terraform-expert

Terraform state management requires remote backends with locking to prevent concurrent modifications. Configure a remote backend (S3, Azure Storage, Terraform Cloud) and enable state locking so multiple team members can safely collaborate without corrupting infrastructure definitions or causing apply conflicts.

Structure modules with clear input variables, outputs, and a single responsibility. Use local paths or remote sources (Git, registries) to reference modules across projects. Follow naming conventions and document variables to make modules discoverable and composable across infrastructure codebases.

Use sensitive input variables marked with `sensitive = true`, store secrets in external vaults (AWS Secrets Manager, HashiCorp Vault), and avoid committing `.tfvars` files to version control. Terraform masks sensitive outputs and prevents accidental exposure in logs and state files.

Terraform plan previews changes without modifying infrastructure, showing add, update, and delete operations. Terraform apply executes the planned changes and updates state. Plan acts as a safety checkpoint; review it before apply to catch unintended modifications.

Data sources fetch information about existing resources without managing them. They query infrastructure details (VPCs, AMIs, DNS records) and pass that data to your configuration, enabling Terraform to reference external resources and build dynamic infrastructure definitions.

State files track resource metadata and enable Terraform to detect changes and calculate diffs. Corruption or loss breaks the mapping between configuration and real resources, causing Terraform to lose track of infrastructure. Use remote backends with versioning and locking to prevent corruption and enable recovery.