Automating Terraform with GitHub Actions

Thu, 07 May 2026 00:00:00 +0000

Manually running terraform apply from a laptop works for learning. In the real world, infrastructure changes go through a pipeline. This is how I set one up.

The Goal

Every Pull Request → run terraform plan automatically
Every merge to main → run terraform apply automatically
AWS credentials stored securely as GitHub Secrets — never in code

Workflow File

name: Terraform CI/CD

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  terraform:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: exercise-02-variables-outputs

    steps:
      - uses: actions/checkout@v3
      - uses: hashicorp/setup-terraform@v2
      - uses: aws-actions/configure-aws-credentials@v2
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: eu-west-2

      - run: terraform init
      - run: terraform fmt -check
      - run: terraform validate
      - run: terraform plan
        if: github.event_name == 'pull_request'
      - run: terraform apply -auto-approve
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'

Problems I Hit

Workflow not showing in Actions tab — GitHub only reads workflow files from the main branch. The file needs to be merged before it’s recognised.

First Terraform Deployment on AWS

Tue, 05 May 2026 00:00:00 +0000

With the environment set up, I wrote my first real Terraform code — a complete VPC with a public subnet, security group, and an EC2 instance running nginx.

What I Built

VPC (10.0.0.0/16)
Public subnet with Internet Gateway
Security group (SSH + HTTP)
EC2 instance (Ubuntu 24.04)
SSH key pair

File Structure

exercise-02-variables-outputs/
├── main.tf
├── variables.tf
├── locals.tf
├── outputs.tf
├── data.tf
├── key.tf
└── terraform.tfvars

Separating resources into logical files keeps things clean and readable.