Truth in IT
    • Sign In
    • Register
        • Videos
        • Channels
        • Pages
        • Galleries
        • News
        • Events
        • All
Truth in IT Truth in IT
  • Data Management ▼
    • Converged Infrastructure
    • DevOps
    • Networking
    • Storage
    • Virtualization
  • Cybersecurity ▼
    • Application Security
    • Backup & Recovery
    • Data Security
    • Identity & Access Management (IAM)
    • Zero Trust
    • Compliance & GRC
    • Endpoint Security
  • Cloud ▼
    • Hybrid Cloud
    • Private Cloud
    • Public Cloud
  • Webinar Library
  • TiPs
  • DRAW

HashiCorp: Using Terraform with Ansible for Configuration Management

HashiCorp
10/15/2026
0 (0%)
Share
  • Comments
  • Download
  • Transcript
Report Like Favorite
  • Share/Embed
  • Email
Link
Embed

Transcript


TL;DR

  • Terraform handles infrastructure provisioning, but post-provisioning configuration tasks — package installation, file configuration, database seeding — often require a dedicated tool like Ansible, especially at scale.
  • Whether to combine provisioning and configuration management in one pipeline or keep them separate depends on how tightly coupled the dependencies are; always build an escape hatch to run each stage independently.
  • Integrating Terraform with Ansible Automation Platform requires manual bootstrapping of credentials, job templates, and inventories in AAP before Terraform can reference them, creating a hybrid automated/manual workflow.
  • A stale SSH key pair caused a mid-stream failure, illustrating the real risk of managing dependencies that span Terraform state and external platforms — changes in one must be manually propagated to the other.
  • User data scripts are convenient for small demos but lack native completion signaling and idempotency guarantees, making Ansible a more robust choice for configuring infrastructure at any meaningful scale.
  • The choice between Terraform-first and Ansible-first workflows is largely driven by team familiarity and existing toolchain investment; neither approach is universally correct, and most mature environments use both.

Terraform and Ansible: Why Both Tools Are Needed

Episode 12 of the "Getting Into Terraform" series tackles one of the most practical and frequently encountered challenges in infrastructure automation: what happens after Terraform provisions a resource? Hosts Rosemary Wang and Richard Boyd explore the boundary between infrastructure provisioning and configuration management, explaining why Terraform alone is often insufficient for post-provisioning tasks such as installing packages, configuring networking, or seeding database schemas. The session opens with a substantive discussion on whether provisioning and configuration management pipelines should be kept separate or combined. The hosts argue that the answer is context-dependent: tightly coupled dependencies between infrastructure attributes and configuration steps favor a unified pipeline, while loosely coupled scenarios benefit from separation. A key insight offered is the importance of always building an "escape hatch" — the ability to run provisioning independently of configuration management — so that teams are never forced to execute an entire pipeline just to push a configuration change.

Ansible Automation Platform Integration Walkthrough

The bulk of the episode is a live, unscripted walkthrough of integrating Terraform with Red Hat's Ansible Automation Platform (AAP). The hosts demonstrate the end-to-end setup required to trigger an Ansible playbook against an AWS EC2 instance provisioned by Terraform. This includes configuring SSH credentials in AAP, creating a project linked to a Git repository containing the playbook, defining a job template, and building an inventory of target hosts. The session surfaces a classic chicken-and-egg problem: credentials, job templates, and inventories must be configured in AAP before Terraform can reference them, creating a manual bootstrapping dependency that sits outside the automated pipeline. The hosts encounter a real-world failure mid-stream when AAP cannot reach the EC2 host due to a stale SSH key pair — the private key had been regenerated by Terraform but not updated in AAP. They resolve this by outputting the private key from Terraform state using a base64-encoded sensitive output, then manually updating the credential in AAP. This friction point becomes a teaching moment about the risks of managing dependencies that span both automated and manual configuration boundaries.

Lessons Learned and Practical Guidance

The closing segment distills the session's hard-won lessons into actionable guidance. The hosts emphasize that mutable configuration management — making in-place changes to running infrastructure — is a legitimate and common pattern, even if immutable infrastructure via golden images is the preferred long-term goal. They acknowledge that user data scripts are a viable shortcut for small demos but do not scale well, citing the lack of native completion signaling and the complexity of managing idempotency across many hosts. The episode also highlights that the choice between Terraform-first and Ansible-first workflows often comes down to team familiarity and existing toolchain investment rather than a universal best practice. A recurring theme is the importance of being deliberate about automation boundaries: clearly delineating what is fully automated, what requires manual intervention, and where those handoffs occur. The hosts close by noting that the AAP provider for Terraform is a relatively new integration that has not previously been demonstrated live, making this episode a first-of-its-kind walkthrough for the series. The next stream is scheduled for August 11th and will likely cover Terraform module testing.

Chapters

0:00 - Introduction and Series Context
1:23 - The Provisioning vs. Configuration Problem
6:05 - One Pipeline or Two? Audience Q&A
11:04 - Introducing Ansible Automation Platform
13:47 - Why User Data Scripts Don't Scale
58:02 - Configuring AAP: Projects and Job Templates
112:11 - Running the Job and Debugging SSH Failure
113:55 - Extracting Private Key from Terraform State
119:36 - Automation Boundaries and Manual Handoffs
121:44 - Recap and Closing Thoughts

Key Quotes

1:23 "The really big problem that people tend to encounter at some point is basically how do you integrate Terraform with every other workflow that you need to work with."
10:05 "You should offer an escape hatch, right? If you are letting yourself combine configuration management and provisioning in one pipeline, make sure you give yourself an escape hatch to just run the provisioning piece as you need to."
14:07 "My biggest complaint about user data scripts is that there isn't like a good native way to know when it's done or has, like, when it's no longer executing."
115:11 "This is why I don't like doing like half things in Terraform and half things out of Terraform. In my opinion, this is where things go horribly awry, because you've configured some things in Terraform, but you have dependencies outside of Terraform."
121:23 "Just make sure that as you think about this, though, you're more deliberate about where you are actually automating versus where these steps are manual."
122:29 "It's not one or the other, but most folks try to do everything as immutable as possible and not do mutable changes like with configuration management."

FAQ

When should I use Terraform versus Ansible for managing infrastructure?

Terraform is best suited for provisioning and lifecycle management of infrastructure resources — creating, updating, and destroying cloud resources declaratively. Ansible excels at mutable, in-place configuration tasks such as installing packages, configuring files, or seeding databases on already-running infrastructure. Most mature environments use both: Terraform provisions the resource, and Ansible configures it afterward. The decision of whether to run them in one pipeline or separate pipelines depends on how tightly coupled the provisioning attributes are to the configuration steps.

What is the Ansible Automation Platform (AAP) provider for Terraform, and how does it work?

The AAP provider for Terraform allows you to trigger Ansible job templates directly from a Terraform configuration. To use it, you first configure credentials, a project (linked to a Git repository containing your playbook), a job template, and an inventory of target hosts inside AAP. Terraform then references these resources — typically via data sources — and can launch a job against a provisioned host as part of the apply workflow. There is a bootstrapping dependency: the AAP objects must exist before Terraform can reference them, which means some initial setup in AAP is manual.

Why shouldn't I just use user data scripts instead of Ansible for post-provisioning configuration?

User data scripts are convenient for simple, one-time setups in demos or small environments, but they have significant limitations at scale. They lack native signaling for completion or failure — you typically have to implement workarounds like writing a sentinel file to S3 or polling the filesystem. They are also difficult to make idempotent, meaning running them multiple times can produce inconsistent results. Ansible, by contrast, is designed for idempotent, repeatable configuration management and provides structured output and error handling, making it far more reliable for production use across many hosts.


Categories:
  • » Cybersecurity » Application Security
  • » Data Management » DevOps
  • » Cybersecurity » Cloud Security
  • » Data Protection
Channels:
News:
Events:
Tags:
  • Infrastructure as Code
  • DevSecOps
  • Cloud Security
  • How-To
  • Technical Deep Dive
  • Demo
  • Best Practices
  • Terraform and Ansible integration
  • Configuration management
  • Ansible Automation Platform
  • Mutable vs. immutable infrastructure
  • CI
  • CD pipeline design
Show more Show less

Browse videos

  • Related
  • Featured
  • By date
  • Most viewed
  • Top rated
  •  

              Video's comments: HashiCorp: Using Terraform with Ansible for Configuration Management

              Upcoming 360 View Events

              • Nov
                19

                360View: Govern, Secure & Recover Your Microsoft 365 Environment

                11/19/202601:00 PM ET
                More events

                XStreaminars (watch here)

                • Oct
                  27

                  Illumio: See It. Stop It. Contain It. Lateral Movement Defense in Action

                  10/27/202611:00 AM ET
                  • Oct
                    28

                    EnvZero: Near-Zero Time to Resolution--Live Agentic Remediation for Failed and Drifted Infrastructure

                    10/28/202601:00 PM ET
                    More events

                    Industry Events (Sponsor Hosted)

                    • Oct
                      20

                      Harnessing Data Governance for AI with Cyera and Snowflake

                      10/20/202611:00 AM ET
                      • Oct
                        27

                        Maximize Security, Value, and Returns on Your Microsoft Investment

                        10/27/202611:00 AM ET
                        • Oct
                          27

                          The HUMAN Experience: Real-Time Insights into Page Intelligence

                          10/27/202601:00 PM ET
                          • Oct
                            28

                            [APAC:] Secure AI Everywhere: Visibility, governance and protection for the agentic era

                            10/28/202601:00 AM ET
                            • Oct
                              28

                              [EMEA:] Secure AI Everywhere: Visibility, governance and protection for the agentic era

                              10/28/202606:00 AM ET
                              More events

                              Upcoming Webinar Calendar

                              • 10/20/2026
                                11:00 AM
                                10/20/2026
                                Harnessing Data Governance for AI with Cyera and Snowflake
                                https://www.truthinit.com/index.php/channel/2137/harnessing-data-governance-for-ai-with-cyera-and-snowflake/
                              • 10/27/2026
                                11:00 AM
                                10/27/2026
                                Maximize Security, Value, and Returns on Your Microsoft Investment
                                https://www.truthinit.com/index.php/channel/2178/maximize-security-value-and-returns-on-your-microsoft-investment/
                              • 10/27/2026
                                11:00 AM
                                10/27/2026
                                Illumio: See It. Stop It. Contain It. Lateral Movement Defense in Action
                                https://www.truthinit.com/index.php/channel/2182/see-it-stop-it-contain-it-lateral-movement-defense-in-action/
                              • 10/27/2026
                                01:00 PM
                                10/27/2026
                                The HUMAN Experience: Real-Time Insights into Page Intelligence
                                https://www.truthinit.com/index.php/channel/2139/the-human-experience-real-time-insights-into-page-intelligence/
                              • 10/28/2026
                                01:00 AM
                                10/28/2026
                                [APAC:] Secure AI Everywhere: Visibility, governance and protection for the agentic era
                                https://www.truthinit.com/index.php/channel/2125/apac-ensuring-comprehensive-security-for-ai-applications/
                              • 10/28/2026
                                06:00 AM
                                10/28/2026
                                [EMEA:] Secure AI Everywhere: Visibility, governance and protection for the agentic era
                                https://www.truthinit.com/index.php/channel/2127/emea-ensuring-ai-security-across-all-platforms/
                              • 10/28/2026
                                01:00 PM
                                10/28/2026
                                [AMERICAS:] Secure AI Everywhere: Visibility, governance and protection for the agentic era
                                https://www.truthinit.com/index.php/channel/2126/securing-ai-across-the-americas-strategies-and-insights/
                              • 10/28/2026
                                01:00 PM
                                10/28/2026
                                EnvZero: Near-Zero Time to Resolution--Live Agentic Remediation for Failed and Drifted Infrastructure
                                https://www.truthinit.com/index.php/channel/2179/envzero-near-zero-time-to-resolution-live-agentic-remediation-for-failed-and-drifted-infrastructure/
                              • 11/04/2026
                                11:00 AM
                                11/04/2026
                                Aligning Agentic Intent: Understanding Your Agents' Purpose vs. Their Actions
                                https://www.truthinit.com/index.php/channel/2158/aligning-agentic-intent-understanding-your-agents-purpose-vs-their-actions/
                              • 11/05/2026
                                02:00 PM
                                11/05/2026
                                HUMAN Dialogue: Embracing the Era of AI-Driven Consumers.
                                https://www.truthinit.com/index.php/channel/2160/human-dialogue-embracing-the-era-of-ai-driven-consumers/
                              • 11/05/2026
                                02:00 PM
                                11/05/2026
                                Reclaim Your Evenings: Leverage Data Intelligence to Minimize Risk and Boost AI Adoption
                                https://www.truthinit.com/index.php/channel/2172/reclaim-your-evenings-leverage-data-intelligence-to-minimize-risk-and-boost-ai-adoption/
                              • 11/19/2026
                                01:00 PM
                                11/19/2026
                                360View: Govern, Secure & Recover Your Microsoft 365 Environment
                                https://www.truthinit.com/index.php/channel/2076/360view-govern-secure-recover-your-microsoft-365-environment/
                              • 11/19/2026
                                01:00 PM
                                11/19/2026
                                Zendesk Deep Dive: Get the work done faster with Employee Service AI Agents
                                https://www.truthinit.com/index.php/channel/2181/zendesk-deep-dive-get-the-work-done-faster-with-employee-service-ai-agents/
                              Truth in IT
                              • Sponsor
                              • About Us
                              • Terms of Service
                              • Privacy Policy
                              • Contact Us
                              • Preference Management
                              Desktop version
                              Standard version