IBM Developer

Blog post

Scale IBM Cloud infrastructure with Terraform modules

Accelerate cloud deployment with 100+ IBM-supported Terraform modules that cut code by 85% and ensure built-in security and Financial Services compliance.

By Vincent Burckhardt, Prateek Sharma

AI is changing how teams build cloud infrastructure. But whether you write Terraform-based solutions by hand or generate them with an AI assistant, the hard problems are the same: Which service-to-service authorizations do you actually need? What are the encryption defaults? How do you set auto-scaling thresholds that will not wake you up at 3:00 AM? How do you configure fine-grained context-based restrictions? What edge cases cause issues in production?

These problems are not coding problems. They are knowledge problems. That knowledge comes from months of research, failed deployments, and lessons learned through experience. Engineers who work independently rediscover the same answers. When team members leave, they take institutional knowledge with them. AI can help, but the quality of what it generates depends on the building blocks you provide. Supported, up-to-date building blocks backed by an accountable team ensure high quality when AI assembles infrastructure.

The terraform-ibm-modules project captures that knowledge as composable building blocks for IBM Cloud. These production-tested, IBM-supported modules are built from years of configuring IBM Cloud services correctly. The value is the same whether you work by hand or with an AI assistant: compose from supported, maintained modules instead of building from scratch. Pick the modules you need, connect them, and get infrastructure that is already configured the way IBM engineers configure it. The difference is only the approach: manually or conversationally.

These modules build on Terraform, using the IBM Cloud provider, and following best practices for Terraform on IBM Cloud.

What you get with IBM Terraform modules

The terraform-ibm-modules collection contains IBM Cloud's supported Terraform modules. They are not community experiments or proofs of concept. You get IBM support, consistent module patterns, and automated tests for every release. If an issue occurs, IBM resolves it.

IBM started developing these modules in 2021 to build infrastructure for core IBM Cloud services. Internal usage continues to refine the modules through production deployment. They now power infrastructure for major IBM Cloud customers and serve as building blocks for IBM solutions, such as landing zone deployable architectures.

This approach helps larger organizations. Security and compliance teams audit the modules once, rather than auditing custom implementations for every project. Platform teams curate approved modules. Development teams compose infrastructure from those approved building blocks to achieve fast deployment within guardrails.

The collection includes over 100 actively maintained modules with more than 11 million total weekly downloads. The modules cover account setup, VPC networking, IBM Cloud Databases, security services (IBM Cloud® Key Protect, IBM Cloud® Secrets Manager, and IBM Cloud® Security and Compliance Center Workload Protection), container platforms (Red Hat® OpenShift®, IBM Cloud® Code Engine), observability, IBM watsonx™, and more.

Every module follows the same structure:

terraform-ibm-{service-name}/
├── main.tf
├── variables.tf
├── outputs.tf
├── versions.tf
├── modules/
│   └── fscloud/          # Financial Services Cloud variant
├── examples/
│   ├── basic/
│   └── complete/
│   └── ...
└── tests/

When you learn one module, you know them all.

How modules combine

An encrypted database requires a Key Management Service (KMS) key. The modules handle this dependency cleanly:

module "kms" {
  source  = "terraform-ibm-modules/kms-all-inclusive/ibm"
  version = "5.5.27"
  # ... creates Key Protect instance and encryption keys
}

module "postgresql" {
  source      = "terraform-ibm-modules/icd-postgresql/ibm"
  version     = "4.8.0"
  name        = "my-postgresql"
  region      = "us-south"
  kms_key_crn = module.kms.keys["db-keys"]["postgresql-key"].crn
}

One module's output feeds into another module's input. You control composition, dependencies, variables, and state. The modules handle IBM Cloud complexity, such as service authorizations, encryption configuration, and endpoint policies, while you manage architecture.

Each module's examples directory shows sample compositions. The complete examples combine multiple modules with the options required in production.

Key modules to know

For the complete catalog of IBM Terraform modules, see the Terraform Registry. Here is a representative list of key modules:

Financial Services Cloud compliance is built in

For regulated industries, fscloud submodules are essential. These pre-configured variants implement the IBM Cloud Framework for Financial Services: 565 control requirements from NIST SP 800-53, validated by financial institutions.

The fscloud submodules enforce:

  • KMS encryption (customer-managed keys required; no IBM-owned keys)
  • Private endpoints only
  • Pre-configured context-based restrictions
module "mongodb_fscloud" {
  source            = "terraform-ibm-modules/icd-mongodb/ibm//modules/fscloud"
  version           = "3.12.0"
  resource_group_id = var.resource_group_id
  name              = "compliant-mongodb"
  region            = "us-south"
  kms_key_crn       = var.kms_key_crn
}

You configure compliance instead of spending months engineering it.

Testing and maintenance

Every module release passes automated validation: idempotency checks, breaking change detection, and deployment validation against IBM Cloud. Before release, multiple engineers review the code to identify design issues that automated tests might miss.

The testing framework is open source: ibmcloud-terratest-wrapper extends Gruntwork's Terratest with IBM Cloud capabilities. You can use it for your own modules.

Open source collaboration and contribution

The terraform-ibm-modules project is open source. You can fork repositories, make enhancements, and submit pull requests. All contributions follow the contribution guidelines.

The community receives IBM's testing and maintenance, while IBM gains real-world usage patterns and community contributions.

AI-assisted composition

The terraform-ibm-modules MCP server connects AI assistants (such as Claude or GitHub Copilot) directly to the module catalog using the Model Context Protocol (MCP). Instead of generating Terraform configuration from general training data, AI assistants compose from modules that are tested, versioned, and maintained by a dedicated team.

When you describe your requirements, the AI assistant suggests module combinations, connects dependencies, and generates configurations. You maintain ownership of the Terraform code, and every component includes support and automated tests before each release.

You can also explore the terraform-ibm-modules skills repository, a collection of IBM Cloud patterns and best practices for AI assistants. The goal is to teach AI assistants which modules exist and how to use them effectively.

Measurable benefits and code reduction

Building secure, compliant cloud infrastructure from scratch takes months. These modules let you skip most of that.

A secure Red Hat OpenShift cluster with VPC, IAM, KMS, Cloud Object Storage (COS), and observability typically requires roughly 1,500 lines of Terraform code. Using terraform-ibm-modules, the configuration requires fewer than 200 lines. Line count reduction is only part of the value. These configurations are validated across thousands of deployments and reviewed by security teams. The code is proven because it already runs in production environments.

For organizations, this approach delivers faster time to production and simpler compliance audits. Updates flow through the module library as IBM Cloud evolves.

Following IBM's acquisition of HashiCorp in February 2025, these modules align with IBM's key infrastructure automation tools: Terraform for provisioning and Red Hat Ansible for configuration management. Organizations that use terraform-ibm-modules are well positioned as IBM integrates these tools.

You maintain full Terraform control while building on proven, standardized design decisions.

Getting started with IBM Cloud modules

Browse the module catalog in the IBM Cloud documentation, the terraform-ibm-modules GitHub organization, or the Terraform Registry. Each module includes documentation and code examples. You can use the terraform-ibm-modules MCP server with your AI assistant to explore modules conversationally.

Deploy by using the Terraform CLI (standard init, plan, and apply commands), IBM Cloud Schematics, HashiCorp Terraform Cloud, or any CI/CD pipeline. For more information about contributing, see the module contribution guidelines.