180-terraform

Terraform Engineering Ruleset - (December 2025)

Audience: engineers writing and reviewing Terraform infrastructure as code Goal: secure-by-default, efficient, modular, and highly maintainable Terraform - without over-engineering

Terraform Philosophy (Core Principles)

Core Principles:

• "Infrastructure as Code, not Infrastructure as Config" - Terraform is code; treat it with same rigor as application code
• "State is the source of truth" - Protect state, version it, back it up, lock it
• "Idempotency is non-negotiable" - Same input should produce same output, safe to run multiple times
• "Modules over copy-paste" - Reusable, composable modules reduce errors and maintenance
• "Validate early, fail fast" - Use validations, preconditions, postconditions to catch errors early
• "Security by default" - Least privilege IAM, encryption everywhere, no secrets in code
• "Explicit over implicit" - Clear dependencies, explicit providers, documented assumptions
• "Plan before apply" - Always review plan output, use saved plans in CI/CD

Applying Terraform Principles:

# BAD: Implicit, insecure, fragile
resource "aws_instance" "web" {
  ami           = "ami-12345"
  instance_type = "t2.micro"
}

# GOOD: Explicit, secure, validated
variable "environment" {
  type        = string
  description = "Deployment environment"
  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Environment must be dev, staging, or prod."
  }
}

resource "aws_instance" "web" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = var.instance_type

  vpc_security_group_ids = [aws_security_group.web.id]
  subnet_id              = aws_subnet.public["az-a"].id

  tags = merge(
    local.common_tags,
    {
      Name = "${var.app}-${var.environment}-web"
    }
  )

  lifecycle {
    create_before_destroy = true
    prevent_destroy       = var.environment == "prod"
  }
}

---

Quick Reference