Explain the difference between declarative and imperative approaches in Infrastructure as Code. Which approach does Terraform use, and why?

Question

Accepted Answer

Declarative and imperative are two fundamentally different approaches to defining infrastructure. Understanding the distinction is crucial for choosing the right tools and writing effective infrastructure code.

The imperative approach focuses on how to achieve the desired result. You write step-by-step instructions that tell the system exactly what actions to perform. Think of it like giving someone directions by saying turn left, then go straight for two blocks, then turn right. Shell scripts and some configuration management tools like Ansible in its default mode use this approach.

The declarative approach focuses on what the end result should look like. You describe the desired state, and the tool figures out how to get there. Using the directions analogy, it is like saying I want to be at the coffee shop on Main Street and letting a GPS figure out the route. Terraform, CloudFormation, and Kubernetes manifests use this approach.

Terraform uses the declarative approach. You write configuration files that describe the infrastructure you want, such as I need two web servers, a load balancer, and a database. Terraform then compares your desired state with the current state of your infrastructure and determines what changes need to be made.

Terraform uses the declarative approach for several important reasons.

First, idempotency. You can run Terraform multiple times, and it will only make changes if the current state differs from the desired state. With imperative scripts, running them twice might create duplicate resources or cause errors.

Second, state awareness. Terraform maintains a state file that tracks what resources it has created. This allows it to detect drift, meaning changes made outside of Terraform, and to update or destroy resources intelligently.

Third, dependency management. Terraform automatically understands dependencies between resources. If a subnet must exist before an EC2 instance can be launched in it, Terraform handles the ordering automatically.

Fourth, easier reasoning. With declarative code, you can look at the configuration and immediately understand what infrastructure exists. With imperative scripts, you need to mentally execute the script to understand the final state.

The declarative approach does have limitations. Complex conditional logic can be harder to express, and sometimes you need imperative escape hatches like provisioners for tasks that do not fit the declarative model.