Courseiva
TF-003Chapter 2 of 15Objective 1.2

Terraform Core Components and Architecture

What is the single biggest headache when building modern IT infrastructure? It is keeping everything consistent and reproducible. For the TF-003 exam, understanding how Terraform's core parts interact is vital because it forms the foundation of everything else you will learn. Without grasping how the CLI, Cloud, and Enterprise fit together, you will struggle to understand how Terraform actually operates in real-world scenarios.

12 min read
Beginner
Updated Jul 23, 2026
Editorial oversight: Johnson Ajibi· Security Systems Architect · MSc IT Security · IEEE Senior Member

A simple way to picture Terraform Core Components and Architecture

The City Planning Department Analogy

Ever wondered how a city gets built without everything collapsing into chaos? Imagine you are the head of a city planning department. Your job is to describe exactly what the city should look like—every building, road, and park—in a single blueprint. You do not build anything yourself; you write the plan. Terraform is like that blueprint. It is a tool that lets you describe your entire IT infrastructure (servers, databases, networks) in a set of files, just like an architect draws up plans for a city.

Now, think of your construction crew as the Terraform CLI (Command Line Interface). You hand them the blueprint, and they follow it precisely to build the city. They do not guess; they execute your instructions to create, change, or demolish structures. But what if you need to manage multiple cities at once, or collaborate with other planners across the world? That is where Terraform Cloud and Terraform Enterprise come in. Terraform Cloud is like a shared online office where your whole team can store blueprints, track changes, and run construction jobs without fighting over paper copies. Terraform Enterprise is the deluxe version for huge government agencies—it adds extra security, compliance rules, and custom controls so you can manage the entire national infrastructure safely.

How It Actually Works

Terraform is an Infrastructure as Code (IaC) tool. That means you write code to define your infrastructure—servers, databases, networks, and more—instead of clicking around in a web console. Think of it as writing a recipe for your infrastructure instead of baking a cake from scratch each time. The three core components covered in this chapter are the Terraform CLI (Command Line Interface), Terraform Cloud, and Terraform Enterprise. Each plays a different role, but they all work together to help you manage infrastructure reliably and efficiently.

The Terraform CLI is a command-line program you run on your computer. You type commands like 'terraform init', 'terraform plan', and 'terraform apply' to tell Terraform what to do. When you run 'terraform init', it downloads the necessary provider plugins—think of these as drivers that allow Terraform to talk to different services like AWS, Microsoft Azure, or Google Cloud. 'terraform plan' shows you what changes will be made without actually doing anything—like a preview before you hit save. 'terraform apply' then executes those changes, creating or modifying your infrastructure exactly as you defined. The CLI also manages your state file, which is a record of what your infrastructure currently looks like. Imagine keeping a log of every brick laid in your city—the state file is that log. It helps Terraform know what already exists so it does not try to build something twice or delete something it should not.

Terraform Cloud is a Software as a Service (SaaS) platform provided by HashiCorp. It adds collaboration, version control, and remote execution to Terraform. Instead of running everything on your laptop, you can connect your Terraform configuration (the blueprint) to Terraform Cloud. It will run the CLI for you in a secure environment, store your state file safely, and let you work with your team without stepping on each other's toes. For the exam, remember two key features of Terraform Cloud: remote state storage and remote operations. Remote state storage means your state file lives in the cloud, accessible by authorised people. This prevents conflicts like two team members accidentally overwriting each other's work. Remote operations allow you to run Terraform plans and applies from the cloud, so you do not need to have the CLI on your machine—anyone with the right permissions can trigger a run through a web interface or API.

Terraform Enterprise is the self-hosted version of Terraform Cloud. Think of it as running your own internal version of Terraform Cloud inside your company's own data centre. This is for large organisations that need strict control over their data, compliance with specific regulations, or custom integrations. For example, a bank might use Terraform Enterprise to ensure all infrastructure changes are audited and logged according to financial industry rules. The core functionality is the same as Terraform Cloud, but it is installed on your own servers behind your firewall.

How do these three components interact? Typically, a developer writes a Terraform configuration (a set of .tf files) on their local machine. They use the Terraform CLI to test and debug changes. When they are ready, they push the configuration to a version control system like Git. Terraform Cloud or Enterprise can be linked to that Git repository so that every time someone merges a change, Terraform automatically runs a plan. If the plan looks good, an administrator can approve and apply it. The state file is centrally managed, so every team member knows the current state of the infrastructure. This collaboration model replaces the old way of manually configuring servers via command line or web consoles, which was slow, error-prone, and hard to reproduce.

Flowchart showing the typical Terraform workflow from writing configuration to applying changes and storing state remotely.

Walk-Through

1

Write Configuration

You write .tf files defining your infrastructure using HashiCorp Configuration Language (HCL). This is the blueprint phase, analogous to an architect drawing plans before construction begins.

2

Initialise with Terraform Init

Run 'terraform init' in your terminal. This downloads the required provider plugins (e.g., AWS, Azure) and sets up the backend for storing state. Without this step, Terraform cannot interact with cloud providers.

3

Plan Changes with Terraform Plan

Run 'terraform plan' to see a preview of what will be created, modified, or destroyed. This is a safety net—it shows you the outcome without making any actual changes, allowing you to catch mistakes early.

4

Apply Changes with Terraform Apply

Run 'terraform apply' to execute the plan. Terraform communicates with the cloud provider’s API to create or modify resources. It updates the state file to reflect the new infrastructure.

5

Collaborate via Terraform Cloud/Enterprise

Push your configuration to a Git repository connected to Terraform Cloud or Enterprise. The platform automatically runs a plan, stores the state remotely, and provides a web interface for approvals and auditing.

6

Manage Drift and Updates

Over time, infrastructure may change manually or drift from the Terraform configuration. Use 'terraform plan' regularly to detect drift, and re-apply to restore desired state. Terraform Cloud can also send notifications if drift is detected.

What This Looks Like on the Job

An IT professional at a mid-sized e-commerce company uses Terraform to manage their cloud infrastructure. They have three environments: development, staging, and production. Without Terraform, they would have to set up each environment manually through the AWS console, clicking buttons to create virtual servers, load balancers, and databases. This is not only tedious but also risky—a forgotten step could lead to a security vulnerability or an outage.

Here is how they use Terraform Core Components and Architecture in their daily work:

The senior DevOps engineer writes a Terraform configuration for a new microservice. They define the necessary compute instances using the AWS provider, a database using the RDS provider, and a virtual private cloud (VPC) for network isolation.

They run 'terraform init' to download the AWS and RDS provider plugins.

They run 'terraform plan' to see that Terraform will create two new EC2 instances, one RDS database, and a VPC with subnets.

They commit the configuration to a Git repository, and a webhook triggers Terraform Cloud to run a plan on the development branch.

The team reviews the plan output in Terraform Cloud's web interface. One developer notices that the database is not configured for automated backups. They update the configuration and push a fix.

After approval, Terraform Cloud runs 'terraform apply' automatically, creating the infrastructure. The state file is stored securely in Terraform Cloud, so anyone on the team can see exactly what was built.

When the feature is ready for production, the team merges the code into the main branch. Terraform Cloud runs a new plan for the production workspace. The operations manager reviews and approves the changes.

Weeks later, a security update requires all databases to have encryption enabled. The engineer modifies the configuration to add 'encryption = true' and applies it across all environments with one command.

This scenario demonstrates why the core components matter. The CLI empowers the individual to write and test code. Terraform Cloud enables collaboration and automation. Terraform Enterprise would be used instead if the company needed to run everything on-premises for regulatory reasons. Without these components working together, the engineer would be back to manually re-creating everything each time, increasing the chance of human error and slowing down deployments.

How TF-003 Actually Tests This

The TF-003 exam tests your understanding of how Terraform’s core components differ and how they interact. Expect multiple-choice questions that ask you to match a scenario with the correct component. The exam loves to test your knowledge of specific features: 'Which component provides remote state storage?' 'What is the difference between Free and Team tiers in Terraform Cloud?' 'When would you choose Terraform Enterprise over Terraform Cloud?'

Here are the exact concepts and traps to watch for:

Trap: Confusing Terraform Cloud with Terraform Enterprise. The exam might present a scenario about a small startup and ask which to use. Remember: Cloud is SaaS (hosted by HashiCorp), Enterprise is self-hosted on your own infrastructure.

Trap: Thinking the CLI is obsolete when using Cloud or Enterprise. The CLI is still essential for local development and testing—Cloud/Enterprise just adds orchestration and collaboration.

Trap: Assuming remote state storage is only available in paid tiers. Terraform Cloud’s free tier includes remote state storage for up to 500 resources.

Trap: Mixing up 'remote operations' with 'remote state storage'. Remote operations means running plans/applies in the cloud; remote state storage means storing the state file in the cloud.

Key definitions to memorise for the exam:

Terraform CLI: The command-line tool used to write, plan, and apply infrastructure changes.

Terraform Cloud: SaaS platform that adds collaboration, remote state, and remote operations.

Terraform Enterprise: Self-hosted version of Terraform Cloud for organisations with strict compliance or data sovereignty needs.

'terraform init': Initialises a working directory containing Terraform configuration files. Downloads required providers.

'terraform plan': Creates an execution plan showing what will be changed.

'terraform apply': Executes the actions proposed in a plan.

State file: A JSON file that maps Terraform configuration to real-world resources. Used for tracking changes and detecting drift.

Expect questions about the benefits of using Terraform Cloud over running CLI solo: shared state, role-based access control (RBAC), version control integration, and a web-based interface for approvals. Also be ready to answer why an organisation would choose Terraform Enterprise—primarily because of data residency, compliance, or the need to integrate with existing on-premises authentication systems.

Key Takeaways

Terraform CLI is the core tool that executes infrastructure changes, while Terraform Cloud and Enterprise add collaboration, remote state management, and automation on top of it.

Terraform Cloud is a SaaS platform hosted by HashiCorp, whereas Terraform Enterprise is self-hosted on your own infrastructure for compliance or data sovereignty needs.

Remote state storage in Terraform Cloud prevents team conflicts by centralising the state file, making it accessible to authorised users only.

Remote operations allow Terraform plans and applies to run in the cloud, decoupling execution from your local machine.

The Terraform state file is essential for tracking existing resources and must never be deleted or edited manually.

Terraform Cloud’s free tier includes state management for up to 500 resources, making it accessible for small projects.

Version control integration is a key feature of Terraform Cloud/Enterprise, enabling automated runs when code changes are pushed.

Choosing between Cloud and Enterprise depends on deployment requirements, not on which has more features.

RBAC (Role-Based Access Control) in Terraform Cloud/Enterprise lets you control who can view, plan, or apply infrastructure changes.

Terraform Core Components are designed to work together: the CLI for local development, Cloud/Enterprise for team collaboration and security.

Easy to Mix Up

These come up on the exam all the time. Here's how to tell them apart.

Terraform CLI

Runs locally on your machine

No built-in team collaboration features

State stored locally by default

Terraform Cloud

SaaS platform hosted by HashiCorp

Built-in RBAC, version control integration, approvals

Remote state storage and remote operations

Terraform Cloud

SaaS – no infrastructure to manage

Hosted and maintained by HashiCorp

Multi-tenant environment

Terraform Enterprise

Self-hosted on your own servers

Full control over data and compliance

Single-tenant, behind your firewall

terraform plan

Creates a preview of changes

Does not modify any infrastructure

Safe to run multiple times

terraform apply

Executes the changes proposed in the plan

Modifies real infrastructure

Requires approval in Terraform Cloud

State file stored locally

Single-user only

Risk of loss if local machine fails

No collaboration

State file stored remotely

Team collaboration possible

Backed up and versioned

Lockable to prevent conflicts

Watch Out for These

Mistake

Terraform Cloud and Terraform Enterprise are completely different products with no shared codebase.

Correct

Terraform Enterprise is essentially a self-hosted version of Terraform Cloud with additional features for large-scale enterprise needs.

People see the separate names and assume they are unrelated, similar to how different cloud providers offer fundamentally different services.

Mistake

Once you start using Terraform Cloud, you never need to use the Terraform CLI again.

Correct

The CLI is still used for local development, testing, and debugging before pushing configuration to Terraform Cloud.

Beginners think cloud services replace local tools entirely, not realising they complement each other.

Mistake

Terraform Enterprise is always more powerful and feature-rich than Terraform Cloud.

Correct

Terraform Cloud often receives new features first because it is a SaaS product, while Terraform Enterprise may lag behind due to self-hosted deployment complexities.

The word 'Enterprise' sounds like a premium product, so people assume it is superior in every way, but it is actually about deployment model, not feature parity.

Mistake

The state file is only needed for the first deployment, after which it can be deleted.

Correct

The state file is critical for every subsequent operation because it tracks what resources exist, preventing duplicates and enabling deletions.

Beginners think state is a one-time setup, but it is actually the ongoing source of truth for Terraform’s management of infrastructure.

Mistake

Terraform Cloud and Terraform Enterprise cannot be used with version control systems like Git.

Correct

Both integrate deeply with Git—changes pushed to a branch can automatically trigger Terraform plans and applies.

Some think cloud solutions are isolated, but they are designed to work with standard development workflows.

Mistake

Remote state storage and remote operations are the same feature in Terraform Cloud.

Correct

Remote state storage is about where the state file is kept; remote operations is about where the Terraform commands are executed.

The words 'remote' and 'state' often get conflated, leading to confusion about what each feature actually does.

Do You Actually Know This?

Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.

Frequently Asked Questions

What is the difference between Terraform Cloud and Terraform Enterprise?

Terraform Cloud is a Software as a Service (SaaS) hosted by HashiCorp. Terraform Enterprise is the self-hosted version that you run on your own infrastructure, typically for compliance, data residency, or custom integration needs.

Do I have to use Terraform Cloud or can I just use the CLI?

You can absolutely use only the CLI for personal projects or small teams. Terraform Cloud adds collaboration, remote state management, and automation, but it is not mandatory. The exam expects you to know when each is appropriate.

Is Terraform Enterprise more powerful than Terraform Cloud?

No. Terraform Cloud often gets new features first because it is a SaaS product. Terraform Enterprise may have a slight delay in receiving updates due to the need to package and test the software for on-premises deployments.

What does 'remote state storage' mean in plain English?

It means your state file is stored in the cloud (like Terraform Cloud) instead of on your local machine. This allows your team to share a single source of truth and prevents conflicts from multiple people making changes.

Can I use Terraform Cloud with GitLab or Azure DevOps?

Yes, Terraform Cloud integrates with many version control systems including GitHub, GitLab, Bitbucket, and Azure DevOps. The integration allows automatic plan generation when code is pushed.

What happens if I delete the state file?

If you delete the state file, Terraform loses track of what resources it manages. It cannot detect existing resources or know what to destroy. You would have to manually import each resource or start over.

Terms Worth Knowing

Keep going

You've finished Terraform Core Components and Architecture. Continue through the TF-003 study guide to build a complete picture of the exam.

Done with this chapter?