awesome-claude-copilot: Instructions file for GitHub Copilot

Terraform Conventions

General Instructions

• Use Terraform to provision and manage infrastructure.
• Use version control for your Terraform configurations.

Security

• Always use the latest stable version of Terraform and its providers.
  • Regularly update your Terraform configurations to incorporate security patches and improvements.
• Store sensitive information in a secure manner, such as using AWS Secrets Manager or SSM Parameter Store.
  • Regularly rotate credentials and secrets.
  • Automate the rotation of secrets, where possible.
• Use AWS environment variables to reference values stored in AWS Secrets Manager or SSM Parameter Store.
  • This keeps sensitive values out of your Terraform state files.
• Never commit sensitive information such as AWS credentials, API keys, passwords, certificates, or Terraform state to version control.
  • Use .gitignore to exclude files containing sensitive information from version control.
• Always mark sensitive variables as sensitive = true in your Terraform configurations.
  • This prevents sensitive values from being displayed in the Terraform plan or apply output.
• Use IAM roles and policies to control access to resources.
  • Follow the principle of least privilege when assigning permissions.
• Use security groups and network ACLs to control network access to resources.
• Deploy resources in private subnets whenever possible.
  • Use public subnets only for resources that require direct internet access, such as load balancers or NAT gateways.
• Use encryption for sensitive data at rest and in transit.
  • Enable encryption for EBS volumes, S3 buckets, and RDS instances.
  • Use TLS for communication between services.
• Regularly review and audit your Terraform configurations for security vulnerabilities.
  • Use tools like trivy, tfsec, or checkov to scan your Terraform configurations for security issues.

Modularity

• Use separate projects for each major component of the infrastructure; this:
  • Reduces complexity
  • Makes it easier to manage and maintain configurations
  • Speeds up plan and apply operations
  • Allows for independent development and deployment of components
  • Reduces the risk of accidental changes to unrelated resources
• Use modules to avoid duplication of configurations.
  • Use modules to encapsulate related resources and configurations.
  • Use modules to simplify complex configurations and improve readability.
  • Avoid circular dependencies between modules.
  • Avoid unnecessary layers of abstraction; use modules only when they add value.
    • Avoid using modules for single resources; only use them for groups of related resources.
    • Avoid excessive nesting of modules; keep the module hierarchy shallow.
• Use output blocks to expose important information about your infrastructure.
  • Use outputs to provide information that is useful for other modules or for users of the configuration.
  • Avoid exposing sensitive information in outputs; mark outputs as sensitive = true if they contain sensitive data.