> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anyshift.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Terraform

> Anyshift ingests your Terraform code and state, then correlates them against live cloud infrastructure to power drift detection, impact analysis, and code-to-infra queries.

## Overview

Anyshift treats Terraform as a first-class citizen. Annie reads your **code** (modules, resources, variables) and your **state** (`.tfstate` files from S3 or HCP Terraform Cloud), and links both to the actual cloud resources they manage.

<CardGroup cols={2}>
  <Card title="Code" icon="code">
    HCL parsed from your connected Git repositories: modules, resources, data sources, variables, outputs, and inter-module references.
  </Card>

  <Card title="State" icon="database">
    `.tfstate` ingested from S3 buckets and HCP Terraform Cloud workspaces. Managed instances are linked back to their declarations and forward to the live cloud resources they manage.
  </Card>
</CardGroup>

## How It Connects

Once your Terraform code and state are both connected, Annie builds this chain in her knowledge graph:

<img src="https://mintcdn.com/anyshift/LDU-qrcdNwKzq2j9/images/graphs/tf_chain.svg?fit=max&auto=format&n=LDU-qrcdNwKzq2j9&q=85&s=cc75b7646de571d4eee065bb0da3259f" alt="A Terraform module declaration is instantiated as a state entry, which manages a live AWS VPC" style={{ width: '100%', maxWidth: '620px', margin: '1.5rem auto', display: 'block' }} width="620" height="560" data-path="images/graphs/tf_chain.svg" />

That chain is what lets you ask questions across layers, from code, to state, to the running resource, without leaving the chat.

## Connecting Your Terraform

<CardGroup cols={2}>
  <Card title="Git (code)" icon="github" href="/pages/integration/github">
    Connect GitHub or GitLab to ingest your Terraform modules, resources, and references.
  </Card>

  <Card title="HCP Terraform (state)" icon="network-wired" href="/pages/integration/hcp">
    Connect HashiCorp Cloud Platform workspaces to ingest state from HCP Terraform Cloud.
  </Card>
</CardGroup>

<Note>
  **S3 state buckets are auto-discovered.**

  If your Terraform state lives in S3, there's nothing extra to configure. Once your AWS account is connected, Annie detects state buckets automatically from your ingested Terraform backend blocks and from AWS API extraction. You'll see them in the Anyshift app under Integrations → Terraform Backends.
</Note>

## What You Can Ask Annie

<AccordionGroup>
  <Accordion icon="code" title="Code and module questions">
    * *"Which resources are managed by Terraform vs. manually?"*
    * *"Show me all modules that use the `aws_instance` resource"*
    * *"Which workspaces deploy to the `prod` environment?"*
    * *"What variables does the networking module expose?"*
  </Accordion>

  <Accordion icon="diagram-project" title="Dependency & impact">
    * *"What resources depend on this module?"*
    * *"If I destroy this VPC, what breaks?"*
    * *"Which services will be affected by changing this security group rule?"*
  </Accordion>

  <Accordion icon="code-compare" title="Drift">
    * *"What resources were modified outside of Terraform?"*
    * *"Which live resources are not in any state file?"*

    See the [Drift Detection](/pages/iac/drift_detection) page for more.
  </Accordion>
</AccordionGroup>

## Real-World Examples

<AccordionGroup>
  <Accordion icon="rocket" title="Post-Apply Validation">
    I just ran `terraform apply` and want to verify what actually changed.

    *"What changed in the last 30 minutes?"*

    > I found 5 resources updated:
    >
    > * `aws_instance.prod-api-1`: instance\_type → t3.large
    > * `aws_instance.prod-api-2`: instance\_type → t3.large
    > * `aws_autoscaling_group.prod-api-asg`: desired\_capacity → 4
    > * `aws_lb_target_group.prod-api-tg`: 2 new targets
    > * `aws_cloudwatch_metric_alarm.prod-api-cpu`: threshold → 80
    >
    > All changes match your most recent plan.
  </Accordion>

  <Accordion icon="fire" title="Module Blast Radius">
    I'm about to refactor a shared module and want to know what depends on it.

    *"What uses the `shared-networking` module?"*

    > 14 workspaces reference `shared-networking`:
    >
    > * `platform-prod` (3 VPCs, 12 subnets)
    > * `data-prod` (1 VPC, 6 subnets)
    > * `security-prod` (consumes outputs: vpc\_id, private\_subnets)
    > * ...
    >
    > Breaking changes to the outputs will require coordinated updates.
  </Accordion>
</AccordionGroup>

## Get Started

<CardGroup cols={2}>
  <Card title="Connect a Git provider" icon="github" href="/pages/integration/github">
    Ingest your Terraform code.
  </Card>

  <Card title="Connect a state backend" icon="network-wired" href="/pages/integration/hcp">
    Ingest your Terraform state from HCP (S3 is auto-detected).
  </Card>
</CardGroup>