terraform

This is identity churn caused by using count with list indices. Convert to for_each over a map or toset so resources have stable keys, and add moved blocks (Terraform 1.1+) to migrate existing state addresses without destroying resources.

Use count = cond ? 1 : 0 for simple boolean create-or-skip decisions. Use for_each with toset(list) when items may reorder or be removed, and for_each with a map when you need to reference resources by stable named keys.

No. The sensitive attribute only masks values in CLI output and logs; the plaintext value is still stored in the state file. Source secrets from cloud secret managers and use write_only or *_wo arguments (Terraform 1.11+) to avoid persisting them.

Native terraform test requires Terraform 1.6+ and uses .tftest.hcl files. Use command = plan for input-derived values and command = apply for computed values like ARNs or set-type nested blocks that cannot be index-addressed.

CI drift usually comes from unpinned provider or runtime versions. Pin the runtime with required_version, pin providers with version constraints, commit .terraform.lock.hcl, and apply the reviewed plan artifact in CI instead of re-running plan.

Split state when different teams or change cadences manage components, or when a single state exceeds roughly 500 resources. Combine tightly coupled components under about 100 resources, and always use a remote backend with locking and encryption for team or production work.