Terraform / OpenTofu

Terraform's value proposition is simple — declare the desired state, let the tool figure out the diff. The complexity is in everything around that: state, modules, environments, secrets, blast radius, and the dance with drift. This skill is about getting those right. OpenTofu is the open-source fork; almost everything here applies to both, with notes where they diverge.

Choosing Terraform vs alternatives

Terraform is the right default when:

• You're multi-cloud, or might be.
• You need a mature provider ecosystem (3rd-party SaaS providers — GitHub, Datadog, Cloudflare, etc.).
• The team already knows it.

It's the wrong tool when:

• You're 100% on Azure and the team is .NET-centric — Bicep is more pleasant for pure Azure.
• You want to use a real programming language for IaC — Pulumi or CDK for Terraform, depending on whether you want Terraform's state model under the hood.
• The platform is Kubernetes-centric and you're already in YAML/Helm — Crossplane or Argo CD + Helm may fit better than wrapping K8s in Terraform.

For everything else, default to Terraform.