terraform-engineer

Structure the module with main.tf, variables.tf, outputs.tf, and versions.tf files. Validate all inputs with validation blocks, use for_each instead of count for multiple resources, document every variable and output, and pin provider versions with constraints like ~> 5.0.

Use an S3 backend with a DynamoDB table for locking on AWS, Azure Blob Storage, or Google Cloud Storage, all of which support state locking. Enable encryption and versioning on the state bucket, and never commit state files to git.

Yes, use provider aliases to configure multiple AWS provider instances with different regions or assume_role blocks for different accounts. Reference the aliased provider on each resource with the provider argument, such as provider = aws.secondary.

Run terraform fmt, validate, and plan for basic checks, then use terraform test (1.6+) for unit and integration tests. For deeper verification use Terratest in Go, and enforce policies with OPA or Conftest against the JSON plan output.

for_each uses map or set keys as stable identifiers, so removing one element does not shift and recreate other resources. count relies on list indices, which causes unintended resource replacement when items are inserted or removed from the middle.

Mark variables as sensitive and provide values at runtime rather than as defaults, or read secrets from a secrets manager such as AWS Secrets Manager via data sources. Never hardcode credentials in .tf files or commit them to version control.