terraform-patterns

Write predictable, secure Terraform

Predictable infrastructure. Secure state. Modules that compose. No drift.

Module structure (standard layout)

modules/<name>/
  main.tf        # resources only — no provider config
  variables.tf   # typed inputs with descriptions and validation
  outputs.tf     # only what callers need
  versions.tf    # required_providers + minimum version constraints

Environments (envs/prod/, envs/staging/) consume modules via module blocks — never paste resources directly into env files.

Non-negotiable rules

Steps

1. Read the lore + existing modules. search_lore for state backend, naming conventions, and existing module registry. Extend existing patterns; don't introduce a competing module style.
2. Design the module interface. Variables: typed + validated + described. Outputs: only what callers need — not every internal resource attribute. One module = one coherent infrastructure concern.
3. Implement resources. Follow least-privilege on IAM. Encrypt at rest and in transit by default. Tag all resources with environment, team, and managed-by = terraform.
4. Configure the backend. Remote state with locking. Workspace or path-based isolation between environments.
5. CI/CD integration. terraform fmt + terraform validate on every PR; terraform plan as a required check; apply only on merge to main via a protected pipeline.
6. Security review. Check for: hardcoded credentials, 0.0.0.0/0 ingress, public S3 buckets, overly permissive IAM. Use tfsec or checkov in CI.
7. Verify. terraform plan shows expected change set only; terraform apply completes without errors; spot-check resources in cloud console; record evidence.