps workflow](#benefits-in-a-devops-workflow) - **Continuous delivery:** Terraform works hand-in-hand with CI/CD pipelines, allowing for continuous delivery of infrastructure updates. - **Version control:** Infrastructure changes are tracked in the same version control system as application code, which makes rolling back to previous versions straightforward. - **Security and compliance:** Terraform lets you enforce security policies through automation, so your infrastructure meets compliance requirements. **FAQ:** _How does Terraform improve collaboration in DevOps?_ By integrating with CI/CD pipelines, Terraform enables teams to collaborate more effectively. Developers, operations, and security teams can review changes, apply policies, and confirm that infrastructure updates are safe and aligned with business needs, all without manual intervention. ## [How do you create a CI/CD pipeline in GitHub Actions for Terraform?](#how-do-you-create-a-cicd-pipeline-in-github-actions-for-terraform) One of the easiest ways to deploy Terraform using CI/CD is with **GitHub Actions**. GitHub Actions is a flexible CI/CD tool that allows you to automate workflows directly in your GitHub repository. Here’s a step-by-step guide to creating a CI/CD pipeline in GitHub Actions for Terraform: ### [Step 1: define a workflow](#step-1-define-a-workflow) In your GitHub repository, create a `.github/workflows/main.yml` file. This file defines the CI/CD pipeline. .github/workflows/main.yml ``` 1name: Terraform Deployment2 3on:4 push:5 branches:6 - main7 8jobs:9 terraform:10 runs-on: ubuntu-latest11 12 steps:13 - name: Checkout Code14 uses: actions/checkout@v215 16 - name: Set up Terraform17 uses: hashicorp/setup-terraform@v118 with:19 terraform_version: 1.0.020 21 - name: Terraform Init22 run: terraform init23 24 - name: Terraform Plan25 run: terraform plan26 27 - name: Terraform Apply28 run: terraform apply -auto-approve ``` ### [Step 2: add security and secrets](#step-2-add-security-and-secrets) In GitHub Actions, you’ll need to store sensitive data (like cloud provider credentials) securely using **GitHub Secrets**. That way your pipeline can authenticate with the cloud provider without exposing credentials in the code. ### [Step 3: trigger the pipeline](#step-3-trigger-the-pipeline) The pipeline is triggered whenever changes are pushed to the `main` branch, automating the entire Terraform workflow from initialization to applying changes. **FAQ:** _Why use GitHub Actions for Terraform?_ GitHub Actions is highly customizable and integrates natively with GitHub repositories, making it ideal for teams already using GitHub for source control. Its flexibility lets you build, test, and deploy infrastructure with Terraform in one automated flow. ## [Best practices for Terraform in CI/CD pipelines](#best-practices-for-terraform-in-cicd-pipelines) To get the most out of using Terraform in CI/CD pipelines, here are a few best practices to follow: ### [1\. Use remote state storage](#1-use-remote-state-storage) Store your Terraform state file in a remote backend (like an S3 bucket, Azure Blob, or Terraform Cloud) so CI/CD pipelines can always reach the latest state. Remote state storage also prevents issues from multiple users or pipelines modifying the infrastructure simultaneously. ### [2\. Perform security and compliance checks](#2-perform-security-and-compliance-checks) Use tools like **Checkov** or **TFLint** to scan your Terraform code for security vulnerabilities and best practices before applying it in production. ### [3\. Test infrastructure changes in staging](#3-test-infrastructure-changes-in-staging) Before applying any changes to production, deploy the infrastructure in a staging environment. That catches problems early in the development lifecycle. ### [4\. Automate rollbacks](#4-automate-rollbacks) Always include a rollback strategy in your CI/CD pipeline. If a deployment fails, your pipeline should automatically revert the infrastructure to the previous stable state. ### [Conclusion](#conclusion) Incorporating Terraform into your CI/CD pipeline is a solid choice for teams automating infrastructure deployments at scale. Whether you’re using GitHub Actions, Jenkins, or any other CI/CD platform, Terraform’s flexibility and cross-cloud support make it a strong fit for your DevOps stack. Follow the practices above and keep security and compliance checks in the pipeline, and you can deploy infrastructure changes faster and more reliably. ## [References](#references) 1. Terraform Documentation - HashiCorp, [https://www.terraform.io/docs](https://www.terraform.io/docs) 2. GitHub Actions Documentation, [https://docs.github.com/en/actions](https://docs.github.com/en/actions) 3. Terraform Best Practices - HashiCorp Learn, [https://learn.hashicorp.com/collections/terraform/best-practices](https://learn.hashicorp.com/collections/terraform/best-practices) 4. Using Terraform with CI/CD - HashiCorp Learn, [https://learn.hashicorp.com/tutorials/terraform/cicd-pipeline](https://learn.hashicorp.com/tutorials/terraform/cicd-pipeline) 5. Infrastructure as Code - AWS Whitepapers, [https://aws.amazon.com/whitepapers/?whitepapers-main.sort-by=item.additionalFields.sortDate&whitepapers-main.sort-order=desc&awsf.whitepapers-content-type=\*all&awsf.whitepapers-global-methodology=\*all&awsf.whitepapers-tech-category=tech-categories%23devops](https://aws.amazon.com/whitepapers/?whitepapers-main.sort-by=item.additionalFields.sortDate&whitepapers-main.sort-order=desc&awsf.whitepapers-content-type=*all&awsf.whitepapers-global-methodology=*all&awsf.whitepapers-tech-category=tech-categories%23devops) (Search for “Infrastructure as Code”) 6. Terraform State Management - HashiCorp, [https://www.terraform.io/docs/language/state/index.html](https://www.terraform.io/docs/language/state/index.html) 7. Checkov - Bridgecrew by Prisma Cloud, [https://www.checkov.io/](https://www.checkov.io/) 8. TFLint - Terraform Linter, [https://github.com/terraform-linters/tflint](https://github.com/terraform-linters/tflint) Was this useful? ## Tags [#Terraform](/blog/tags/terraform)[#CI/CD Pipelines](/blog/tags/cicd-pipelines)[#DevOps](/blog/tags/devops)[#GitHub Actions](/blog/tags/github-actions)[#Infrastructure as Code](/blog/tags/infrastructure-as-code)[#IaC](/blog/tags/iac)[#Automation](/blog/tags/automation)[#Cloud Deployment](/blog/tags/cloud-deployment)[#Continuous Delivery](/blog/tags/continuous-delivery)[#Version Control](/blog/tags/version-control) ## Share [Facebook](https://facebook.com/sharer/sharer.php?u=https%3A%2F%2Fmkabumattar.com%2Fblog%2Fpost%2Fdeploying-infrastructure-with-terraform-in-ci-cd-pipelines "Share on Facebook")[Twitter](https://twitter.com/intent/tweet/?text=Deploying%20Infrastructure%20with%20Terraform%20in%20CI%2FCD%20Pipelines&url=https%3A%2F%2Fmkabumattar.com%2Fblog%2Fpost%2Fdeploying-infrastructure-with-terraform-in-ci-cd-pipelines "Share on Twitter")[LinkedIn](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fmkabumattar.com%2Fblog%2Fpost%2Fdeploying-infrastructure-with-terraform-in-ci-cd-pipelines&title=Deploying%20Infrastructure%20with%20Terraform%20in%20CI%2FCD%20Pipelines&summary=How%20to%20deploy%20infrastructure%20using%20Terraform%20in%20a%20CI%2FCD%20pipeline%3A%20where%20Terraform%20fits%20into%20DevOps%20workflows%20and%20how%20to%20build%20a%20GitHub%20Actions%20pipeline%20for%20Terraform%20automation.&source=https://mkabumattar.com "Share on LinkedIn")[WhatsApp](https://wa.me/?text=Deploying%20Infrastructure%20with%20Terraform%20in%20CI%2FCD%20Pipelines%20https%3A%2F%2Fmkabumattar.com%2Fblog%2Fpost%2Fdeploying-infrastructure-with-terraform-in-ci-cd-pipelines "Share on WhatsApp")[Telegram](https://t.me/share/url?url=https%3A%2F%2Fmkabumattar.com%2Fblog%2Fpost%2Fdeploying-infrastructure-with-terraform-in-ci-cd-pipelines&text=Deploying%20Infrastructure%20with%20Terraform%20in%20CI%2FCD%20Pipelines "Share on Telegram")[Reddit](https://www.reddit.com/submit?url=https%3A%2F%2Fmkabumattar.com%2Fblog%2Fpost%2Fdeploying-infrastructure-with-terraform-in-ci-cd-pipelines&title=Deploying%20Infrastructure%20with%20Terraform%20in%20CI%2FCD%20Pipelines "Share on Reddit")[Hacker News](http://news.ycombinator.com/submitlink?u=https%3A%2F%2Fmkabumattar.com%2Fblog%2Fpost%2Fdeploying-infrastructure-with-terraform-in-ci-cd-pipelines&t=Deploying%20Infrastructure%20with%20Terraform%20in%20CI%2FCD%20Pipelines "Share on Hacker News")[Pinterest](https://pinterest.com/pin/create/button/?url=https%3A%2F%2Fmkabumattar.com%2Fblog%2Fpost%2Fdeploying-infrastructure-with-terraform-in-ci-cd-pipelines&media=&description=How%20to%20deploy%20infrastructure%20using%20Terraform%20in%20a%20CI%2FCD%20pipeline%3A%20where%20Terraform%20fits%20into%20DevOps%20workflows%20and%20how%20to%20build%20a%20GitHub%20Actions%20pipeline%20for%20Terraform%20automation. "Share on Pinterest")[Email]() ## Comments ## You might also enjoy More posts on similar topics [![Modular Terraform for Scalable Infrastructure as Code](/_astro/hero.kBsnpbcJ_1mG2Sh.webp)](/blog/post/modular-terraform-scalable-iac-guide) ## [Modular Terraform for Scalable Infrastructure as Code](/blog/post/modular-terraform-scalable-iac-guide) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [Infrastructure as Code](/blog/categories/infrastructure-as-code) - [Terraform](/blog/categories/terraform) - [DevOps](/blog/categories/devops) - [Cloud Engineering](/blog/categories/cloud-engineering) - [Automation](/blog/categories/automation) Businesses need infrastructure that's flexible and can grow fast, and managing it by hand doesn't scale. Infrastructure as Code, or IaC, changed how we build and manage those digital foundations. IaC [#Terraform](/blog/tags/terraform)[#Infrastructure as Code](/blog/tags/infrastructure-as-code)[#IaC](/blog/tags/iac)+12 tags [read more](/blog/post/modular-terraform-scalable-iac-guide) [![Streamlining GitHub Organization Management with Terraform](/_astro/hero.DJ7g8CQA_Z1UlNiP.webp)](/blog/post/streamlining-github-organization-management-with-terraform) ## [Streamlining GitHub Organization Management with Terraform](/blog/post/streamlining-github-organization-management-with-terraform) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [DevOps](/blog/categories/devops) - [Infrastructure as Code](/blog/categories/infrastructure-as-code) - [GitHub](/blog/categories/github) - [Automation](/blog/categories/automation) - [Terraform](/blog/categories/terraform) Managing a GitHub organization manually can become increasingly complex as teams grow and projects multiply. For DevOps and DevSecOps engineers, automation is how you keep things consistent and cut do [#Terraform](/blog/tags/terraform)[#GitHub](/blog/tags/github)[#IaC](/blog/tags/iac)+7 tags [read more](/blog/post/streamlining-github-organization-management-with-terraform) [![Testing Terraform: Static Analysis, Native Tests, and Terratest](/_astro/hero.QFNhZZd9_Z1MKEy5.webp)](/blog/post/terraform-testing-terratest-native-tests) ## [Testing Terraform: Static Analysis, Native Tests, and Terratest](/blog/post/terraform-testing-terratest-native-tests) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [Infrastructure as Code](/blog/categories/infrastructure-as-code) - [DevOps](/blog/categories/devops) - [Testing](/blog/categories/testing) If you treat infrastructure as code, you have to test it like code. Most of us have lived the alternative. You change one input on a shared module, run a quick plan against staging, and merge. A few h [#Terraform](/blog/tags/terraform)[#Terratest](/blog/tags/terratest)[#CI/CD](/blog/tags/cicd)+4 tags [read more](/blog/post/terraform-testing-terratest-native-tests) [![Building Resilient Systems: Immutable Infrastructure with Packer and Terraform](/_astro/hero.C1--9UB8_ZaNEHL.webp)](/blog/post/immutable-infrastructure-packer-terraform-guide) ## [Building Resilient Systems: Immutable Infrastructure with Packer and Terraform](/blog/post/immutable-infrastructure-packer-terraform-guide) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [DevOps](/blog/categories/devops) - [Infrastructure as Code](/blog/categories/infrastructure-as-code) - [Cloud Computing](/blog/categories/cloud-computing) What is immutable infrastructure? The way we manage IT infrastructure has really changed. We're moving from old-school, changeable setups to more modern, "immutable" ones. Understanding this big s [#Packer](/blog/tags/packer)[#Terraform](/blog/tags/terraform)[#Immutable Infrastructure](/blog/tags/immutable-infrastructure)+3 tags [read more](/blog/post/immutable-infrastructure-packer-terraform-guide) [![Compliance as Code: Making Security Easier with Terraform and InSpec](/_astro/hero.CuKP9d1A_ZJUUcq.webp)](/blog/post/compliance-as-code-nist-iso-27001-gdpr-terraform-inspec) ## [Compliance as Code: Making Security Easier with Terraform and InSpec](/blog/post/compliance-as-code-nist-iso-27001-gdpr-terraform-inspec) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [Compliance as Code](/blog/categories/compliance-as-code) - [Security](/blog/categories/security) - [DevSecOps](/blog/categories/devsecops) - [Terraform](/blog/categories/terraform) - [InSpec](/blog/categories/inspec) - [Cloud](/blog/categories/cloud) - [Governance](/blog/categories/governance) Hey, so you know how keeping our tech stuff secure and following all the rules can be a real headache these days? With everything moving to the cloud and so many regulations popping up, it's tough to [#Compliance](/blog/tags/compliance)[#NIST](/blog/tags/nist)[#ISO 27001](/blog/tags/iso-27001)+7 tags [read more](/blog/post/compliance-as-code-nist-iso-27001-gdpr-terraform-inspec) [![GitOps vs. Traditional IaC for Kubernetes: A Comparative Analysis](/_astro/hero.B-RmFsqr_57hBt.webp)](/blog/post/gitops-vs-traditional-iac-kubernetes-deployment) ## [GitOps vs. Traditional IaC for Kubernetes: A Comparative Analysis](/blog/post/gitops-vs-traditional-iac-kubernetes-deployment) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [DevOps](/blog/categories/devops) - [Infrastructure as Code](/blog/categories/infrastructure-as-code) - [GitOps](/blog/categories/gitops) - [Kubernetes](/blog/categories/kubernetes) - [Cloud Native](/blog/categories/cloud-native) If you're managing modern cloud-native applications, especially with Kubernetes, you know it can be a real puzzle. Getting containers to work together, handling all those configurations, and scaling t [#GitOps](/blog/tags/gitops)[#Infrastructure as Code](/blog/tags/infrastructure-as-code)[#IaC](/blog/tags/iac)+9 tags [read more](/blog/post/gitops-vs-traditional-iac-kubernetes-deployment) 6 related posts