Iac Terraform

Infrastructure as Code — Terraform / OpenTofu

Core Principle

IaC is code. It lives in git, gets reviewed in PRs, runs in CI, and never has secrets hardcoded in it. State is shared and locked.

OpenTofu is a drop-in open-source alternative to Terraform. All patterns here apply to both.

Detection Signals

Core Workflow

terraform init      # initialize backend and download providers
terraform validate  # check syntax and provider references
terraform plan      # preview changes — always review before apply
terraform apply     # apply changes (never skip plan in production)
terraform destroy   # destroy resources (requires explicit approval)

Never run apply without reviewing plan output in production.

Key Rules (apply always)

Load references/patterns.md for: full project structure, remote state backend configs (AWS/GCP/Azure), module patterns, variable validation, secrets data sources, import commands, and anti-patterns.

Load references/ci-cd.md for: GitHub Actions plan/apply/drift-detection workflows, GitLab CI plan+apply pipeline, environment promotion pattern.

.gitignore Requirements

*.tfstate
*.tfstate.backup
.terraform/
*.tfplan

Before Declaring Done

• Remote backend configured with state locking (S3+DynamoDB, GCS, or Azure Blob)
• State bucket has versioning enabled (allows rollback)
• No secrets in .tfvars or passed via -var — all secrets use data sources
• terraform validate passes in CI on every PR
• terraform plan output posted to PR for review
• terraform apply requires manual approval for production environment
• Drift detection scheduled (weekly minimum)
• .gitignore includes *.tfstate, .terraform/, *.tfplan
• Modules versioned via git tags if shared across repos

Source: Dev-Toolbelt/dev-team-agents — distributed by TomeVault.