loom-terraform

Terraform / OpenTofu

Overview

Terraform/OpenTofu infrastructure: module design, state/backends, multi-environment strategy, provider config, refactoring/import. Prefer tofu over terraform — OpenTofu is the Linux Foundation fork, config-compatible, and has capabilities OSS Terraform lacks (client-side state encryption). Command mapping table is at the end.

The single highest-value section is Expert Practices below — the anti-patterns/gotchas there are where naive-but-working configs go wrong.

Module & Configuration Design

Canonical layout — shared modules/, one root module per environment, lock file committed:

terraform/
├── modules/{vpc,eks,rds}/         # each: main.tf variables.tf outputs.tf versions.tf
├── environments/{dev,staging,prod}/  # each: main.tf backend.tf terraform.tfvars .terraform.lock.hcl
└── .terraform.lock.hcl

Principles: reusable modules with typed, validated, described inputs; providers pinned in required_providers; remote state with locking; locals for computed/DRY values; documented outputs; lifecycle rules where deletion/replacement risk exists.

Variable validation — validate at the boundary; contains() for enums, length/regex for shape:

variable "environment" {
  type = string
  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Environment must be dev, staging, or prod."
  }
}

Module composition — wire flat modules via input/output, never nest deep (see Anti-Patterns). Version external modules with ~>; pin internal git modules by tag ref=:

module "vpc" { source = "terraform-aws-modules/vpc/aws", version = "~> 5.0" }
module "internal" { source = "git::https://github.com/org/tf-modules.git//vpc?ref=v1.2.3" }

State & Backends

S3 with native locking (no DynamoDB):

terraform {
  backend "s3" {
    bucket       = "myorg-terraform-state"
    key          = "prod/eks/terraform.tfstate"
    region       = "us-west-2"
    encrypt      = true
    kms_key_id   = "arn:aws:kms:us-west-2:123456789012:key/..."
    use_lockfile = true   # native S3 conditional-write lock; no DynamoDB table/IAM
  }
}