Terraform or Ansible? Drawing the line
Both tools can configure infrastructure. Using each for what it does best keeps automation simple and predictable.
Teams new to infrastructure as code often ask which tool to standardise on. The better question is where to draw the line between them.
What each tool is good at
Terraform is declarative and keeps state. You describe what should exist — virtual machines, networks, cloud resources, DNS records — and Terraform works out what to create, change or destroy to get there. It is best at provisioning: bringing things into existence and tracking them.
Ansible is procedural and stateless. It connects to systems (over SSH, WinRM or a network device API) and runs tasks in order. It is best at configuration: what goes inside the things Terraform created — packages, services, device configuration.
A boundary that works
- Terraform creates the VM, its network interfaces and its DNS record.
- Terraform outputs an inventory (hostnames, IP addresses, roles).
- Ansible reads that inventory and configures the operating system and applications.
For network devices the same split applies: Terraform can create a lab topology or cloud network, and Ansible pushes VLANs, routing and device policy.
Signs the line is in the wrong place
- Terraform runs shell scripts through provisioners to install software. Move that to Ansible.
- Ansible playbooks create and delete cloud resources and keep track of them in variables. Move that to Terraform.
- Nobody can tell which tool last changed a setting. Pick one owner for every setting.
Next in this track: putting both tools behind a pipeline with review and approval gates.