Complementary stack part 3: Terraform and CMP

Provisioning is not the same job as governing

Part 2 of the Complementary Stack Series examined Ansible and the distinction between executing automation and governing the larger request. Part 3 moves to the infrastructure provisioning layer with Terraform.

Terraform’s strength is clear: it turns infrastructure into declarative, versioned code, previews changes before they happen, maintains state, and provisions infrastructure consistently across platforms. HCP Terraform builds on those capabilities with centralized state, coordinated runs, no-code provisioning, and policy enforcement.

But provisioning infrastructure is only one part of the lifecycle. This brief explores what happens before a Terraform run begins and after it ends: approvals, ownership, cost controls, tagging, cross-tool workflows, and ongoing lifecycle management. That’s where the distinction between provisioning and governance becomes important.

In this brief, you’ll learn:

• Where Terraform fits within the broader platform engineering stack
• What no-code provisioning and Sentinel policy checks add to HCP Terraform
• Why Terraform state and CMP resource governance answer different questions
• How CloudBolt can govern requests before Terraform runs and manage resources afterward
• How Terraform and CMP can work together without rebuilding existing modules or workflows

In this model, Terraform continues to own the plan, apply, and state, while CloudBolt manages the approval chain, cost estimate, ownership, and lifecycle surrounding it.

Next in the series: Part 4 moves from infrastructure provisioning to the developer experience and examines the relationship between Backstage, developer catalogs, and CMP.

Read part 1 | Read part 2 | Read part 4 | Read part 5

Download PDF