terraform

Terraform Rules

Module structure

Every Terraform module must have: main.tf, variables.tf, outputs.tf, versions.tf, README.md.

Variable validation — always include

variable "environment" {
  type = string
  validation {
    condition     = contains(["dev", "staging", "production"], var.environment)
    error_message = "environment must be dev, staging, or production"
  }
}

Pipeline order — enforce all gates before plan

terraform fmt -check → terraform validate → tflint → checkov/tfsec → plan

IAM — never generate wildcards

# ❌ Never
statement {
  actions   = ["*"]
  resources = ["*"]
}

# ✅ Always
statement {
  actions   = ["s3:GetObject", "s3:ListBucket"]
  resources = ["arn:aws:s3:::my-bucket", "arn:aws:s3:::my-bucket/*"]
}

Tagging — always enforce at provider level

provider "aws" {
  default_tags {
    tags = { env = var.environment, team = var.team, managed-by = "terraform" }
  }
}

SOC 2 — never generate

• publicly_accessible = true on RDS, Redshift, OpenSearch
• encrypted = false on any storage (S3, EBS, RDS, DynamoDB, ElastiCache, EFS)
• is_multi_region_trail = false on CloudTrail
• enable_log_file_validation = false on CloudTrail
• skip_final_snapshot = true on production databases
• deletion_protection = false on production databases
• enable = false on GuardDuty
• :latest image tags in any resource

SOC 2 — always generate on data resources

resource "aws_kms_key" "..." {
  enable_key_rotation     = true   # CC6.7
  deletion_window_in_days = 30
}

resource "aws_cloudtrail" "..." {
  is_multi_region_trail      = true   # CC7.2
  enable_log_file_validation = true
  kms_key_id                 = aws_kms_key.cloudtrail.arn
}

resource "aws_db_instance" "..." {
  storage_encrypted       = true
  backup_retention_period = 35    # A1.2
  deletion_protection     = true
  skip_final_snapshot     = false
  multi_az                = true
}

State backend — always encrypt