Terraform

Terraform is an automation tool, but not the same kind of tool as Ansible.
To understand Terraform clearly, let’s start with a simple comparison.

Terraform vs Ansible: key differences

You already know that Ansible is used to configure existing devices and maintain their configuration over time.
As shown in the figure below, Ansible connects to infrastructure that already exists and pushes configuration changes to it.

Figure 1 - Configuration management

Here is the key difference you must remember:

• Ansible manages the configuration of existing infrastructure

• Terraform creates the infrastructure resources

Yes, this can feel surprising at first.

Until now, you have always worked with infrastructure that already exists:

• in the CLI, you connect to routers or switches that are already deployed

• with Ansible, devices are already reachable on the network

Infrastructure provisioning with Terraform

With Terraform, the logic is different.
As shown in the figure below, Terraform allows you to describe the infrastructure you want before it even exists.

Figure 2 - Infrastructure provisioning

In this example, Terraform is used to create virtual machines, but the idea is broader.
Terraform is used to create infrastructure resources.

Why Terraform matters for networking

It is important to clarify one thing: Terraform does not create physical routers or switches by itself.
Instead, it is mainly used in cloud and virtualized environments, where infrastructure and networking components can be created programmatically.

At this point, you might be thinking:

“Okay, but why are we learning Terraform for the CCNA? What does this have to do with networking?”

The answer is that modern networks are increasingly deployed inside infrastructures that are built automatically, not only configured manually.

As a network engineer, you need to understand the difference between:

• building infrastructure with Terraform

• configuring and maintaining it with Ansible

For the CCNA, you are not expected to use Terraform to configure routers.
You are expected to understand when Terraform is used in a network workflow, and how it differs from configuration tools like Ansible.

In the next section, we will break down how Terraform works step by step.

Terraform works differently from traditional configuration tools, so we will go through its logic step by step.

You do not need to become a Terraform expert for the CCNA.
You only need to understand how Terraform thinks and how the main components work together.

Step 1 - Defining the desired state

It starts with the Network / Infrastructure Engineer.

The engineer writes Terraform configuration files.
These files describe the infrastructure Terraform should create.

Figure 3 - Desired state definition

These configuration files are written in HCL (HashiCorp Configuration Language).
For this lesson, you do not need to know how to write HCL. You only need to understand the idea:

• The configuration files define what you want

• They represent the desired state of the infrastructure

In other words, they are your infrastructure requirements written as code.

Step 2 - Comparing desired state with the current state

Terraform also uses a file called the state file.
The state file is Terraform’s record of the current infrastructure state at a given moment.

Figure 4 - State comparison logic

Terraform Core compares:

• The desired state (from the configuration files)

• With the current state (from the state file)

This is how Terraform knows what to do next:

• What must be created

• What must be changed

• What can stay the same

Now that we know what we want and what currently exists, the next question is how Terraform creates infrastructure.
This is where providers come in.

Step 3 - Executing changes using providers

Terraform does not create infrastructure directly.

Instead, Terraform uses providers.
As shown in the figure below, providers are responsible for interacting with infrastructure platforms.

Figure 5 - Provider API execution

In this example, the providers are cloud platforms such as:

• AWS

• Azure

• Google Cloud

These platforms expose APIs, and Terraform communicates with them by sending API calls through the providers.
In the context of networking, Terraform can also use other providers related to network platforms and vendors.

The important idea to remember is:

• Terraform decides what needs to be done

• Providers perform the actual actions on the infrastructure

What to remember

Terraform always works with three key elements:

• Configuration files → describe the infrastructure you want (desired state)

• State file → tracks the current state of the infrastructure over time

• Providers → create and manage resources using API calls

Now that you understand how Terraform works internally, we can look at an important difference in how automation tools think.

This leads us to the next concept.

Terraform and Ansible approach automation in two very different ways.

We mainly talk about:

• Procedural approach (Ansible)

• Declarative approach (Terraform)

Figure 6 – Procedural (Ansible) vs declarative (Terraform) approaches to network configuration.

As shown in the figure, let’s take a simple example with a router.

Procedural approach with Ansible

With Ansible, the approach is procedural.
This means configuration is applied step by step, and order matters.

You can clearly see this with:

• Step 1

• Step 2

• Step 3

Each step must be executed in the correct sequence for the configuration to work properly.

Declarative approach with Terraform

Terraform works in a completely different way.

Terraform does not care about individual steps.
Instead, it focuses on the final desired state.

Rather than saying “do this, then this, then this”, Terraform says:

“This is the configuration I want.”

Terraform then checks the current state and makes sure the infrastructure matches the desired state.
If something changes or drifts, Terraform will correct it to return to that state.

Now let’s talk about mutable vs immutable infrastructure.
These terms may sound complex, but the idea behind them is actually very simple.

Mutable infrastructure (Ansible)

Ansible works with a mutable infrastructure, which means existing resources are modified in place.

In the figure below, you can see a virtual machine with configuration v1.0. If Ansible is used to apply a change, the same VM is updated and becomes version v1.1. The resource stays the same; only its configuration changes.

Figure 7 - Mutable vs Immutable Infrastructure

This approach is typical when managing already deployed systems.

Immutable infrastructure (Terraform)

Terraform works differently.
With Terraform, resources are considered immutable, meaning they are not modified once created. If a change is required on a VM with configuration v1.0, Terraform will create a new VM with configuration v1.1 and then destroy the old one.

These are simply two different ways of handling change: Ansible updates existing resources, while Terraform replaces them.

To summarize, Terraform and Ansible are both important automation tools, and you will often encounter them in enterprise networks. At the CCNA level, what matters is not how to configure these tools in detail, but understanding their roles and characteristics.

Terraform and Ansible are used for different purposes, and they are often used together in modern infrastructures.

Take your time to review the table below.
It highlights the key differences you need to remember.

Terraform vs Ansible — Key Comparison

Table 1 - Terraform vs Ansible Comparison

Key idea to remember

• Terraform builds the infrastructure

• Ansible configures and maintains it

That distinction is exactly what you need to understand for the CCNA.