You Still Need to Learn Terraform — Even With AI Writing Code

0:00DevOps Toolbox makes the counter-intuitive case: Terraform is one of the most important tools in modern DevOps, and with AI writing more code, knowing it is becoming more important, not less. An agent will happily generate hundreds of lines of Terraform in seconds — but understanding what it's actually building, how resources depend on each other, how state is managed, and what happens on apply is a different story. That gap "breaks companies, destroys DNS setups and CDNs, messes up load balancers" — and shows up on the cloud bill at the end of the month.

The fork story

1:35The history, in one breath: Terraform was created in 2014 by HashiCorp, founded by Mitchell Hashimoto (also the creator of Ghostty). It started open source and became the industry standard for infrastructure-as-code. Then in 2023 HashiCorp changed the license to the more restrictive BSL (Business Source License) — ostensibly to stop competitors exploiting their work. Like Redis and Elasticsearch before it, the community wasn't thrilled, so a group of companies forked Terraform into OpenTofu, a fully open-source alternative now under the Linux Foundation. Then IBM acquired HashiCorp in 2025. Today: Terraform by IBM vs. OpenTofu by the Linux Foundation — two projects sharing DNA and features, taking different paths.

The core workflow

2:44The 80% you'll actually use. You start with a repo and a cloud provider (he uses AWS), install the CLI (aliased tf), and write main.tf — Terraform is written in Go, with the HCL (HashiCorp Configuration Language) declarative syntax, and the provider block at the top. Then: tf init initializes the backend and installs provider plugins (like go mod tidy); the Terraform Registry holds per-resource docs ("how documentation is meant to be shown"); variables make templates reusable and reviewable; data objects fetch live info from the provider (like the latest Amazon Linux AMI); resources are what you build; outputs print values you can consume from other projects — and projects that consume each other's outputs form a stack, layers of infrastructure stacked on top of each other. The .terraform directory (providers, modules) and the lock file pin every dependency — commit it.

9:01The command sequence: tf fmt formats (great as a CI step), tf validate checks consistency, and tf plan — "the command DevOps engineers collectively decided to stop using" — builds the implementation plan, showing the three things that matter: what's added, what's changed, and the worrying one, what's destroyed. Then tf apply (with an approve prompt), and finally tf destroy — his favorite, because it cleans up everything in dependency order with no forgotten subnet or orphaned gateway.

State is everything

11:14The Terraform state file — an exact description of the deployed infrastructure, down to tags and user data in base64 — is "possibly the most critical piece of Terraform." It's how the system keeps control of your environment. If someone changes something out-of-band (not through Terraform), you now have drift. Which is why state ends up in remote storage (S3 in AWS) with state locking, so two engineers can't apply simultaneously. The lifecycle he demonstrates — add a tag, plan shows the change, apply, verify with the AWS CLI + jq — is the whole loop in miniature.

Don't trust the agent blindly

10:08When a plan errors (missing VPC, etc.), "you can give that to your agent and trust it'll fix everything, but I would not do that if I were you. Not because it'll be wrong, but because it'll be random." A wrong VPC can deploy your server to the wrong environment, leaving a security hole and a resource that shouldn't exist. His rule: generated templates are fine, but review them one by one. This is the through-line of the whole video — the agent generates the Terraform, but the human still has to understand state, dependencies, and blast radius to use it responsibly.

OpenTofu: the drop-in fork

13:48The sibling project, OpenTofu, is "Terraform — guaranteed to stay open source." It's at 30k+ stars (half of them, he jokes, "done with rage after the license change"), uses the same HCL for the same objects and references, and has its own registry with the same providers. The migration: "there's a 99% chance you're already migrated — literally everything just works out of the box." Install, swap terraform for tofu (or just alias tf=tofu), and plan/apply/destroy all behave identically. The real differences are on top: state encryption, more flexible provider configs, and no commercial features — "mostly the warm feeling inside," but not something to disregard.

Claims checked

Sources & further reading