What Is Infrastructure as Code? How IaC Works, What It Costs and Your First Terraform Stack in 2026

A colleague fixes a 2am outage by opening a port in the AWS console. Six months later you change one tag on that security group, run terraform plan, and Terraform calmly offers to delete the firewall rule keeping payments alive. Nothing is broken. That gap between what you wrote down and what exists is the part nobody mentions when they call infrastructure as code "just writing your servers down in files".

How Infrastructure as Code Works: Desired State, Plan and Apply

You do not write "create a bucket, then enable versioning on it". You write "a bucket exists, and versioning is enabled", and the tool decides whether that means creating, changing, or doing nothing.

That is what makes it repeatable. Run a shell script twice and you get two buckets or an error. Run terraform apply twice and the second run reports no changes. The name for that property is worth knowing in interviews: idempotency. The comparison takes three inputs:

1. Your configuration, the .tf files in Git: what you want.
2. The state file, terraform.tfstate: what Terraform created last time, and its cloud IDs.
3. The live cloud, read through the provider API during refresh: what is actually there now.

The plan is the difference between those three. The apply executes it, then rewrites the state file so the next run starts from the truth.

Infrastructure as Code Tutorial: Your First Terraform Stack in 20 Lines

Reading about plan and apply teaches you nothing. Typing it does. Start with something cheap enough that a mistake costs rupees.

Put this in main.tf, changing the bucket name, since S3 names are global.

terraform {
  required_providers {
    aws = {
      source = "hashicorp/aws"
    }
  }
}

provider "aws" {
  region = "ap-south-1"
}

resource "aws_s3_bucket" "reports" {
  bucket = "dtg-demo-reports-2026"
}

resource "aws_s3_bucket_versioning" "reports" {
  bucket = aws_s3_bucket.reports.id
  versioning_configuration {
    status = "Enabled"
  }
}

That aws_s3_bucket.reports.id reference is how Terraform builds its dependency graph: the bucket is created before versioning is configured, without you sequencing anything. Pin a version on the provider in real work. An unpinned provider is how a quiet Tuesday becomes an unplanned upgrade.

$ terraform init     # downloads the provider
$ terraform plan     # shows the diff, changes nothing
$ terraform apply    # type yes, and it becomes real

Learn to read plan output. You will review other people's plans more often than you write your own:

Terraform will perform the following actions:

  # aws_s3_bucket.reports will be created
  + resource "aws_s3_bucket" "reports" {
      + bucket = "dtg-demo-reports-2026"
      + id     = (known after apply)
    }

Plan: 2 to add, 0 to change, 0 to destroy.

Four symbols carry the meaning: + creates, ~ updates in place, - destroys, -/+ destroys and recreates. Stop on that last one during review: on an RDS instance it means your database is about to be replaced.

The Terraform State File Is Where Teams Actually Get Hurt

That terraform.tfstate file is a JSON record of everything Terraform created, including values you would never commit to Git. Put it in version control and you have leaked secrets. Leave it on one laptop and your teammate's apply builds everything again, because their state file is empty. The first grown-up move on any project is a shared backend with locking:

terraform {
  backend "s3" {
    bucket       = "dtg-tfstate-ap-south-1"
    key          = "platform/prod/terraform.tfstate"
    region       = "ap-south-1"
    encrypt      = true
    use_lockfile = true
  }
}

use_lockfile is the current answer to concurrent applies. It shipped experimentally in Terraform 1.10 and went generally available in 1.11, using S3 conditional writes to drop a .tflock object beside your state for the length of a run. A separate DynamoDB table still works, but HashiCorp's docs mark dynamodb_table deprecated.

Drift, and that 2am security group

Change infrastructure outside Terraform and the state file does not know. The gap is called drift, and it waits for your next unrelated change, then surfaces as a deletion you never asked for. Two commands before you trust a plan on an estate you inherited:

$ terraform plan -refresh-only   # compare state against reality, propose no changes
$ terraform state list           # every resource Terraform believes it owns

What usually goes wrong here is human. Somebody sees Error acquiring the state lock, decides it must be stale, and runs force-unlock while a colleague's apply is still writing. Plenty of the state corruption stories in 2026 incident write-ups begin there, not with a bug. If you see a lock, message whoever's name is on it.

5 mistakes that turn infrastructure as code into a liability

That last row separates a team using IaC from a team that owns its infrastructure. While any engineer can apply from a laptop, your Git history is a suggestion, not a record.

Infrastructure as Code vs Configuration Management: Terraform or Ansible?

This trips people up, because both tools get described as "automating infrastructure" while doing different jobs. Terraform provisions the box; Ansible configures what runs inside it. One creates the virtual machine, its network and the load balancer. The other installs nginx on it, drops a config file and restarts the service.

Learning one first for the Indian job market? Learn Terraform. Not because it is the better tool, but because cloud job ads here name it far more often, and because containers absorbed much of Ansible's old work: when your unit of deployment is an image, you configure that image in a Dockerfile. The trade-off is being slower the day you inherit legacy VMs with no images. Also read: Docker Tutorial for Beginners 2026.

What Is Infrastructure as Code Actually Used For at Work?

Picture a two-person platform team at a mid-size insurer in Pune: 40 EC2 instances, an RDS cluster and a pile of S3 buckets built by people who have since left. Two parts of their week map to job titles you can apply for.

Cloud and DevOps engineering

An environment per branch, torn down on merge. A developer opens a pull request, a pipeline runs terraform plan and posts the diff as a comment, so review covers infrastructure alongside code. Provisioning sits inside the AWS DevOps Engineer Professional blueprint, half of 360DT's live AWS Solutions Architect and DevOps program; the Microsoft equivalent runs through the AZ-305 and AZ-400 course. Also read: What Is CI/CD?

Data and AI platform work

The same insurer's data team needs a workspace, a storage account, a managed identity and access policies identical across dev, UAT and production. Build that three times by hand and it differs three ways; apply one file with three variable sets and it cannot. Hence provisioning's place in the Fabric data engineer course covering DP-700 and DP-900, in the MLOps engineer course around AI-300 and in the AI Engineer course. On the AI side the argument is purely financial: GPU endpoints are the most expensive thing companies leave switched on by accident. Also read: How to Build Production RAG.

What Infrastructure as Code Costs in 2026, and the OpenTofu Question

The Terraform CLI is free to download and run. The managed platform around it costs money, and the terms changed this year: the legacy free plan ended on 31 March 2026, and organisations moved to an enhanced Free tier covering 500 managed resources, unlimited users and one concurrent run. Above that, HCP Terraform bills per resource under management, at $0.10, $0.47 and $0.99 per managed resource-month for Essentials, Standard and Premium.

The case study: what Fidelity did about the licence

When HashiCorp moved Terraform to the Business Source Licence, a fork called OpenTofu appeared under MPL 2.0, and it has stopped being a protest project. It entered the CNCF at Sandbox level in April 2025, its registry reports 3,900+ providers as of mid-2026, and the adoption stories carry names: Fidelity Investments migrated more than 50,000 state files across, GitLab deprecated its Terraform CI/CD templates in May 2025 over the licence, and Boeing, Capital One and AMD run it in production.

My call for someone learning today: write Terraform, know OpenTofu exists. The HCL transfers either way and Indian job ads still say "Terraform". The trade-off is real, though: OpenTofu ships things the open Terraform binary does not, including built-in state encryption from v1.7, so on a security-sensitive estate the fork may be the better answer.

One caveat no vendor will offer you. If you run three virtual machines that change twice a year, infrastructure as code is not worth it yet. You would spend a fortnight on state management to automate something you barely touch, and add a state file you can lose to a system that had no such failure mode.

How to Learn Infrastructure as Code Properly

The order that works is not the order tutorials teach. Skip modules and workspaces for the first month; they are abstractions over something you cannot yet do by hand. Instead: create five resources in one file, break them deliberately, import a resource you made in the console, move state to S3, then put plan into a pipeline. Six weekends of that, and you can answer the question interviewers actually ask, which is never "what is a module" but "how does your team handle state".

Pair it with the cloud you will be hired on, because Terraform without a provider to aim at is grammar without vocabulary. AWS is the route most Indian cloud ads assume, and the live AWS Solutions Architect and DevOps course is the closest fit here, with the exam mapping on the certifications overview. To watch someone build a stack first, the free webinars cost nothing and a demo class takes an hour.

Related guides

• Linux Commands Cheat Sheet for DevOps in 2026 for when a provisioned box misbehaves.
• AZ-305 vs SAA-C03 in 2026 to decide which cloud to point your provider at.
• DevOps Engineer Salary in India 2026 for what these skills are advertised at.
• IT Support to Cloud Engineer in India 2026 if IaC is your first cloud skill.
• What Is Kubernetes? the other desired-state system you will meet next.

Frequently asked questions

Do the boring version first: create five resources, move the state to S3, destroy the lot, then build it again from the same file. The moment that second build comes back identical is the moment the idea stops being abstract, and it beats any amount of reading about module structure. Then pick the cloud you want to be hired on and go deep, through the live AWS course or a free webinar first.

About this guide. 360 Digital Transformation is an Authorized Training Partner of Anthropic and Microsoft. Other certification bodies, vendors and employers named here are not affiliated with us. Tools and versions change quickly; commands and figures cited were checked on 27 September 2026.