🏗️ Terraform Workflow & Best Practices

init, plan, apply, destroy, workspace, Terraform Cloud

Terraform Associate · TF-Associate · ⏱️ 20 min · ❓ 6 savol

🔄 Core Workflow

1. Write — HCL konfiguratsiya. 2. Init (`terraform init`) — provider plugin yuklab olish, backend init. 3. Plan (`terraform plan`) — nima o'zgarishini ko'rish. 4. Apply (`terraform apply`) — o'zgarish qo'llash. 5. Destroy (`terraform destroy`) — barcha resurslarni o'chirish.

🔧 Muhim Buyruqlar

`terraform fmt` — kod formatlash. `terraform validate` — konfiguratsiya tekshirish. `terraform show` — state ko'rish. `terraform output` — output qiymatlar. `terraform refresh` — state ni real holat bilan sync. `terraform taint` — resursni recreate uchun belgilash.

🌍 Workspaces

Bir config — bir nechta state. `terraform workspace new dev`. Har bir workspace alohida state file. Use case: dev/staging/prod uchun bir konfiguratsiya. Terraform Cloud — managed workspaces, remote run, VCS integration, policy as code (Sentinel).

🔐 Sensitive Data

Provider credential: env var, AWS profile, IAM role. HECH QACHON credential ni .tf faylga yozmang. Variable `sensitive = true` — output va log da yashiriladi. Secret management: HashiCorp Vault, AWS Secrets Manager.

💡 Asosiy nuqtalar

init → plan → apply — asosiy workflow
terraform fmt: kod formatlash (CI da tekshiring)
terraform validate: syntax tekshirish
Workspace: alohida state, bitta config
Credential HECH QACHON .tf faylda
Terraform Cloud: remote backend + CI/CD

📋 Kod misoli

# Core workflow
terraform init           # Provider va backend init
terraform fmt            # Kodni formatlash
terraform validate       # Konfiguratsiya tekshirish
terraform plan           # O'zgarishlarni ko'rish
terraform plan -out=tfplan  # Plan saqlash
terraform apply tfplan   # Saqlangan planni apply
terraform destroy        # Barcha resurslarni o'chirish

# Workspace
terraform workspace list
terraform workspace new staging
terraform workspace select staging
terraform workspace show

# Useful flags
terraform apply -auto-approve  # Confirm so'ramasdan
terraform plan -var="region=eu-west-1"
terraform apply -target=aws_instance.web  # Faqat bitta resurs

🎯 Imtihon maslahatlari

`terraform plan -out=tfplan` → `terraform apply tfplan` — CI/CD da plan ni saqlash va aynan shu planni apply qilish best practice
`terraform taint` (deprecated Terraform 1.5+) → o'rniga `terraform apply -replace="aws_instance.web"` ishlatiladi
Workspace `terraform.workspace` variable orqali konfiguratsiyada ishlatiladi: `local.env = terraform.workspace`
`terraform validate` syntax tekshiradi, `terraform plan` esa real API call qiladi (auth kerak)
Sentinel — Terraform Cloud/Enterprise da policy as code (not open-source Terraform)

⚠️ Ko'p adashadigan

`terraform apply` ni plan ko'rmasdan `-auto-approve` bilan production da ishlatish — xavfli!
`terraform destroy` ni `terraform apply`dan farq qilmay ishlatish — destroy barcha resurslarni o'chiradi
Workspace = environment izolatsiyasi uchun ideal deb hisoblash — katta proyektlarda alohida state backend afzal

🧠 Eslab qolish: "WIPA D" = Write, Init, Plan, Apply, Destroy — Terraform asosiy workflow 5 qadami