Terraform vs Ansible: what each is for and how they fit together

The short answer

Terraform and OpenTofu create and manage infrastructure resources: networks, virtual machines, load balancers, DNS records, managed databases. Ansible configures what runs on machines: packages, files, users, services. They overlap at the edges, which is why the comparison confuses people, but they have different strengths.

What Terraform and OpenTofu do well

Terraform is declarative. You describe the resources you want, it compares that with a recorded state, and it shows a plan of what will be created, changed, or destroyed before it acts. That plan-and-apply loop, combined with a large ecosystem of providers for cloud platforms and services, makes it a strong fit for provisioning.

OpenTofu is a community-governed fork of Terraform, created after HashiCorp changed Terraform's license in 2023. For most work the two are interchangeable, and the practices in this article apply to both.

What Ansible does well

Ansible runs tasks against hosts, usually over SSH, without requiring an agent on the target. Playbooks are written in YAML, and most modules are idempotent, meaning that running them again leaves a correctly configured machine unchanged. That makes it a good fit for operating-system configuration, application setup, patching, and orchestrating ordered steps across a fleet.

Where they overlap, and why it matters

Ansible has modules that create cloud resources, and Terraform can run scripts on machines through provisioners. Both are possible, and both tend to cause trouble. Ansible does not keep a state of the resources it created, so it cannot tell you what has drifted or should be removed. Terraform's own documentation treats provisioners as a last resort, because a script that runs once at creation is not a model of the machine's ongoing configuration.

How they fit together

A common and clean division is to let Terraform create the infrastructure and publish its addresses, then let Ansible configure the machines it created.

terraform apply
terraform output -json > outputs.json
ansible-playbook -i inventory.ini site.yml

Choose by the problem

Use Terraform or OpenTofu when you need to:

• Create, change, and delete cloud or virtualization resources repeatably.
• See a plan of changes before applying them, and track what exists in state.
• Manage resources across providers with one workflow.

And use Ansible when you need to:

• Install packages, manage files and services, and harden hosts.
• Configure long-lived servers or virtual machines consistently.
• Run ordered operational procedures such as rolling restarts and patch windows.

Fewer machines to configure

It is worth noting that the more of your estate runs as containers or from prebuilt machine images, the less configuration management you need at runtime. Baking an image once and provisioning it with Terraform often replaces a long playbook. Ansible remains valuable for the machines you do keep, and for building those images.

Habits that keep both healthy

• Give each resource one owner. Do not have both tools manage the same thing.
• Keep both in version control and run them from a pipeline, with plans reviewed in pull requests.
• Keep secrets out of code and out of state where possible.
• Start with a small slice and expand as the process proves itself.