Terraform is infrastructure-as-code software that lets teams define cloud resources in declarative configuration files. Instead of clicking through a console, operators describe the desired state of servers, networks, databases, and permissions, and Terraform compares that state to what exists before creating or changing resources. It uses providers to talk to cloud platforms and can also consume reusable modules from registries.
In cyber security, Terraform matters because it controls high-trust infrastructure: IAM roles, network boundaries, secrets handling, and deployment pathways. If an attacker can alter a module, provider, or registry path, they may influence how environments are provisioned, exposed, or initialized. That is why compromised registries and tampered build inputs are dangerous in Terraform workflows. Defenders reduce risk by reviewing configuration changes, pinning versions, protecting state files, restricting registry sources, and using mirrors or private registries when upstream integrity is uncertain.