Install Terraform (Windows, macOS, Linux)

What Terraform actually is

Terraform is a declarative infrastructure-as-code tool: you describe the end state you want (a VM, a bucket, a VPC) in configuration files, and Terraform figures out the sequence of API calls needed to make reality match that description — you don't script the individual steps yourself.

It talks to a cloud or platform through a provider — a plugin (AWS, Azure, GCP, even Cisco ACI/Meraki) that translates Terraform's generic resource language into that platform's specific API calls. The CLI itself has no built-in knowledge of any one cloud; providers are downloaded per-project on 'terraform init'.

Terraform tracks what it's already created in a state file (terraform.tfstate) — this is how it knows the difference between 'create this' and 'this already exists, leave it alone' on every subsequent run. Losing or corrupting state is one of the most disruptive things that can happen to a real Terraform project, which is why remote state (covered in the AWS/Azure guides) matters well before a team grows past one person.

What you're actually installing

Terraform ships as a single self-contained binary — no runtime, no background service, nothing to configure just to get it running. Installing it means getting that one executable onto your PATH so your shell can find it from any directory.

Windows

winget install HashiCorp.Terraform
terraform -version

Windows (no winget / older Windows)

winget ships with the App Installer package and is standard on current Windows 10/11, but if it's missing: download the Windows zip directly from HashiCorp's release page, extract it, and manually add the extracted folder to your PATH via System Properties → Environment Variables — then open a NEW terminal window, since existing ones won't see the updated PATH.

macOS (Homebrew)

brew tap hashicorp/tap
brew install hashicorp/tap/terraform
terraform -version

Linux (Debian/Ubuntu, apt)

wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt update && sudo apt install terraform
terraform -version

Linux (Fedora/RHEL/CentOS, dnf)

sudo dnf install -y dnf-plugins-core
sudo dnf config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
sudo dnf install terraform
terraform -version

Managing multiple versions with tfenv (optional)

Real projects sometimes pin an exact Terraform version in a .terraform-version file or a required_version constraint. tfenv (a separate, optional tool — install via 'brew install tfenv' on macOS or from its GitHub repo on Linux) lets you install and switch between multiple Terraform versions without manually replacing the binary every time you change projects: 'tfenv install 1.7.5' then 'tfenv use 1.7.5'.

You don't need this for CCNA-level familiarity — it matters once you're regularly working across multiple real projects that pin different versions.

Verify the install

Run terraform -version. You should see a version number print immediately with no errors — that confirms the binary is on PATH and executable.

Run terraform -help once to see the full command list. You don't need to memorize it; you'll use init, plan, apply, and destroy for the overwhelming majority of real work.

General install hygiene

Avoid installing via a random downloaded zip and forgetting to add the extracted folder to PATH — the OS-specific package managers above handle this automatically, which is exactly why they're the recommended path over a manual download.

Let the package manager pull the current stable release rather than an old version pinned in a tutorial from years ago, unless a specific real project pins an older version for a genuine compatibility reason.

Why this is worth getting right on day one

This install is the boring five minutes standing between you and everything else Terraform actually does — but a shaky one is exactly how a stale binary shadowing a new one, or a PATH that only works in one terminal tab, turns into a confusing "it works on my machine but not in CI" problem weeks later, at a much worse time to debug it. Getting the install genuinely clean now — confirmed with `terraform -version`, confirmed on PATH with `which`/`where`, no leftover second copy — means the next time something breaks, you already know it isn't this.