Infrastructure as Code: Bridging Terraform and Ansible

When building modern cloud infrastructure, the debate often surfaces: Terraform or Ansible? The reality is that these two tools aren't mutually exclusive; they are highly complementary. Understanding where one ends and the other begins is the key to a robust Infrastructure as Code (IaC) strategy.

The Declarative vs. Imperative Divide

Terraform is primarily a declarative provisioning tool. You tell Terraform what you want your infrastructure to look like (e.g., "I need 3 EC2 instances, a VPC, and a load balancer"), and Terraform figures out how to make the cloud provider's API match that state. It excels at managing the lifecycle of cloud resources.

Ansible, while it can provision infrastructure, truly shines as a configuration management and orchestration tool. It is procedural (though it has declarative modules). Once the servers exist, Ansible connects to them (usually via SSH) and configures the software, users, and services running on those machines.

The Perfect Workflow

A standard, highly effective workflow combines both:

1. Provisioning with Terraform: Use Terraform to spin up the VPC, subnets, security groups, and the raw compute instances. Terraform creates the "empty boxes" and the networking between them.
2. Handoff: Terraform outputs the IP addresses of the newly created instances. This output can be dynamically fed into an Ansible inventory file.
3. Configuration with Ansible: Ansible takes over, connecting to the new instances to install packages, configure Nginx, set up systemd services, and deploy your application code.

Example Integration

You can use the local-exec provisioner in Terraform to trigger an Ansible playbook as soon as a resource is created:

resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
 
  provisioner "local-exec" {
    command = "ansible-playbook -i ${self.public_ip}, playbook.yml"
  }
}

Note: While local-exec works, relying on dynamic inventories in Ansible fetching state from Terraform (using tools like terraform-inventory) is often more robust for larger environments.

Conclusion

Stop trying to force Terraform to do complex OS-level configuration, and stop using Ansible to manage complex cloud state dependencies. By letting Terraform handle the provisioning and Ansible handle the configuration, you build a more maintainable, scalable, and resilient infrastructure.