Terraform Practices

Infrastructure Terraform Practices

Overview. This skill covers testing, CI/CD, code structure, and module patterns for Terraform and OpenTofu—including code generated from or styled like the blueprints in this repo.

When to use

• Writing or reviewing Terraform/OpenTofu (including blueprint-generated code)
• Setting up tests (native test framework, Terratest) or CI/CD
• Choosing testing approach (static vs native vs Terratest vs policy vs mock)
• Structuring modules; block ordering; count vs for_each; locals for dependency order
• Version management and modern Terraform features (try, optional, moved, write-only)

When not to use

• Blueprint selection or catalog → use style-guide
• Secrets (ephemeral passwords, IAM DB auth) or security group rules → use security

1. Testing

Decision matrix

Testing pyramid

• Static (cheap): validate, fmt, lint, security scanning
• Integration: module tests, real resources in test account
• E2E (expensive): full environment deployment

Native test tips

• command = plan — fast; input validation, input-derived attributes
• command = apply — computed values, set-type blocks, real/mocked behavior
• For set-type blocks use for expressions or command = apply; do not index with [0]

Detail: references/testing-frameworks.md

2. Code structure

Resource block order

1. count or for_each first (blank line after)
2. Other arguments
3. tags as last real argument
4. depends_on (if needed)
5. lifecycle at end (if needed)

Variable block order

1. description (always)
2. type
3. default
4. validation
5. nullable (when false)

# GOOD
resource "aws_nat_gateway" "this" {
  count = var.create_nat_gateway ? 1 : 0

  allocation_id = aws_eip.this[0].id
  subnet_id     = aws_subnet.public[0].id

  tags = { Name = "${var.name}-nat" }

  depends_on = [aws_internet_gateway.this]
}

Detail: references/code-patterns.md

3. Count vs for_each

Stable addressing (AZs): Prefer for_each = toset(var.availability_zones) so removing one AZ only affects that resource.

Detail: references/code-patterns.md

4. Locals for dependency management

Use try() in locals to hint deletion order (e.g. subnets before secondary CIDR):

locals {
  vpc_id = try(
    aws_vpc_ipv4_cidr_block_association.this[0].vpc_id,
    aws_vpc.this.id,
    ""
  )
}
# Reference local.vpc_id in resources that must be destroyed before CIDR association

Detail: references/code-patterns.md

5. CI/CD

Stages: validate → test → plan → apply (with approvals for production).

Cost optimization: Use mocking in PRs; run integration tests on main; tag test resources; auto-cleanup.

Detail: references/ci-cd-workflows.md

6. Version management

Workflow: terraform init to lock; terraform init -upgrade to update within constraints; then plan and test.

7. Modern features

8. Naming

For blueprint resources use project-environment-component (style-guide). In generic modules, "this" for singletons is optional.

References

• testing-frameworks.md
• ci-cd-workflows.md
• code-patterns.md
• module-patterns.md
• quick-reference.md
• security-compliance.md — for scanning (trivy, checkov, state security); for secrets and security group rules use security.

Converted and distributed by TomeVault — claim your Tome and manage your conversions.