CI/CD

Automate the Terraform workflow using CI/CD pipelines — from automatic plans to policy enforcement and drift detection.

What Will You Learn? #

CI/CD pipelines ensure every infrastructure change goes through a consistent review, testing, and approval process. This section covers various aspects of Terraform automation including pipeline design, approval workflows, policy as code, and Terraform Cloud.

Articles in This Section #

Article	Main Topic
CI Pipeline	Building a basic pipeline for terraform plan and validate
Plan Approval Strategy	Approval strategies before applying to production
Automated Apply	Automating applies for specific environments
Policy as Code	Using Sentinel, OPA, and tfsec to enforce policies
Drift Detection Automation	Automatically detecting changes made outside Terraform
Terraform Cloud	Using Terraform Cloud/HCP for managed workflows

CI/CD Pipeline Flow #

flowchart TD
    A["Developer<br/>Push Code"] --> B["CI Pipeline<br/>Triggered"]
    B --> C["terraform fmt -check"]
    C --> D["terraform validate"]
    D --> E["terraform plan"]
    E --> F["Security Scan<br/>tfsec, checkov"]
    F --> G{"Policy<br/>Check"}
    G -->|"Pass"| H{"Manual<br/>Approval?"}
    G -->|"Fail"| I["Block &<br/>Notify"]
    H -->|"Approved"| J["terraform apply"]
    H -->|"Rejected"| I
    J --> K["Post-Deploy<br/>Tests"]
    K --> L["Notify Team"]

    style B fill:#e3f2fd
    style J fill:#c8e6c9
    style I fill:#ffcdd2
    style L fill:#e8f5e9

Approval Strategies #

flowchart LR
    subgraph Auto["Auto-Apply"]
        A_DEV["Dev Environment<br/>Auto apply on merge"]
    end

    subgraph Semi["Semi-Auto"]
        A_STG["Staging<br/>Auto plan, manual approve"]
    end

    subgraph Manual["Full Manual"]
        A_PROD["Production<br/>Manual plan + approve"]
    end

    Auto --> Semi --> Manual

    style Auto fill:#e8f5e9
    style Semi fill:#fff3e0
    style Manual fill:#ffebee

Policy as Code Stack #

flowchart TD
    subgraph Validation["Validation Layer"]
        FMT["terraform fmt<br/>Format check"]
        VAL["terraform validate<br/>Syntax check"]
    end

    subgraph Security["Security Layer"]
        TFSEC["tfsec<br/>Security scan"]
        CHECKOV["Checkov<br/>Compliance check"]
    end

    subgraph Policy["Policy Layer"]
        SENTINEL["Sentinel<br/>HashiCorp policy"]
        OPA["OPA/Rego<br/>Open policy"]
    end

    Validation --> Security --> Policy

    style Validation fill:#e3f2fd
    style Security fill:#fff3e0
    style Policy fill:#f3e5f5

The CI/CD pipeline is the backbone of Terraform in production. Continue to Security to learn security best practices.