Terraform Stacks vs Workspaces: When to Use Each

Workspaces:
  main.tf ──→ dev.tfstate
          ──→ staging.tfstate
          ──→ prod.tfstate
 
Stacks:
  networking/main.tf ─┐
  database/main.tf   ─┼──→ coordinated apply/destroy
  compute/main.tf    ─┘

# Create workspaces
terraform workspace new dev
terraform workspace new staging
terraform workspace new prod
 
# Switch and apply
terraform workspace select dev
terraform apply   # Uses dev.tfstate
 
terraform workspace select prod
terraform apply   # Uses prod.tfstate (completely separate)

project/
├── main.tf
├── variables.tf
├── outputs.tf
├── terraform.tfvars          # Default values
├── environments/
│   ├── dev.tfvars
│   ├── staging.tfvars
│   └── prod.tfvars

# main.tf — same code for all environments
resource "aws_instance" "web" {
  ami           = var.ami_id
  instance_type = var.instance_type  # t3.micro in dev, t3.xlarge in prod
 
  tags = {
    Name        = "${terraform.workspace}-web"
    Environment = terraform.workspace
  }
}

terraform workspace select prod
terraform apply -var-file=environments/prod.tfvars

# Problem: Networking team manages VPC, app team manages compute
# With workspaces, everything is in one configuration
resource "aws_vpc" "main" { ... }           # Networking team
resource "aws_ecs_cluster" "app" { ... }    # App team
resource "aws_rds_cluster" "db" { ... }     # Database team
 
# Issues:
# - One team's change can break another's
# - Long plan times (Terraform evaluates everything)
# - Blast radius is the entire stack
# - Different teams need different permissions

# stack.tfstack.hcl
component "networking" {
  source = "./components/networking"
  inputs = {
    environment = var.environment
    vpc_cidr    = var.vpc_cidr
  }
}
 
component "database" {
  source = "./components/database"
  inputs = {
    environment = var.environment
    vpc_id      = component.networking.vpc_id         # Auto-dependency
    subnet_ids  = component.networking.private_subnets
  }
}
 
component "compute" {
  source = "./components/compute"
  inputs = {
    environment = var.environment
    vpc_id      = component.networking.vpc_id
    db_endpoint = component.database.endpoint          # Auto-dependency
  }
}

# deployments.tfdeploy.hcl
deployment "dev" {
  inputs = {
    environment = "dev"
    vpc_cidr    = "10.0.0.0/16"
  }
}
 
deployment "prod" {
  inputs = {
    environment = "prod"
    vpc_cidr    = "10.1.0.0/16"
  }
}

Q: Do you have ONE Terraform configuration used in multiple environments?
   → Use WORKSPACES
 
Q: Do you have MULTIPLE Terraform configurations that deploy together?
   → Use STACKS
 
Q: Do you have both?
   → Use STACKS (they include deployment targets for multi-env)

# In the compute configuration:
data "terraform_remote_state" "networking" {
  backend = "s3"
  config = {
    bucket = "tf-state"
    key    = "networking/terraform.tfstate"
    region = "us-east-1"
  }
}
 
resource "aws_ecs_cluster" "app" {
  name = "app"
  # Reference networking output
  # But if networking hasn't been applied yet... this fails
}
 
resource "aws_ecs_service" "app" {
  cluster = aws_ecs_cluster.app.id
  network_configuration {
    subnets = data.terraform_remote_state.networking.outputs.private_subnets
  }
}