terraform

Terraform

Purpose

Manage infrastructure declaratively without the two events that define bad Terraform experiences: a plan nobody read that destroyed a database, and a state file that no longer matches reality.

When to Use

• Writing or reviewing Terraform configuration.
• Structuring modules and environments.
• Reviewing a plan before an apply that touches production.
• Recovering from state drift or a corrupted state file.

Capabilities

• Module design with clear inputs, outputs, and versioning.
• Remote state with locking, and workspace or directory-based environment separation.
• Plan review, including recognizing a destructive change before it runs.
• Import and drift reconciliation.
• Secrets handling that keeps values out of state where possible.

Inputs

• The existing configuration and state.
• The target environment and its blast radius.
• The plan output — always read before an apply.

Outputs

• Modules that are reusable and versioned.
• Remote state, locked, encrypted, and backed up.
• A reviewed plan with any resource replacement explicitly acknowledged.

Workflow

1. Separate environments physically — Separate state files and separate directories or workspaces. A single state containing dev and prod is one typo away from an incident.
2. Write modules with a narrow interface — Inputs that are actually variable, outputs that consumers need. A module with forty variables is a wrapper, not an abstraction.
3. Plan and read the plan — Every -/+ is a destroy and recreate. On a database, a load balancer, or anything holding state, that is an outage. Never approve a plan you have not read line by line.
4. Lock the state — Remote backend with locking (S3 + DynamoDB, or the equivalent). Two concurrent applies against unlocked state will corrupt it.
5. Pin everything — Provider versions, module versions, and the Terraform version itself. An unpinned provider will change behavior underneath you on an unrelated day.
6. Reconcile drift explicitly — Manual changes happen. terraform plan shows them; decide to import, adopt, or revert. Ignoring drift means the next apply reverts someone's emergency fix.