Terraform

What it does

Buddy runs Terraform and OpenTofu as native pipeline actions instead of shell scripts. Terraform Plan shows what will change, Terraform Apply deploys the saved plan, and Terraform Drift Detection finds resources changed outside of Terraform. For anything else there is Terraform CLI, which runs any command with the tool preinstalled. No runners to maintain, no wrapper scripts to parse the output, no state file passed around by hand.

How it works

Push a change to your .tf files and the pipeline runs Plan in the working directory you point at. The action saves the plan file and renders a resource diff in the run view, with counters for resources to add, change, replace and destroy exported as output variables. An Approval action can pause the run until someone reviews the diff, either on every run or only when the plan destroys or replaces something. Apply then executes exactly the plan that was reviewed, not a fresh one, so what was approved is what gets deployed.

The state lives where you choose: a Buddy artifact with locking, Amazon S3 or Google Cloud Storage through an integration, or your own backend configured in code. Credentials for AWS and Google come from Buddy integrations, secrets from encrypted variables, inputs from TF_VAR_ variables or tfvars files.

Action preview

PlanApplyDrift DetectionState backendVariablesConditionsOptions

Image loading...

Why run Terraform in a Buddy pipeline

A Terraform workflow has three risky moments: a plan nobody read, an apply that ran on a different plan than the one reviewed, and infrastructure drifting away from the code between runs. The actions address each one. Plan output is structured, not a wall of text, so a reviewer sees at a glance that two resources will be destroyed. Apply consumes the plan file from the preceding action, which rules out a surprise change between review and deploy. Drift Detection runs on a schedule, compares the real resources with the state and either fails the run or just reports, with the list of drifted resources available to a notification or a ticket.

Everything runs in Buddy's agentic cloud. The pipeline can be started by a push, a schedule, an API call or an AI agent working in a sandbox, and the result is the same every time: the same tool version, the same backend, the same approval rules. Terraform and OpenTofu are interchangeable in the configuration, so switching the tool is a change of one field, not a rewrite of the pipeline.

Terraform Action Features

• Choose the tool: OpenTofu, open-source Terraform up to 1.5.7, or a custom binary in your own Docker image, pinned to a specific version
• Keep the state in a Buddy artifact, Amazon S3, Google Cloud Storage or a custom backend defined in your code
• Review a structured resource diff and gate Apply with an approval step, only for destructive changes if you prefer
• Apply the saved plan file from the preceding Plan action
• Run Drift Detection on a schedule and fail the run or just report when the infrastructure no longer matches the state
• Target several environments with Terraform workspaces, separate backends or one pipeline per directory
• Pass -var-file, -parallelism and other flags through additional arguments
• Run the actions conditionally: on each execution, only when the infrastructure directory changed since the last run, or when a variable has a specific value
• Define everything in YAML and manage it through the REST API, with the same parameters as in the GUI

More about Terraform

• Terraform and OpenTofu in Buddy: quickstart
• Plan, Apply and Drift Detection in detail
• YAML parameters of the Terraform actions
• Terraform Plan, Apply and Drift Detection announcement