terraform

Split configuration by purpose: terraform.tf for version and provider constraints, providers.tf for provider configuration, main.tf for resources, variables.tf and outputs.tf for inputs and outputs in alphabetical order, and locals.tf for shared computed values.

Use for_each with a set or map for collections of resources, since keys remain stable when items are added or removed. Reserve count for conditional single-resource creation like count = var.enable_x ? 1 : 0, because indexed resources shift when middle items are removed.

Pin both the CLI and providers in terraform.tf using required_version and required_providers with the pessimistic operator, for example version = "~> 5.0". This allows patch and minor updates while blocking breaking major version upgrades on terraform init.

Never hardcode credentials in .tf files; pass them via environment variables, IAM roles, or CI secrets into variables. Mark secret variables and outputs with sensitive = true, and keep .tfstate and .terraform/ out of version control since state stores values in plaintext.

Run terraform fmt -recursive, terraform validate, tflint for linting, and tfsec or checkov for security scanning. Also confirm all variables have type and description, outputs have descriptions, versions are pinned, and no credentials are hardcoded.