devops-terraform-patterns

Terraform Patterns

Core Principles

1. Infrastructure as Code — All infrastructure is declared in version-controlled .tf files. Manual changes are prohibited; every resource has a single source of truth in code.
2. State Is Sacred — Remote state with locking prevents corruption. Never edit state files by hand. Use terraform state commands for manipulation and always back up before operations.
3. Modular Design — Reusable modules encapsulate logical groupings of resources. Root modules compose child modules. Pin module versions to avoid surprises.
4. Immutable Infrastructure — Prefer replacing resources over mutating them. Use create_before_destroy lifecycle rules for zero-downtime deployments.
5. Least Privilege Plans — CI pipelines run plan on every PR and apply only on merge to main. Human review of plan output is mandatory before any production apply.

---

Resource and Data Source Patterns

Use for_each over count when resources need stable identity. Data sources fetch existing infrastructure without managing it.

# Fetch existing VPC, create subnets with for_each for stable keys
data "aws_vpc" "main" {
  filter {
    name   = "tag:Environment"
    values = [var.environment]
  }
}

resource "aws_subnet" "private" {
  for_each = var.private_subnets

  vpc_id            = data.aws_vpc.main.id
  cidr_block        = each.value.cidr
  availability_zone = each.value.az

  tags = merge(var.common_tags, {
    Name = "${var.project}-private-${each.key}"
    Tier = "private"
  })
}

See resource-patterns for: lifecycle rules, depends_on usage, count vs for_each trade-offs, dynamic blocks, and provisioner patterns.

---

Module Design

Modules accept typed inputs, expose outputs, and compose into larger stacks. Keep modules focused on a single concern.

# Root module composing child modules
module "networking" {
  source  = "git::https://github.com/org/terraform-modules.git//networking?ref=v2.3.1"

  environment    = var.environment
  vpc_cidr       = var.vpc_cidr
  private_subnets = var.private_subnets
  public_subnets  = var.public_subnets
}

module "database" {
  source = "./modules/rds"

  subnet_ids         = module.networking.private_subnet_ids
  security_group_ids = [module.networking.db_security_group_id]
  instance_class     = var.db_instance_class
  engine_version     = var.db_engine_version
}

output "db_endpoint" {
  description = "RDS instance endpoint"
  value       = module.database.endpoint
  sensitive   = true
}