terraform-validate

Terraform Validate

Validates Terraform modules and configurations across CP infrastructure repositories for consistency, security, and best practices.

When to Use

• User asks to "validate terraform", "check this module", "review infrastructure changes"
• User is modifying a cpp-terraform-* or cpp-module-terraform-* repo
• User wants to verify state backend configuration
• User wants to check variable naming conventions across modules

Process

Step 1: Identify Module Type

Prefix	Type	Purpose
cpp-module-terraform-azurerm-*	Reusable module	Shared building blocks consumed by other Terraform repos
cpp-terraform-azurerm-*	Root module	Environment-specific infrastructure provisioning
cpp-terraform-network	Network	VNet, subnet, NSG, peering configuration
cpp-automation-terraform	Automation	Terraform automation and orchestration

Step 2: Validate Structure

Every Terraform repo should have:

├── main.tf                    # Primary resource definitions
├── variables.tf               # Input variable declarations
├── outputs.tf                 # Output value declarations
├── versions.tf                # Provider and Terraform version constraints
├── README.md                  # Auto-generated by terraform-docs
├── .pre-commit-config.yaml    # Pre-commit hooks
├── .terraform-version         # tfversion pinning
└── vars/                      # Environment-specific tfvars (root modules only)
    ├── dev.tfvars
    ├── sit.tfvars
    ├── ste.tfvars
    ├── nft.tfvars
    ├── prp.tfvars
    └── prd.tfvars

Step 3: Validation Checks

Variable Declarations

• All variables have description field
• All variables have type constraint
• Sensitive variables marked with sensitive = true
• Default values only for optional variables
• Variable names use snake_case

Resource Configuration

• All resources have consistent tagging (environment, team, service)
• Resource names follow CP naming convention: {resource-type}-{env}-{purpose}
• No hardcoded values that should be variables
• Lifecycle rules specified where appropriate (prevent_destroy for stateful resources)