Running terraform apply from a laptop does not scale past a single engineer, so production teams move Terraform into a pipeline that plans on every pull request, gates the change behind review and policy checks, and only applies once a human or an automated rule signs off. This turns infrastructure changes into the same reviewable, auditable process as application code, and it is where security scanning and policy as code earn their keep: a Checkov or Sentinel check catches a public S3 bucket or an oversized blast radius before it ever touches real infrastructure, not after. The non-obvious part is that a Terraform pipeline is really a state machine with a shared lock — every plan and apply must serialize against the same backend, so the pipeline's job is as much about coordinating concurrent runs safely as it is about running commands. Getting the plan/apply split, the approval gate, and the lock discipline right up front prevents the two failure modes that hurt most: an unreviewed change reaching production, and two runs corrupting the same state file.
What This Cheat Sheet Covers
This topic spans 16 focused tables and 134 indexed concepts. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: CI/CD Pipeline Fundamentals for Terraform
Every Terraform pipeline, regardless of platform, is built from the same small set of moving parts: a plan step that previews changes, an apply step that executes them, and a boundary between the two that a human or a policy controls.
| Concept | Example | Description |
|---|---|---|
terraform plan -out=tfplanterraform apply tfplan | Separates the read-only preview from the destructive action so a reviewer can inspect exactly what will change before it happens. | |
on: pull_request: | Runs a speculative terraform plan on every PR so reviewers see the infrastructure diff alongside the code diff. | |
on: push: branches: [main] | Applies only after code lands on the trunk branch, keeping apply out of feature branches entirely. | |
terraform plan -out=tfplan# upload tfplan as a pipeline artifact | Guarantees the exact plan a reviewer approved is the one that gets applied, instead of re-planning (and risking drift) right before apply. | |
terraform apply -input=false -auto-approve tfplan | Disables interactive prompts so Terraform never blocks waiting for terminal input inside an automated runner. | |
terraform plan -detailed-exitcode# 0=no changes, 1=error, 2=changes present | Lets a pipeline branch on whether a plan is empty, so it can skip an apply step entirely when there is nothing to do. |