Hello everyone! Today, we’ll dive deep into the major updates for Terraform, which has become even more powerful in 2025, along with a thorough examination of the major version changes (v20 โ v21) for our most familiar AWS Provider and EKS module.
The Terraform ecosystem in 2025 can be summarized by three key themes: AI Integration, Enhanced Developer Experience, and Strengthened Security. These updates go beyond merely adding features; they are evolving the very way we manage infrastructure as code. It’s crucial to understand the overall flow as we examine each change. ๐
๐ฎ 1. Revolutionary Changes in Terraform Core (2025 Updates)
Remarkable changes have begun with Terraform’s core functionalities, its very heart.
๐ง 1. AI-Powered Code Suggestions and Analysis (Experimental Introduction)
Terraform has now gained a smart AI assistant. When you run `terraform plan`, the AI analyzes infrastructure changes to proactively detect and warn about unexpected cost spikes, security vulnerabilities, and inefficient resource configurations. The VS Code extension even integrates features that recommend or auto-complete necessary resource code based solely on comments or variable names, maximizing productivity.
โจ 2. Stabilization of config-driven import and refactor blocks (GA)
Importing existing infrastructure into Terraform code used to be a cumbersome manual process. However, with the declarative definition of `import` blocks within HCL code, existing resources can now be brought under code management as naturally as creating new ones.
Furthermore, the `refactor` block, which goes beyond the `moved` block, has been officially introduced. This allows for complex code refactoring, such as grouping multiple resources into a single module, to be performed safely without the risks associated with state files, beyond just renaming resources.
Example: Refactoring multiple EC2 instances into a module
### BEFORE: ๊ฐ๋ณ ๋ฆฌ์์ค ์ ์ ###
resource "aws_instance" "web_1" {
ami = "ami-0c55b159cbfafe1f0"
instance_type = "t2.micro"
}
resource "aws_instance" "web_2" {
ami = "ami-0c55b159cbfafe1f0"
instance_type = "t2.micro"
}
### AFTER: ๋ชจ๋๋ก ๋ฆฌํฉํ ๋ง ๋ฐ refactor ๋ธ๋ก ์ฌ์ฉ ###
module "web_servers" {
source = "./modules/ec2_instance"
instance_count = 2
ami = "ami-0c55b159cbfafe1f0"
instance_type = "t2.micro"
}
# The refactor block that informs Terraform of state changes
refactor {
from = aws_instance.web_1
to = module.web_servers.aws_instance.this[0]
}
refactor {
from = aws_instance.web_2
to = module.web_servers.aws_instance.this[1]
}๐ 3. Enhanced State File Performance and Security
The state file locking contention issues, which frequently occurred during collaboration in large teams, have been significantly improved. This reduces waiting times when multiple pipelines run concurrently and speeds up `apply` operations. Furthermore, when using major cloud backends like S3 and GCS, encryption at rest and encryption in transit are now enabled by default, allowing for safer state file management without additional configuration.
๐ ๏ธ 4. HCL (HashiCorp Configuration Language) Feature Expansion
HCL has become even more flexible. Higher-order functions like `map`, `filter`, and `reduce` have been added, allowing for more concise and elegant handling of complex data structures. Additionally, a powerful feature has been added: `validation` blocks within resource blocks, enabling dynamic validation of resource attribute values based on specific conditions defined by the Provider.
โ๏ธ 2. Key Changes in AWS Provider Module v21
The most widely used AWS Provider has also undergone significant changes based on the ‘Secure-by-default’ philosophy.
๐ก๏ธ 1. Improved Authentication and Enhanced Default Security (๐จ Breaking Change)
Now, the use of IMDSv2 (Instance Metadata Service Version 2) is set as the default, strengthening security against SSRF attacks and similar threats. Additionally, when creating major storage resources like `aws_s3_bucket` and `aws_ebs_volume`, server-side encryption (SSE) is automatically enabled. If encryption is not desired, you must explicitly add a disable option in your code.
๐ 2. Official Support for New AWS Services
New instance types based on AWS Graviton5 announced at re:Invent 2024, new model management resources for Amazon Bedrock, and other latest AI/ML-related services have been quickly added. Data and security services like AWS App Fabric and AWS Clean Rooms can now also be fully managed with Terraform.
๐ท๏ธ 3. Integrated Resource Tag Management Policy
The ability to set default tags at the Provider level has become even more powerful. It is now much easier to consistently enforce an organization’s tagging policy across all resources. Furthermore, some issues where resources were unnecessarily recreated simply by changing tags have been resolved.
๐๏ธ 4. Attribute Changes for Key Resources (๐จ Breaking Change)
- aws_vpc: The method for allocating and managing IPv6 CIDR blocks has been improved to be more intuitive and flexible.
- aws_instance: Confusion and conflict issues between `user_data` and `user_data_base64` attributes have been resolved, and the behavior of the `user_data_replace_on_change` attribute has become clearer, increasing predictability.
โ 3. Key Changes in EKS Module v21
The EKS module, central to cloud-native environments, has actively embraced the latest Kubernetes trends.
๐ 1. Support for Latest Kubernetes Versions and EKS New Feature Integration
Kubernetes versions 1.32, 1.33 are officially supported, while support for older versions below 1.27 has been deprecated. Additionally, EKS’s new feature, ‘EKS Pod Identity’, has been adopted as the default authentication method, significantly simplifying the previously complex IRSA (IAM Roles for Service Accounts) configuration.
๐ 2. Official Support for Karpenter v1.0 and Enhanced Integration (๐จ Breaking Change)
This is the biggest change in the EKS module update. Instead of the existing `managed_node_groups` or `self_managed_node_groups`, the option to use Karpenter as the default method, a next-generation node provisioner, has come to the forefront. Consequently, Cluster Autoscaler-related variables have been removed. The module’s structure has been reorganized to allow direct definition of Karpenter’s Provisioner and AWSNodeTemplate within the module, enabling much faster and more efficient node scaling.
Code Comparison: Cluster Autoscaler vs Karpenter
### v20: Managed Node Group (with Cluster Autoscaler) ###
module "eks" {
source = "terraform-aws-modules/eks/aws"
version = "~> 20.0"
# ... (Cluster basic configuration)
managed_node_groups = {
general = {
min_size = 1
max_size = 10
desired_size = 2
instance_types = ["m5.large"]
}
}
}
### v21: Karpenter ํตํฉ ๋ฐฉ์ ###
module "eks" {
source = "terraform-aws-modules/eks/aws"
version = "~> 21.0"
# ... (Cluster basic configuration)
# Enable Karpenter
enable_karpenter = true
# Directly define Karpenter Provisioner within the module
karpenter_provisioners = {
default = {
requirements = [
{ key = "karpenter.sh/capacity-type", operator = "In", values = ["on-demand"] },
{ key = "karpenter.k8s.aws/instance-category", operator = "In", values = ["c", "m", "r"] },
{ key = "kubernetes.io/arch", operator = "In", values = ["amd64"] }
]
limits = {
resources = {
cpu = "200"
memory = "400Gi"
}
}
consolidation = {
enabled = true
}
}
}
}๐งฉ 3. Expanded EKS Add-ons Management Capabilities
In addition to CoreDNS, kube-proxy, and VPC CNI, more types of Add-ons such as AWS Distro for OpenTelemetry and GuardDuty EKS Runtime Monitoring can now be directly installed and managed through the module. The ability to specify Add-on versions and set update policies makes managing cluster components much more convenient.
๐ 4. Granular Networking and Security Settings
Security group rules for the ‘Security Groups for Pods’ feature can now be defined more detailed and flexibly within the module. Furthermore, variables for VPC CNI’s Custom Networking settings have been added, allowing for more effective control over Secondary IPs assigned to Pods.
โ Summary and Recommendations
The 2025 Terraform updates demonstrate a clear direction.
- Productivity Innovation through AI: Reduces repetitive tasks and proactively predicts potential issues.
- Enhanced Secure-by-default: Encourages building inherently secure infrastructure without extra effort.
- Flexible Refactoring and Management: Supports easier and safer modification and maintenance of complex and large-scale infrastructure.
Notably, AWS and EKS Module v21 boldly adopted the latest cloud-native trends, such as the transition to Karpenter. Therefore, if you are planning to migrate from v20 to v21, we strongly recommend that you thoroughly review the relevant Breaking Changes in the official documentation and proceed with the upgrade incrementally through testing.
Through these updates, Terraform is establishing itself as a reliable partner for developers throughout the entire process of designing and operating infrastructure, moving beyond being just an IaC tool.
Leave a Reply