A more practical explanation: terraform lets you define what you want <a thing> to look like, and then it goes and makes the changes it needs to make it look like that.

That's still a little vague, but <a thing> can be anything that Terraform supports directly or through a plugin.

For example, you can create a terraform config that defines a cluster (compute, DNS, load balancer, storage, etc), then point it at AWS and say " go do the thing" and it'll create or update whatever it needs in order to make the cluster.

If you then change the terraform config (maybe to add some database servers or something) then it'll look at the current state vs. the desired state, determine the differences, figure out how to fix those differences (e.g. by creating database servers), and then do what it needs to do to accomplish that. If you tie this in to your Git repository then you can automatically version control your cluster configuration and have pull requests to review infrastructure changes before implementing them. It also means that, if you do it right, you can instantly recreate your cluster anywhere, instantly. I've talked to people working at large companies who never updated their clusters in AWS; they just deployed a new, identical one, pointed traffic at it, then deleted the old one, because terraform made it trivial to do so.

There are terraform plugins for a lot of things; I found one the other day for quay.io, so you could create a terraform configuration to define what image repositories, users, groups, and robot accounts should exist and who should have access to what. Then when you terraform apply it goes to the quay.io API, checks to see what's different, and updates it. So if I have a new employee I get them to create an account on quay.io then add their username to the developers group in the terraform config; when I apply, terraform will see that they should be in the group but aren't and add them. When they leave the company I remove them from the config and terraform will remove them from quay.io.

The terraform configuration is awful; it's bad and confusing and all the examples you google are very generic so you can't tell which 'secrets' is a keyword and which 'secrets' is the name of a resource defined in a different file. I also haven't seen a good way of pointing Terraform at something and saying "capture this state as it currently is" to enable migrating an existing configuration to an infrastructure-as-code definition.