Ansible vs Terraform: which should you use?

Quick answer: Terraform is a declarative, state-based tool for provisioning infrastructure (VMs, networks, load balancers, DNS records, managed databases) — it compares the infrastructure that exists against the infrastructure your config describes and works out the diff. Ansible is an agentless, procedural configuration management tool — it runs an ordered list of tasks against existing servers to bring their software and configuration into a known state. Most teams that use both use Terraform to stand infrastructure up and Ansible to configure what runs on it; they are not really substitutes for each other.

Terraform: declarative and state-based

You describe the desired end state of your infrastructure in HCL, and Terraform maintains a state file recording what it last created. On every run it diffs desired state against actual state and calculates the minimal set of create/update/destroy operations needed to reconcile them. This makes Terraform very good at provisioning — creating a VPC, spinning up VMs, wiring up a load balancer — because "what does the world look like now vs what should it look like" is exactly the question state-based tooling answers well. See what is Ansible and how do you use it for configuration management for where the line between the two tools is usually drawn in practice.

Ansible: agentless and procedural

Ansible connects over SSH (or WinRM) and runs playbooks — an ordered list of tasks — against a defined inventory of hosts, with no state file and no agent to install on the target. It leans procedural: you write "ensure this package is installed, ensure this file has this content, ensure this service is running," and (if you use Ansible's built-in modules rather than raw shell commands, see common pitfalls to avoid when using Ansible) each task is idempotent, so re-running the playbook is safe. This makes Ansible very good at configuration management — keeping a fleet of already-provisioned servers patched, configured, and consistent.

Decision criteria

• Provisioning cloud resources from nothing (VPCs, subnets, managed databases, DNS, IAM) — Terraform. Its state model is built for exactly this.
• Configuring software on servers that already exist (package installs, config files, users, cron jobs) — Ansible. No agent required, and it reads clearly as a runbook.
• Both, in the same pipeline — very common: Terraform provisions the VMs/cluster, then hands off to Ansible (or a Terraform provisioner, though a separate Ansible run is usually cleaner) to configure what runs on them.
• Team already fluent in one — if your team already knows Ansible well and only occasionally provisions a handful of cloud resources, Ansible's dynamic inventory can handle light provisioning too; the reverse (using Terraform for deep server configuration) is much more awkward, since Terraform providers are not designed for granular in-server config drift.

Still not sure which fits your infrastructure and team? That is exactly the kind of question an office-hours call is for.