# Terraform Iac

> State management, modules, workspaces, remote backends, and multi-environment strategies Use when this capability is needed.

- Skill: `tomevault-io/terraform-iac-2` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/terraform-iac-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/terraform-iac-2/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/terraform-iac-2

---


# Terraform / Infrastructure as Code

Manage infrastructure with Terraform.

## Core Concepts

### State Management
- Store state remotely (S3, Terraform Cloud)
- Enable state locking (DynamoDB)
- Never edit state manually (use `terraform state` commands)
- Isolate environments with workspaces or directories

### Structure
```
terraform/
├── modules/
│   ├── networking/
│   ├── compute/
│   └── database/
├── environments/
│   ├── dev/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   └── terraform.tfvars
│   ├── staging/
│   └── production/
└── backend.tf
```

## Module Design

### Module Interface
```hcl
# modules/compute/main.tf
variable "instance_type" { type = string }
variable "subnet_id"     { type = string }

output "instance_id" { value = aws_instance.app.id }
```

### Module Best Practices
- Input validation (type constraints, validation blocks)
- Outputs for all useful values
- Versioned modules (Git tags, registry)
- Documentation (README per module)
- Test with Terratest

## Remote Backend
```hcl
terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "production/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "terraform-locks"
    encrypt        = true
  }
}
```

## Multi-Environment Strategy
1. **Workspaces**: Simple, state separation only
2. **Directory structure**: Full isolation, can diff configs
3. **Terragrunt**: DRY config, repeatable structure
4. **Always**: Plan in CI, approve, then apply
5. **No manual applies** in production

---
> Source: [cosmicstack-labs/mercury-agent-skills](https://github.com/cosmicstack-labs/mercury-agent-skills) — distributed by [TomeVault](https://tomevault.io).
<!-- tomevault:4.0:skill_md:2026-05-22 -->