A crash course guide for Mac admins looking to move from manual configuration ("ClickOps") to automated, version-controlled infrastructure management using Terraform and GitOps workflows.
Part 1: Understanding the Fundamentals
Before diving into Jamf-specific implementations, it's essential to understand the core concepts that make Infrastructure as Code valuable.
What is Version Control?
Version control is the foundation of modern software development—and now, infrastructure management. If you're new to these concepts, start here:
What is Infrastructure as Code (IaC)?
Infrastructure as Code means managing and provisioning infrastructure through code instead of manual processes. Rather than clicking through a UI to configure settings, you define your desired state in configuration files.
Why IaC Matters
| Benefit |
Description |
| Version Control |
Every change is tracked with full history—who changed what, when, and why |
| Consistency |
Eliminate "configuration drift" where environments slowly diverge from intended state |
| Repeatability |
Deploy identical configurations across dev, test, and production |
| Rollback |
Instantly revert to a previous known-good state when issues arise |
| Collaboration |
Teams can review changes before they're applied via pull requests |
| Auditability |
Complete audit trail for compliance and troubleshooting |
| Disaster Recovery |
Rebuild entire environments from code in minutes |
| Reduced Human Error |
Automation eliminates manual misconfiguration |
IaC Learning Resources
What is GitOps?
GitOps extends IaC by using Git as the single source of truth for your infrastructure. All changes flow through Git—via pull requests with peer review—and automated systems ensure your live environment matches what's defined in your repository.
The GitOps Workflow
1. Developer proposes change via Pull Request
2. Team reviews and discusses the change
3. Automated checks validate the configuration
4. Change is approved and merged
5. Automation applies the change to the live system
6. Continuous monitoring ensures state matches Git
Key GitOps Benefits
| Benefit |
How It Works |
| Pull Request Approvals |
Changes require peer review before deployment—no more unauthorized modifications |
| Audit Trail |
Every change is a Git commit with author, timestamp, and description |
| Easy Rollback |
Revert to any previous state with git revert—the system automatically reconciles |
| Self-Documenting |
Your Git history IS your change documentation |
| Drift Detection |
Systems continuously compare live state vs. declared state and alert on differences |
| Collaboration |
Async code review enables distributed teams to work together effectively |
GitOps Learning Resources
What is Terraform?
Terraform is HashiCorp's open-source Infrastructure as Code tool. It uses a declarative configuration language (HCL) to define resources, and works with virtually any platform that has an API—including Jamf.
Terraform Concepts
| Concept |
Description |
| Provider |
A plugin that enables Terraform to interact with a specific platform (e.g., AWS, Azure, Jamf) |
| Resource |
A component of your infrastructure (e.g., a Jamf policy, configuration profile, or smart group) |
| State |
Terraform's record of the current infrastructure—used to plan and apply changes |
| Plan |
A preview of what Terraform will change before actually applying it |
| Apply |
Execute the planned changes to bring infrastructure to the desired state |
| Module |
Reusable, shareable Terraform configurations |
Terraform Learning Resources
Part 2: IaC for Jamf - Introduction
Now that you understand the fundamentals, let's look at how these concepts apply specifically to Jamf environments.
Jamf + IaC Introductory Content
If you're completely new to applying IaC concepts to Jamf, start here:
Podcast / Video Introduction
Blog Posts
Part 3: JNUC 2025 Sessions
Conference sessions covering real-world implementations and advanced use cases:
Part 4: Terraform Providers for Jamf
Terraform providers are plugins that enable Terraform to interact with specific platforms. Here are the providers available for Jamf products:
Terraform Providers
| Provider |
Maintainer |
Description |
Link |
| deploymenttheory/jamfpro |
Community |
Interfaces with Classic API and Jamf Pro API |
Terraform Registry |
| terraform-provider-jsctfprovider |
Jamf |
Interfaces with Jamf Security Cloud |
Terraform Registry |
| terraform-jamf-platform |
Jamf |
Terraform modules leveraging deploymenttheory and jsctfprovider |
Terraform Registry |
| terraform-provider-jamfplatform |
Jamf |
Interfaces with Jamf Platform API. This API is still in beta. |
Terraform Registry |
Part 5: Community Resources & Starter Projects
These resources, created by Jamf employees and community members, provide practical examples and templates:
Blog Posts
Starter Templates
Part 6: Suggested Learning Path
For Complete Beginners (No Git/IaC Experience)
- Learn Git basics — Complete one of the Git tutorials above
- Understand IaC concepts — Read the AWS or Red Hat IaC explainers
- Watch the intro — Jamf After Dark "I Have No Idea What Terraform Is"
- Read the "why" — Jamf Blog on ClickOps to GitOps
- Try Terraform — Complete a basic HashiCorp tutorial (Docker or cloud provider)
For Those Familiar with Git/DevOps
- Read the Jamf blogs — ClickOps to GitOps + GitOps Workflows
- Watch JNUC sessions — Pick the one most relevant to your environment
- Clone a starter repo — Try
terraform-jamfpro-starter
- Experiment in a test environment — Never start with production!
For Those Ready to Implement
- Review provider documentation — Understand available resources
- Plan your state management — Consider HCP Terraform Cloud for team collaboration
- Define your workflow — Establish PR review processes and CI/CD pipelines
- Start small — Begin with a few resources, expand gradually
- Document everything — Your future self will thank you
Quick Reference: The Value Proposition
| Traditional "ClickOps" |
Infrastructure as Code |
| Changes made directly in UI |
Changes defined in code files |
| No record of who changed what |
Full Git history with author and timestamp |
| Difficult to replicate environments |
Identical deployments every time |
| Manual disaster recovery |
Rebuild from code in minutes |
| Changes go live immediately |
Pull request review before deployment |
| "It worked yesterday" debugging |
Compare any two points in time |
| Tribal knowledge |
Self-documenting configurations |
| One environment at a time |
Manage hundreds of instances consistently |
Additional Resources
Official Documentation
General IaC Best Practices
Certifications
Last updated: February 2026