Using Terraform Workspaces for Multi-Environment DevOps Management

One of the challenges DevOps teams face the most when managing their infrastructure is maintaining different environments (e.g. staging, testing, production) in an efficient and scalable way.

Terraform, the leading infrastructure as code (IaC) tool, offers significant help in that regard, simplifying how you can deploy and manage infrastructure. One feature that’s particularly useful for multi-environment management is Terraform workspaces, which enables users to isolate states for different environments, without having to create entirely new configurations.

Let’s explore how Terraform workspaces work, and how DevOps teams can utilize them for better environment management.

How Terraform Workspaces Work

In Terraform, states are the core files that store information about the current infrastructure under management.

A workspace is like a separate "instance" of Terraform's state files. Here, each workspace maintains its own state file, meaning that when you're working in dev, it doesn't affect prod or staging, and vice versa.

When a workspace is selected, Terraform loads the corresponding state, ensuring that any changes or deployments only affect that specific environment. The active workspace can be retrieved using the built-in terraform.workspace variable.

All teams have to do is switch between the workspaces based on the environment they are working on. DevOps can apply changes, test updates, and manage resources for the environment they’re in, without interfering with other deployments.

Advantages of Terraform Workspaces in Multi-Environment Setups

The main advantage of using workspaces in your Terraform setups is that you won’t have to create multiple configurations across dev, prod, testing, staging, or any other environment. Creating and managing many different configurations typically leads to configuration drift and forces teams to manually track state files for each environment, making infrastructure management inefficient and harder to scale.

Terraform workspaces allow DevOps to work within a single configuration file, while maintaining separate state files for each environment. DevOps teams can work confidently knowing that they won’t accidentally deploy testing configurations to production.

Since everything happens in a single Terraform project, collaboration and version control is significantly easier. All environments share the same Terraform files, making it simple to track changes and roll back if necessary.

Even environments from different cloud platforms can be managed in the same project by creating workspaces. As hybrid and multi-cloud deployments become more popular, DevOps can easily apply platform-specific settings without duplicating Terraform configurations or creating unique repositories for every cloud instance.

Implementing Terraform Workspaces Step-by-Step

Setting up different workspaces in Terraform is fairly straightforward. A new workspace can be created with the following command: terraform workspace new <workspace_name>. To switch between existing workspaces, use terraform workspace select <workspace_name>. Once a workspace is created, it will have its own isolated Terraform state file.

To effectively use workspaces, structure your Terraform configuration so that environment-specific values are dynamically assigned. This can be done using conditional logic or variable files. You can use the terraform.workspace built-in variable to define environment-specific configurations dynamically.

The final step is to apply the configuration within a specific workspace. Since every workspace has a unique state file, changes made in one workspace don’t affect the others.

To apply your configuration, select the workspace you want, and enter the Terraform plan command to see what changes Terraform will make to the infrastructure in that specific workspace. After reviewing the plan, apply the configuration.

It’s important to follow a few best practices to maximize the benefits of Terraform workspaces. Role-based access control (RBAC) should be strictly enforced so that only authorized DevOps members can make changes to states. Additionally, teams should follow strict workspace-specific policies to maintain compliance and consistency.

Alternatives to Terraform Workspaces

Workspaces aren’t the only way to manage multiple environments in Terraform. Depending on your use case, a different approach may be more suitable.

In some cases, strict environment isolation is necessary, which would make the approach of creating separate directories per environment a better choice. The scenarios where you’d want that are rare, but it could happen for compliance purposes in sensitive industries, or in large enterprises where multiple teams work on different parts of the infrastructure.

Organizations are often required to host production infrastructure in separate geographic regions due to compliance and online privacy laws. In those cases, workspaces will not be sufficient since they share the same Terraform backend.

Another method is using Terraform modules. With modules, you can create reusable infrastructure components that can be applied across environments. This is a nice balance of having some standardization without sacrificing flexibility.