Terraform

Terraform is HashiCorp’s infrastructure-as-code (IaC) tool for sysadmins and DevOps engineers who want servers, networks, DNS records and cloud resources created from files in Git instead of from clicks in a console. You write what should exist in HCL (HashiCorp Configuration Language), run terraform plan to see what would change, and terraform apply to make it so. If you are looking for a Terraform download, the current release is 1.17.1 (28 October 2026), a single binary for Windows, Linux and macOS.

One thing to know before you start: since version 1.6.0 Terraform is no longer open source. It is free to download and use under the Business Source License 1.1, which only restricts you from selling it as a competing hosted service. The community fork OpenTofu keeps the MPL 2.0 licence; we compare the two in Terraform vs OpenTofu.

Terraform at a glance

Last verified: 2 November 2026, on the GitHub releases page, releases.hashicorp.com, the official install page and the LICENSE file. Tested by us: Not tested yet. Commands and workflows below come from the official documentation.

What it does

• Declares infrastructure in .tf files: resources, variables, outputs and modules, in a readable language instead of API calls.
• Talks to platforms through provider plugins downloaded from the Terraform Registry: AWS, Azure, Google Cloud, VMware vSphere, Proxmox VE, Kubernetes, Cloudflare, DNS, Active Directory and hundreds more.
• Shows a plan before any change. terraform plan lists what will be created, updated in place, replaced or destroyed, so a reviewer can approve it in a pull request.
• Tracks what it manages in a state file, locally or in a remote backend (S3, Azure Storage, Consul, HCP Terraform), so the next run only changes what differs.
• Reuses modules: write a “standard Linux VM” module once and call it with different parameters for every environment.
• Imports existing resources into state, so a hand-built environment can be brought under code gradually.
• Validates and formats code (terraform validate, terraform fmt), which fits CI pipelines.
• New in 1.17: variables and locals in provider requirements, a -minimal-refresh plan option that refreshes only resources with proposed changes, and Terraform Policy generally available through the -policies flag.

How sysadmins use it

Create a VM from code and tear it down again

1. Make a folder, add main.tf with a terraform { required_providers { ... } } block for your platform’s provider and one resource block, for example a VM or a cloud instance.
2. Run terraform init. It downloads the provider into .terraform/ and writes a lock file; commit the lock file.
3. Run terraform plan -out tfplan and read the summary line (“1 to add, 0 to change, 0 to destroy”).
4. Run terraform apply tfplan. When the test is over, terraform destroy removes everything the state file knows about.

Keep one configuration for several environments

variable "env" { type = string }

module "web" {
  source   = "./modules/linux-vm"
  name     = "web-${var.env}"
  cpu      = var.env == "prod" ? 4 : 2
}

Run terraform workspace new staging, then terraform apply -var env=staging. Each workspace gets its own state, so staging and production never overwrite each other.

Review infrastructure changes like code

1. Store the .tf files in Git and put the state in a remote backend with locking.
2. In CI, run terraform fmt -check, terraform validate and terraform plan on every pull request and post the plan as a comment.
3. Apply only from the main branch, by a pipeline job or by one person, never from laptops.

Adopt an existing resource

Write the resource block first, then run terraform import with its ID from the provider (for example an instance ID). The next plan shows any drift between the real object and your code, which you fix in the file.

Install and first run

Windows. The official install page offers a zip for 386, amd64 and arm64. Unpack terraform.exe into a folder such as C:Toolsterraform, add that folder to the PATH environment variable, open a new terminal and run terraform version. The amd64 zip is about 37 MB. Package managers are not listed on the official install page, so check their versions yourself if you use one.

Linux. HashiCorp publishes apt, yum and dnf repositories:

# Ubuntu / Debian
sudo apt update && sudo apt install terraform
# RHEL / CentOS (after adding hashicorp.repo)
sudo yum -y install terraform
# Fedora
sudo dnf -y install terraform

macOS. brew tap hashicorp/tap then brew install hashicorp/tap/terraform. Homebrew on Linux works the same way.

Checks and gotchas. Every release ships a SHA256SUMS file; verify the zip before unpacking on a build server. The binary itself needs no runtime, but providers download at init time, so a proxy or air-gapped network needs a provider mirror. Provider credentials come from environment variables or the platform’s CLI login, not from .tf files. Do not commit terraform.tfstate: it contains resource IDs and sometimes secrets.

Limitations

• Not open source since 1.6.0. The BSL 1.1 allows internal and production use, but you may not offer Terraform itself to third parties as a paid hosted or embedded product that competes with IBM’s paid versions. Each version becomes MPL 2.0 four years after its release.
• Provisions infrastructure, not the software on it. Package installation, patching and configuration inside a VM are jobs for a configuration tool such as Ansible; see Ansible vs Terraform.
• State is a single source of truth that must be protected: a lost or corrupted state file means Terraform no longer knows what it created.
• Provider quality varies. Official providers for the big clouds are mature; community providers for smaller platforms may lag behind their APIs.
• Collaboration features such as remote runs, policy enforcement with a UI and team permissions are part of HCP Terraform and Terraform Enterprise, which are separate commercial products.

Terraform vs alternatives

OpenTofu is the drop-in fork under MPL 2.0 and reads the same HCL; pick it if the licence matters to you. Pulumi lets you write the same kind of declarations in Python, TypeScript or Go. AWS CloudFormation and Azure Bicep are tied to one cloud each, while Terraform covers many platforms with one workflow. For local test VMs on a workstation, Vagrant is simpler; for a self-hosted lab target, Terraform works well against Proxmox VE through a community provider. More tools of this kind are in our DevOps and automation tools guide.

FAQ

Where is the Terraform download for Windows 11?

On the official install page at developer.hashicorp.com. Windows 10 and 11 use the same amd64 zip (arm64 for ARM laptops). There is no installer; unpack the exe and add it to PATH.

Is Terraform free?

Yes, the Terraform CLI is free to download and use, including in production, under the Business Source License 1.1. The only restriction is building a competing hosted service on it. HCP Terraform, the cloud service, has paid tiers.

Terraform vs Ansible: which one do I need?

Terraform creates the machines and cloud objects; Ansible configures what runs on them. Many teams use both: Terraform for the VM, Ansible for packages and settings.

Terraform vs OpenTofu: what is the difference?

OpenTofu is a community fork made after the licence change, maintained under the Linux Foundation and licensed MPL 2.0. The language and providers are compatible today; the projects add new features separately.

How do I install a specific Terraform version on Ubuntu?

Either pin the package version in apt (apt install terraform=1.17.1-1 style, check the exact name in the repository) or download that version’s zip from releases.hashicorp.com and put the binary on PATH. Keep all team members on one version by setting required_version in the configuration.

Does Terraform work with Kubernetes?

Yes, through the Kubernetes and Helm providers, which create namespaces, deployments and releases. Terraform is usually used to build the cluster itself, with Helm or GitOps tools managing workloads afterwards.

Can Terraform manage on-premises servers?

It manages anything with an API and a provider: VMware vSphere, Proxmox VE, Hyper-V via community providers, network devices, DNS and Active Directory. Bare-metal servers without an API are outside its scope.

Last checked against official sources: 2 November 2026 (developer website: developer.hashicorp.com). Versions and licence terms change — confirm on the developer's site before deploying in production.