Chapter 12: Terraform Introduction

12.2 Install Terraform and check the version

By Ravindra Bagale · Last updated: 25 October 2026

Story. An Infosys client project starts every new joiner with the same first-day check: is the right Terraform on the laptop, and is the AWS CLI logged in through a role or SSO, not a pasted key. Mismatched Terraform versions on two laptops cause confusing lock-file and state upgrade messages. So install from HashiCorp's official package repository and pin the version range in code.

Steps

1. Add the HashiCorp signing key.
2. Add the HashiCorp repository.
3. Install the terraform package.
4. Run terraform version.
5. Run aws sts get-caller-identity to confirm the role.

# Ubuntu / Debian
wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt update && sudo apt install terraform

# Amazon Linux 2023
sudo dnf install -y dnf-plugins-core
sudo dnf config-manager --add-repo https://rpm.releases.hashicorp.com/AmazonLinux/hashicorp.repo
sudo dnf install -y terraform

terraform version
aws sts get-caller-identity

What each line does

• wget -O- .../gpg | sudo gpg --dearmor ... — Downloads HashiCorp's signing key so apt can trust the packages.
• echo "deb [signed-by=...] ..." | sudo tee ... — Adds the official HashiCorp apt repository for your Ubuntu release.
• sudo apt update && sudo apt install terraform — Refreshes the package list and installs Terraform.
• sudo dnf install -y dnf-plugins-core — Installs the plugin that lets dnf add repositories on Amazon Linux.
• sudo dnf config-manager --add-repo ... — Adds the HashiCorp repository for Amazon Linux.
• sudo dnf install -y terraform — Installs Terraform on Amazon Linux 2023.
• terraform version — Prints the installed Terraform version so you can compare with the team.
• aws sts get-caller-identity — Shows which AWS account and role your credentials point to, without printing any secret.

When it is green.

Terraform v1.x.y
on linux_amd64

{
    "UserId": "AROA...:ravindra",
    "Account": "<your-account-id>",
    "Arn": "arn:aws:sts::<your-account-id>:assumed-role/DevOpsLab/ravindra"
}

When it is red.

terraform: command not found

Unable to locate credentials. You can configure credentials by running "aws configure".

Fix. If terraform is not found, the repository step failed; rerun it and check the release name. For credentials, use aws sso login or an EC2 instance role. Never paste access keys into .tf files.

What: every term in plain English

• binary — Terraform is one program file. Install puts it on your PATH.
• PATH — The list of folders your shell searches for commands.
• tfenv — A tool to switch between Terraform versions.
• AWS CLI — The aws command. Terraform uses the same login.
• SSO — AWS IAM Identity Center login. Gives short-lived keys.
• sts get-caller-identity — Shows which AWS user or role you are.
• required_version — A setting that stops old Terraform versions from running your code.

Example 1: Install on Ubuntu from the HashiCorp repo

An Infosys lab machine runs Ubuntu. Use the official package repository so updates come with apt.

sudo apt-get update && sudo apt-get install -y gnupg software-properties-common curl
curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" \
  | sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt-get update && sudo apt-get install -y terraform
terraform version

Output

Terraform v1.x.x
on linux_amd64

What it shows: Your version number will be newer. Any 1.6 or later works for this course.

Example 2: Install on Amazon Linux 2023

Many teams run Terraform from an EC2 build server. Amazon Linux uses dnf.

sudo dnf install -y dnf-plugins-core
sudo dnf config-manager --add-repo https://rpm.releases.hashicorp.com/AmazonLinux/hashicorp.repo
sudo dnf install -y terraform
terraform -version
which terraform

Output

Terraform v1.x.x
on linux_amd64
/usr/bin/terraform

What it shows: On this EC2 server, attach an IAM role. Then Terraform needs no keys at all.

Example 3: Install on Windows and macOS

Laptops at a Wipro client were mixed Windows and Mac. Each has a one-line package manager install.

# Windows PowerShell
winget install HashiCorp.Terraform
terraform -version

# macOS
brew tap hashicorp/tap
brew install hashicorp/tap/terraform
terraform -version

Output

Terraform v1.x.x
on windows_amd64

Terraform v1.x.x
on darwin_arm64

What it shows: Close and reopen the terminal after install so PATH updates.

Example 4: Log in to AWS without keys in files

Never paste access keys into .tf files. Use SSO on a laptop, a role on a server.

aws configure sso
aws sso login --profile lab
export AWS_PROFILE=lab
aws sts get-caller-identity

Output

{
    "UserId": "AROAEXAMPLEID:ravi",
    "Account": "111122223333",
    "Arn": "arn:aws:sts::111122223333:assumed-role/AWSReservedSSO_Lab_abc123/ravi"
}

What it shows: assumed-role in the Arn means short-lived keys. That is what you want.

Example 5: Pin the version for the team

One teammate had Terraform 1.3 and broke a shared state. Pin a minimum in code.

terraform {
  required_version = ">= 1.6.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

tfenv install 1.5.7 && tfenv use 1.5.7
terraform init

Output

Error: Unsupported Terraform Core version
This configuration does not support Terraform version 1.5.7. To proceed,
either choose another supported Terraform version or update this version constraint.

What it shows: Switch back with tfenv use latest. The pin protects state from old versions.

Example 6: Turn on tab completion and a short alias

You will type terraform hundreds of times a day. Tab completion and a short alias save time and typos, which matters at 2 a.m. during an incident.

1. Install autocomplete once.
2. Add an alias tf.
3. Reload the shell and test.

terraform -install-autocomplete
echo "alias tf=terraform" >> ~/.bashrc
source ~/.bashrc
tf version

Output

Terraform v1.x.x
on linux_amd64

What it shows: Now type tf pl and press Tab, and the shell completes plan. Use the full word terraform in scripts and docs so everyone can read them.

Command cheat sheet

Verify: did it work?

1. Version

   terraform version | head -1
   

   Output

   Terraform v1.x.x
   

2. Identity

   aws sts get-caller-identity --query Arn --output text
   

   Output

   arn:aws:sts::111122223333:assumed-role/AWSReservedSSO_Lab_abc123/ravi
   

When it is red 1

terraform: command not found

Cause. Terraform is not on PATH.

Fix, step by step

1. Run which terraform.
2. Reopen the terminal.
3. Check the install finished without errors.

When it is red 2

Error: The SSO session associated with this profile has expired or is otherwise invalid.

Cause. SSO keys expired.

Fix, step by step

1. Run aws sso login --profile lab.
2. Run the command again.

When it is red 3

E: Unable to locate package terraform

Cause. The HashiCorp repo was not added, or apt update was skipped.

Fix, step by step

1. Add the repo line again.
2. Run sudo apt-get update.
3. Install again.

Cleanup

unset AWS_PROFILE

Practice tasks

Homework: try at home

Recap

• Install from the official HashiCorp package source.
• Check with terraform version.
• Log in with SSO or a role, never keys in files.
• Confirm the account with sts get-caller-identity.
• Pin required_version for the team.

FAQ

Do I need Docker?

No. Terraform is a single binary.

Can I use AWS CloudShell?

Yes. Install Terraform there for quick labs.

Which version should I use?

The latest 1.x. Pin a minimum in code.

What is OpenTofu?

A community fork with the tofu command. This course uses terraform.

Is the AWS CLI required?

Not strictly, but it helps for login and checks.

Interview questions

1. How do you install Terraform on a build server?

   From the HashiCorp repo with apt or dnf, version pinned.

2. How does Terraform get AWS access?

   The same chain as the AWS CLI: env vars, profile, SSO, or instance role.

3. Why not access keys in provider blocks?

   They leak into Git and never expire.

4. How do you manage many Terraform versions?

   tfenv or asdf, plus required_version in code.

5. First command before apply in a new shell?

   aws sts get-caller-identity.

Samajla ka?

Ravi Sir's Cards for this lesson

Revision cardInterview card

मराठी cards