terraform-review

Run terraform plan -out=tfplan and triage every resource action symbol: + creates, ~ updates in place, -/+ destroys and recreates, and - destroys. Any -/+ replacement on stateful resources like databases or buckets is a blocker until explicitly justified.

Replacement happens when a changed attribute forces it, marked with '# forces replacement' in the plan, or when a resource is renamed. Use moved blocks or terraform state mv for renames, and identify the forcing attribute before applying.

Use a remote backend such as S3 with DynamoDB locking, GCS, or Terraform Cloud with encryption enabled, and keep terraform.tfstate out of git. Separate state per environment so staging mistakes cannot affect production.

Check for secrets in .tf or .tfvars files, security groups with 0.0.0.0/0 ingress beyond public load balancer ports 80/443, IAM policies with wildcard actions, and public endpoints that are not intentional. Mark sensitive outputs and encrypt state since it contains secrets.

For single-VPS projects, a simple setup script often beats a module tree, and the review should say so. Terraform pays off when you manage multiple environments, reusable modules, or team-shared state.