Insights3 min read
Terraform and Ansible: what each one is for
Terraform creates infrastructure. Ansible configures what runs on it. How the two fit together, where they overlap and how to start.
Two tools, two jobs
Teams often ask which of the two they should use. In most cases the answer is both, because they do different jobs.
Terraform creates infrastructure. Networks, databases, storage, clusters and access rules.
Ansible configures what runs on it. Packages, users, files, services and deployments on servers that already exist.
What Terraform does
With Terraform you describe the result you want: this network, this database, these permissions. You do not write the steps to get there.
Terraform keeps a record of what it has created, called the state. Before each change it compares your description with the state and shows a plan: what will be added, changed or destroyed. Nothing happens until someone approves that plan.
This brings three things. You can read your infrastructure as text. You can review a change before it is made. And you can build a second environment from the same code, for example a test environment that matches production.
OpenTofu is an open-source fork of Terraform. It was created in 2023, after Terraform moved to a different licence, and it is maintained under the Linux Foundation. The two work in much the same way, and what this article says about Terraform holds for OpenTofu too.
What Ansible does
Ansible connects to machines, normally over SSH, and runs a list of tasks written in YAML. It needs no agent installed on the server.
A task says what should be true: this package is installed, this file has this content, this service is running. If it is already true, Ansible changes nothing. So you can run the same playbook again and again and get the same result.
Ansible is the right tool for work inside a machine: setting up a server, hardening it, deploying an application or changing a configuration on fifty machines at once.
Where they overlap
Ansible can create cloud resources, and Terraform can run commands on a server. Each tool is weaker outside its own job.
Ansible keeps no record of what it created. That makes it hard to see what has drifted and hard to remove what is no longer needed. Terraform can run scripts on a machine through provisioners, but its own documentation calls them a last resort.
A simple rule works well: if it is something you create or destroy, use Terraform. If it is something you configure inside a machine, use Ansible.
Do you still need Ansible with containers?
Less than before. When applications run in containers on a managed platform, there are few servers left to configure. The container image carries what the application needs.
Ansible stays useful where real machines remain: virtual machines, network devices, on-premise servers and the base images those machines start from.
How to start with infrastructure as code
- Do not rewrite everything. Import one existing environment into Terraform and make the code match what is running.
- Keep the state in a shared, locked place. It must not live on one person’s laptop.
- Make every change a pull request. The plan is part of the review.
- Keep secrets out of the repository. Use the secret manager of your cloud.
- Start small. One environment that is fully in code is worth more than five that are half done.
Our use case for a data platform defined in code shows these steps in one project. The Data Engineering & Operations page describes how we work.