{"id":78465,"date":"2026-09-05T01:00:10","date_gmt":"2026-09-05T01:00:10","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=78465"},"modified":"2026-09-05T01:00:32","modified_gmt":"2026-09-05T01:00:32","slug":"terraform-developer-productivity-master-guide","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/terraform-developer-productivity-master-guide\/","title":{"rendered":"Terraform Developer Productivity Master Guide"},"content":{"rendered":"\n

Tools, Workflow, Security, Testing, CI\/CD, Automation, AI Assistance, Governance, and Production Best Practices<\/h2>\n\n\n\n

Verified baseline:<\/strong> 5 September 2026
Audience:<\/strong> Terraform developers, DevOps\/SRE, platform\/cloud engineers, module authors, DevSecOps teams, and engineering leaders.<\/p>\n\n\n\n

\n

This handbook treats Terraform development as an engineering system, not a collection of unrelated commands. The goal is a fast local feedback loop, reproducible plans, secure authentication, reviewable changes, automated quality gates, policy enforcement, controlled production execution, and continuous drift\/health feedback.<\/p>\n<\/blockquote>\n\n\n\n

\n\n\n\n

Executive standard<\/h2>\n\n\n\n

A strong default stack for a professional Terraform team is:<\/p>\n\n\n

VS Code \/ Cursor \/ Claude Code\n        \u2193\nHashiCorp Terraform Extension + terraform-ls\n        \u2193\nTerraform MCP Server for current Registry\/HCP context\n        \u2193\ntenv\n        \u2193\nTerraform CLI\n        \u2193\nterraform fmt\nterraform validate\nterraform test\n        \u2193\nTFLint\n        \u2193\nTrivy\n        \u2193\nterraform-docs\n        \u2193\nInfracost\n        \u2193\npre-commit-terraform\n        \u2193\nGit\n        \u2193\nGitHub \/ GitLab\n        \u2193\nCI quality gates + OIDC\/workload identity\n        \u2193\nHCP Terraform \/ Terraform Enterprise or another controlled runner\n        \u2193\nSentinel \/ OPA \/ Terraform Policy where appropriate\n        \u2193\nCloud infrastructure\n        \u2193\nPost-deployment validation + drift\/health monitoring\n<\/code><\/span><\/pre>\n\n\n
Tool classification<\/h3>\n\n\n\n
Tool \/ capability<\/th>Default classification<\/th>Why<\/th><\/tr><\/thead>
Terraform CLI<\/td>MUST HAVE<\/strong><\/td>Core IaC engine<\/td><\/tr>
Git<\/td>MUST HAVE<\/strong><\/td>Reviewable, auditable change history<\/td><\/tr>
terraform fmt<\/code><\/td>MUST HAVE<\/strong><\/td>Canonical formatting<\/td><\/tr>
terraform validate<\/code><\/td>MUST HAVE<\/strong><\/td>Configuration validity<\/td><\/tr>
Remote state + locking<\/td>MUST HAVE for teams<\/strong><\/td>Prevents local-state drift and concurrent writes<\/td><\/tr>
Provider\/module version constraints<\/td>MUST HAVE<\/strong><\/td>Reproducibility<\/td><\/tr>
.terraform.lock.hcl<\/code> in Git<\/td>MUST HAVE for root configurations<\/strong><\/td>Reproducible provider selection\/checksums<\/td><\/tr>
VS Code + HashiCorp extension<\/td>STRONGLY RECOMMENDED<\/strong><\/td>Fast authoring feedback<\/td><\/tr>
terraform-ls<\/code><\/td>STRONGLY RECOMMENDED<\/strong><\/td>IDE intelligence; usually bundled<\/td><\/tr>
tenv<\/code><\/td>STRONGLY RECOMMENDED<\/strong><\/td>Reproducible CLI versions<\/td><\/tr>
TFLint<\/td>STRONGLY RECOMMENDED<\/strong><\/td>Terraform\/provider-aware linting<\/td><\/tr>
Trivy<\/td>STRONGLY RECOMMENDED<\/strong><\/td>IaC misconfiguration + optional secret scanning<\/td><\/tr>
terraform test<\/code><\/td>STRONGLY RECOMMENDED<\/strong><\/td>Native module\/root tests<\/td><\/tr>
terraform-docs<\/code><\/td>STRONGLY RECOMMENDED for modules<\/strong><\/td>Prevents stale README interfaces<\/td><\/tr>
pre-commit-terraform<\/code><\/td>STRONGLY RECOMMENDED<\/strong><\/td>Cheap local automation<\/td><\/tr>
CI plan workflow<\/td>MUST HAVE for production teams<\/strong><\/td>Reproducible review gate<\/td><\/tr>
OIDC\/workload identity<\/td>MUST HAVE for CI cloud auth<\/strong><\/td>Avoids static cloud credentials<\/td><\/tr>
Infracost<\/td>RECOMMENDED<\/strong><\/td>PR-level cost feedback<\/td><\/tr>
Renovate<\/td>RECOMMENDED<\/strong><\/td>Dependency hygiene<\/td><\/tr>
Terraform MCP Server<\/td>RECOMMENDED with AI coding<\/strong><\/td>Current Registry\/HCP context<\/td><\/tr>
Checkov<\/td>OPTIONAL \/ context dependent<\/strong><\/td>Strong policy\/compliance scanning; can overlap Trivy<\/td><\/tr>
Terratest<\/td>OPTIONAL<\/strong><\/td>Real integration\/E2E testing when native tests are insufficient<\/td><\/tr>
Terragrunt<\/td>OPTIONAL<\/strong><\/td>Useful for large repeated multi-account\/region layouts<\/td><\/tr>
Atlantis<\/td>OPTIONAL<\/strong><\/td>PR-driven execution if it fits the operating model<\/td><\/tr>
HCP Terraform<\/td>RECOMMENDED \/ ENTERPRISE<\/strong><\/td>Remote runs, state, governance, registry, RBAC<\/td><\/tr>
Terraform Enterprise<\/td>ENTERPRISE<\/strong><\/td>Self-hosted HCP Terraform distribution<\/td><\/tr>
Sentinel \/ OPA<\/td>ENTERPRISE \/ governance<\/strong><\/td>Policy gates<\/td><\/tr>
Conftest<\/td>OPTIONAL<\/strong><\/td>Lightweight vendor-neutral Rego execution<\/td><\/tr>
tfupdate<\/code><\/td>OPTIONAL \/ niche<\/strong><\/td>Focused Terraform version rewriting; Renovate is broader<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
2026-specific guidance<\/h3>\n\n\n\n
    \n
  1. Terraform MCP Server is now a first-class option<\/strong>\u00a0for AI-assisted Terraform. Use it to ground an AI agent in current provider\/module documentation instead of trusting model memory.<\/li>\n\n\n\n
  2. Native\u00a0terraform test<\/code>\u00a0is the default first testing layer.<\/strong>\u00a0Add Terratest when you truly need live system behavior, cross-service checks, retries, or non-Terraform assertions.<\/li>\n\n\n\n
  3. Trivy is the normal replacement for tfsec<\/strong>\u00a0in new workflows.<\/li>\n\n\n\n
  4. For new S3 backends use native S3 state locking<\/strong>\u00a0(use_lockfile = true<\/code>). Do not design a new backend around DynamoDB locking.<\/li>\n\n\n\n
  5. HCP Terraform policy choices are broader than Sentinel alone.<\/strong>\u00a0OPA is supported and HashiCorp also has Terraform Policy in HCL; treat beta features cautiously.<\/li>\n\n\n\n
  6. Terragrunt 1.x uses the streamlined CLI<\/strong>, e.g.\u00a0terragrunt run --all plan<\/code>; old\u00a0run-all<\/code>\u00a0examples should be considered legacy.<\/li>\n\n\n\n
  7. Do not build CI around static AWS\/Azure\/GCP keys.<\/strong>\u00a0Use GitHub\/GitLab OIDC or the cloud’s workload-identity mechanism.<\/li>\n<\/ol>\n\n\n\n
    \n\n\n\n
    PART 1 \u2014 Terraform Development Ecosystem<\/h1>\n\n\n\n
    1.1 The end-to-end model<\/h2>\n\n\n
    Developer intent\n   \u2193\nEditor \/ AI coding environment\n   \u2193\nLanguage intelligence\n   \u2193\nVersion-controlled Terraform CLI\n   \u2193\nFast local quality gates\n   \u2193\nGit change\n   \u2193\nCI reproducibility gates\n   \u2193\nPlan\n   \u2193\nSecurity \/ cost \/ policy review\n   \u2193\nHuman approval\n   \u2193\nControlled apply\n   \u2193\nVerification\n   \u2193\nDrift \/ health feedback\n<\/code><\/span><\/pre>\n\n\n
    Responsibility of each layer<\/h3>\n\n\n\n
    Layer<\/th>Responsibility<\/th>Typical tools<\/th><\/tr><\/thead>
    Editor<\/td>Write\/navigate\/refactor HCL<\/td>VS Code, Cursor<\/td><\/tr>
    AI assistant<\/td>Boilerplate, explanation, refactoring<\/td>Claude Code, Cursor, VS Code AI<\/td><\/tr>
    Language server<\/td>Schema-aware completion\/diagnostics\/navigation<\/td>terraform-ls<\/code><\/td><\/tr>
    AI context server<\/td>Current Terraform Registry\/HCP information<\/td>Terraform MCP Server<\/td><\/tr>
    Version manager<\/td>Select project-approved binaries<\/td>tenv<\/code>, mise, asdf, tfenv<\/td><\/tr>
    Terraform engine<\/td>Init\/plan\/apply\/state\/test<\/td>Terraform CLI<\/td><\/tr>
    Formatter<\/td>Canonical HCL style<\/td>terraform fmt<\/code><\/td><\/tr>
    Validator<\/td>Terraform language\/module validity<\/td>terraform validate<\/code><\/td><\/tr>
    Linter<\/td>Terraform\/provider best practices<\/td>TFLint<\/td><\/tr>
    Security scanner<\/td>Misconfiguration\/compliance\/secret checks<\/td>Trivy, Checkov<\/td><\/tr>
    Test layer<\/td>Behavior assertions<\/td>terraform test<\/code>, Terratest<\/td><\/tr>
    Documentation<\/td>Generate module interface docs<\/td>terraform-docs<\/code><\/td><\/tr>
    Cost analysis<\/td>Estimate cost delta<\/td>Infracost<\/td><\/tr>
    Commit automation<\/td>Run cheap checks before push<\/td>pre-commit \/ pre-commit-terraform<\/td><\/tr>
    VCS<\/td>Review\/audit<\/td>GitHub, GitLab<\/td><\/tr>
    CI<\/td>Reproduce quality gates and create plan<\/td>GitHub Actions, GitLab CI<\/td><\/tr>
    Remote runner\/orchestrator<\/td>Controlled execution\/state\/governance<\/td>HCP Terraform, TFE, Atlantis<\/td><\/tr>
    Policy as code<\/td>Organizational guardrails<\/td>Terraform Policy, Sentinel, OPA<\/td><\/tr>
    Cloud<\/td>Actual infrastructure<\/td>AWS, Azure, GCP, SaaS providers<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    Core principle: different tools answer different questions<\/h3>\n\n\n
    fmt       \u2192 Is the code formatted?\nvalidate  \u2192 Is the Terraform configuration structurally valid?\nTFLint    \u2192 Is it suspicious, deprecated, inconsistent, or provider-invalid?\nTrivy     \u2192 Is it insecure or dangerously configured?\ntest      \u2192 Does the module<\/span> satisfy its intended behavior?\nplan      \u2192 What will Terraform change in<\/span> this<\/span> real context?\nInfracost \u2192 What may the cost impact be?\nPolicy    \u2192 Is the change allowed by organizational rules?\nReview    \u2192 Should we make this<\/span> change?\nApply     \u2192 Execute the approved change.\nVerify    \u2192 Did the system reach the expected state?\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    No single tool replaces the others.<\/p>\n\n\n\n
    \n\n\n\n
    PART 2 \u2014 Core Terraform Development Tools<\/h1>\n\n\n\n
    2. Terraform CLI<\/h1>\n\n\n\n
    What<\/h2>\n\n\n\n
    Terraform CLI is the execution engine for Terraform configuration, dependency initialization, planning, applying, state operations, testing, and inspection.<\/p>\n\n\n\n
    Essential command map<\/h2>\n\n\n\n
    Command<\/th>Use it when<\/th>Production note<\/th><\/tr><\/thead>
    terraform init<\/code><\/td>First run, provider\/module\/backend changes<\/td>Review lock-file changes<\/td><\/tr>
    terraform fmt<\/code><\/td>During authoring and before commit<\/td>Automate<\/td><\/tr>
    terraform validate<\/code><\/td>After editing modules\/config<\/td>Does not validate live cloud behavior<\/td><\/tr>
    terraform plan<\/code><\/td>Before any change<\/td>Review replacements\/destruction<\/td><\/tr>
    terraform apply<\/code><\/td>Execute an approved plan<\/td>Prefer controlled runner<\/td><\/tr>
    terraform destroy<\/code><\/td>Intentionally remove stack<\/td>High-risk; require strong controls<\/td><\/tr>
    terraform console<\/code><\/td>Test expressions\/functions<\/td>Great for debugging locals\/CIDR logic<\/td><\/tr>
    terraform output<\/code><\/td>Read root outputs<\/td>Avoid exposing sensitive values<\/td><\/tr>
    terraform show<\/code><\/td>Inspect state or saved plan<\/td>Plan\/state can contain secrets<\/td><\/tr>
    terraform providers<\/code><\/td>Inspect provider dependencies<\/td>Useful for upgrade debugging<\/td><\/tr>
    terraform state<\/code><\/td>Controlled state inspection\/moves<\/td>High-risk; use change procedure<\/td><\/tr>
    terraform import<\/code><\/td>Bring existing resources under management<\/td>Prefer reviewable import workflows<\/td><\/tr>
    terraform test<\/code><\/td>Execute .tftest.hcl<\/code> tests<\/td>Default first test framework<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    Practical workflow<\/h2>\n\n\n
    terraform version\nterraform init\nterraform fmt -recursive\nterraform validate\nterraform test\nterraform plan -out=tfplan\nterraform show tfplan\n<em<\/span>><\/span># apply only after review\/approval<\/em<\/span>><\/span>\nterraform apply tfplan\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
    terraform init<\/code><\/h3>\n\n\n\n
    What it does:<\/p>\n\n\n\n
      \n
    • Initializes backend.<\/li>\n\n\n\n
    • Downloads providers.<\/li>\n\n\n\n
    • Downloads child modules.<\/li>\n\n\n\n
    • Creates\/updates\u00a0.terraform.lock.hcl<\/code>.<\/li>\n\n\n\n
    • Prepares the working directory.<\/li>\n<\/ul>\n\n\n\n
      Useful patterns:<\/p>\n\n\n
      terraform init\nterraform init -upgrade\nterraform init -backend=false   <em<\/span>><\/span># useful for validation jobs that do not need state<\/em<\/span>><\/span>\nterraform init -reconfigure\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
      Use -upgrade<\/code> deliberately, not on every CI run, because it tells Terraform to re-evaluate dependency selections.<\/p>\n\n\n\n
      terraform fmt<\/code><\/h3>\n\n\n
      terraform fmt\nterraform fmt -recursive\nterraform fmt -check -recursive\n<\/code><\/span><\/pre>\n\n\n
      Local development: run write mode.
      CI: run -check<\/code> so CI detects unformatted code without modifying the branch.<\/p>\n\n\n\n
      terraform validate<\/code><\/h3>\n\n\n
      terraform init -backend=false<\/span>\nterraform validate\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Validates Terraform configuration consistency and syntax in an initialized directory. It does not<\/strong> prove:<\/p>\n\n\n\n
        \n
      • credentials are valid,<\/li>\n\n\n\n
      • resource values are allowed by the cloud API,<\/li>\n\n\n\n
      • IAM permissions are sufficient,<\/li>\n\n\n\n
      • deployment will succeed,<\/li>\n\n\n\n
      • architecture is secure,<\/li>\n\n\n\n
      • cost is acceptable.<\/li>\n<\/ul>\n\n\n\n
        Those require lint\/security\/plan\/test\/policy\/runtime checks.<\/p>\n\n\n\n
        terraform plan<\/code><\/h3>\n\n\n
        terraform plan\nterraform plan -out=tfplan\nterraform show -no-color tfplan\nterraform show -json tfplan > tfplan.json\n<\/code><\/span><\/pre>\n\n\n
        Review especially:<\/p>\n\n\n\n
          \n
        • -\/+<\/code>\u00a0replacements,<\/li>\n\n\n\n
        • deletions,<\/li>\n\n\n\n
        • IAM changes,<\/li>\n\n\n\n
        • network exposure,<\/li>\n\n\n\n
        • encryption changes,<\/li>\n\n\n\n
        • database\/storage replacement,<\/li>\n\n\n\n
        • identity-provider changes,<\/li>\n\n\n\n
        • state moves\/imports,<\/li>\n\n\n\n
        • count\/for_each key churn.<\/li>\n<\/ul>\n\n\n\n
          Do not treat “Plan: 1 to add, 0 to change, 0 to destroy” as sufficient review. The kind<\/em> of resource matters.<\/p>\n\n\n\n
          terraform apply<\/code><\/h3>\n\n\n\n
          Recommended hierarchy:<\/p>\n\n\n\n
            \n
          1. HCP Terraform\/TFE or controlled CI runner.<\/li>\n\n\n\n
          2. Dedicated deployment runner with OIDC\/workload identity.<\/li>\n\n\n\n
          3. Laptop apply only for sandbox\/learning or documented break-glass workflows.<\/li>\n<\/ol>\n\n\n\n
            Applying a saved reviewed plan is safer than regenerating a plan immediately before apply when your workflow supports preserving the plan artifact securely.<\/p>\n\n\n\n
            terraform destroy<\/code><\/h3>\n\n\n\n
            Treat as a destructive privileged operation. Prefer environment protection, explicit approval, and resource protection where appropriate.<\/p>\n\n\n\n
            terraform show<\/code><\/h3>\n\n\n\n
            Saved plan JSON is excellent input for policy engines and scanners:<\/p>\n\n\n
            terraform plan -out=tfplan\nterraform show -json tfplan > tfplan.json\n<\/code><\/span><\/pre>\n\n\n
            Security:<\/strong> plan output can contain sensitive information. Store it only in trusted, short-lived CI artifacts.<\/p>\n\n\n\n
            terraform state<\/code><\/h3>\n\n\n\n
            Useful commands:<\/p>\n\n\n
            terraform<\/span> state<\/span> list<\/span>\nterraform<\/span> state<\/span> show<\/span> aws_instance<\/span>.web<\/span>\nterraform<\/span> state<\/span> mv<\/span> OLD_ADDRESS<\/span> NEW_ADDRESS<\/span>\nterraform<\/span> state<\/span> rm<\/span> ADDRESS<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
            Policy:<\/p>\n\n\n\n
              \n
            • Never directly edit\u00a0terraform.tfstate<\/code>.<\/li>\n\n\n\n
            • Back up\/retain remote state versions.<\/li>\n\n\n\n
            • Require peer review\/change ticket for production state surgery.<\/li>\n\n\n\n
            • Prefer Terraform language mechanisms such as\u00a0moved<\/code>\u00a0blocks where they solve the problem cleanly.<\/li>\n\n\n\n
            • state rm<\/code>\u00a0means “stop managing this object”; it does not delete the real object.<\/li>\n<\/ul>\n\n\n\n
              \n\n\n\n
              3. VS Code + HashiCorp Terraform Extension<\/h1>\n\n\n\n
              Why<\/h2>\n\n\n\n
              The editor should catch low-cost mistakes before you reach a terminal or CI.<\/p>\n\n\n\n
              The official HashiCorp extension currently provides language-server-backed:<\/p>\n\n\n\n
                \n
              • syntax highlighting,<\/li>\n\n\n\n
              • IntelliSense\/completion,<\/li>\n\n\n\n
              • inline diagnostics,<\/li>\n\n\n\n
              • formatting,<\/li>\n\n\n\n
              • go-to-definition and symbols,<\/li>\n\n\n\n
              • module\/project navigation,<\/li>\n\n\n\n
              • snippets,<\/li>\n\n\n\n
              • HCP Terraform workspace\/run integration,<\/li>\n\n\n\n
              • support for newer Terraform language surfaces.<\/li>\n<\/ul>\n\n\n\n
                Installation<\/h2>\n\n\n\n
                VS Code Marketplace extension:<\/p>\n\n\n
                HashiCorp Terraform\npublisher: HashiCorp\n<\/code><\/span><\/pre>\n\n\n
                The extension bundles a compatible terraform-ls<\/code>, so most VS Code users should not<\/strong> separately install the language server.<\/p>\n\n\n\n
                Recommended settings<\/h2>\n\n\n\n
                Example .vscode\/settings.json<\/code>:<\/p>\n\n\n
                {\n  \"[terraform]\"<\/span>: {\n    \"editor.defaultFormatter\"<\/span>: \"HashiCorp.terraform\"<\/span>,\n    \"editor.formatOnSave\"<\/span>: true<\/span>,\n    \"editor.formatOnPaste\"<\/span>: false<\/span>,\n    \"editor.codeActionsOnSave\"<\/span>: {\n      \"source.organizeImports\"<\/span>: \"never\"<\/span>\n    }\n  },\n  \"[terraform-vars]\"<\/span>: {\n    \"editor.defaultFormatter\"<\/span>: \"HashiCorp.terraform\"<\/span>,\n    \"editor.formatOnSave\"<\/span>: true<\/span>\n  },\n  \"files.trimTrailingWhitespace\"<\/span>: true<\/span>,\n  \"files.insertFinalNewline\"<\/span>: true<\/span>,\n  \"editor.rulers\"<\/span>: [100<\/span>, 120<\/span>]\n}\n<\/code><\/span>Code language:<\/span> JSON \/ JSON with Comments<\/span> (<\/span>json<\/span>)<\/span><\/small><\/pre>\n\n\n
                The HashiCorp extension should be the authority for Terraform formatting; avoid competing formatters for .tf<\/code>.<\/p>\n\n\n\n
                Useful companion extensions<\/h2>\n\n\n\n
                Keep the list small:<\/p>\n\n\n\n
                  \n
                • GitLens or your organization’s Git review extension.<\/li>\n\n\n\n
                • YAML extension for CI\/config files.<\/li>\n\n\n\n
                • Markdown lint\/preview for module docs.<\/li>\n\n\n\n
                • EditorConfig if your organization uses it.<\/li>\n\n\n\n
                • AI assistant only if approved by your security\/data policy.<\/li>\n<\/ul>\n\n\n\n
                  Avoid installing multiple Terraform format\/language extensions at the same time.<\/p>\n\n\n\n
                  \n\n\n\n
                  4. terraform-ls<\/code><\/h1>\n\n\n\n
                  What<\/h2>\n\n\n\n
                  terraform-ls<\/code> is HashiCorp’s official Terraform language server. It exposes IDE features over the Language Server Protocol.<\/p>\n\n\n\n
                  Provides<\/h2>\n\n\n\n
                    \n
                  • completions,<\/li>\n\n\n\n
                  • diagnostics,<\/li>\n\n\n\n
                  • navigation,<\/li>\n\n\n\n
                  • reference awareness,<\/li>\n\n\n\n
                  • provider\/schema intelligence,<\/li>\n\n\n\n
                  • module awareness,<\/li>\n\n\n\n
                  • workspace indexing.<\/li>\n<\/ul>\n\n\n\n
                    Installation decision<\/h2>\n\n\n\n
                    VS Code<\/h3>\n\n\n\n
                    Do not<\/strong> normally install manually. The HashiCorp Terraform extension bundles the compatible server.<\/p>\n\n\n\n
                    Other LSP-compatible editors<\/h3>\n\n\n\n
                    Manual installation can be appropriate.<\/p>\n\n\n\n
                    macOS\/Linux with Homebrew:<\/p>\n\n\n
                    brew install hashicorp\/tap\/terraform-ls\nterraform-ls version\n<\/code><\/span><\/pre>\n\n\n
                    Best practice<\/h2>\n\n\n\n
                    Open the project folder\/workspace<\/strong>, not only one .tf<\/code> file. Whole-project indexing enables better module\/ref navigation.<\/p>\n\n\n\n
                    \n\n\n\n
                    5. Terraform MCP Server<\/h1>\n\n\n\n
                    What<\/h2>\n\n\n\n
                    Terraform MCP Server connects an MCP-capable AI client to current Terraform provider\/module\/policy information and, when configured, HCP Terraform\/TFE context.<\/p>\n\n\n\n
                    Problem it solves<\/h2>\n\n\n\n
                    Without external grounding, an AI model can produce:<\/p>\n\n\n\n
                      \n
                    • provider arguments removed two versions ago,<\/li>\n\n\n\n
                    • fictional resources,<\/li>\n\n\n\n
                    • invalid nesting,<\/li>\n\n\n\n
                    • outdated module interfaces,<\/li>\n\n\n\n
                    • obsolete HCP Terraform behavior.<\/li>\n<\/ul>\n\n\n\n
                      MCP reduces that risk by giving the agent current source context.<\/p>\n\n\n\n
                      Architecture<\/h2>\n\n\n
                      Developer request\n      \u2193\nAI host \/ coding agent\n      \u2193\nMCP client\n      \u2193\nTerraform MCP Server\n      \u2193\nTerraform Registry \/ HCP Terraform\n      \u2193\nCurrent provider, module<\/span>, policy, workspace context\n      \u2193\nAI-generated suggestion\n      \u2193\nfmt \u2192 validate \u2192 lint \u2192 security \u2192 test \u2192 plan\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                      Use cases<\/h2>\n\n\n\n
                        \n
                      • “Show the current schema for this AWS resource before generating it.”<\/li>\n\n\n\n
                      • “Find an approved module in our private registry.”<\/li>\n\n\n\n
                      • “Explain this provider argument using the current provider docs.”<\/li>\n\n\n\n
                      • “Generate a module that is compatible with our pinned provider.”<\/li>\n\n\n\n
                      • “Find the HCP Terraform workspace for this stack and summarize its run context.”<\/li>\n<\/ul>\n\n\n\n
                        Example prompts<\/h2>\n\n\n
                        Using the Terraform MCP Server, verify the current AWS provider schema for<\/span>\naws_s3_bucket and generate the smallest secure example compatible with<\/span> our\nrequired provider constraint. Do not invent attributes.\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n
                        Find the current Registry documentation for<\/span> the module<\/span> used in<\/span> .\/network.\nExplain which inputs are required and identify any code in<\/span> our wrapper that is\nusing removed\/deprecated inputs. Do not change state addresses.\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n
                        Before modifying this<\/span> Terraform, list the resources that would be security\nsensitive (IAM, KMS, network ingress, state backend). Generate code only after\nchecking current provider documentation. Then run fmt\/validate\/test and explain\nremaining assumptions.\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                        Security rules<\/h2>\n\n\n\n
                        Treat the MCP server as a privileged integration if it can access private HCP Terraform information.<\/p>\n\n\n\n
                          \n
                        • Scope HCP tokens minimally.<\/li>\n\n\n\n
                        • Do not expose sensitive state to an AI tool by default.<\/li>\n\n\n\n
                        • Separate read\/documentation use from write\/run-management permissions.<\/li>\n\n\n\n
                        • Review generated commands before execution.<\/li>\n\n\n\n
                        • Never authorize autonomous production apply merely because the generated HCL validates.<\/li>\n<\/ul>\n\n\n\n
                          Recommendation:<\/strong> Strongly recommended for teams already using AI-assisted Terraform, optional otherwise.<\/p>\n\n\n\n
                          \n\n\n\n
                          PART 3 \u2014 Terraform Version Management<\/h1>\n\n\n\n
                          6. tenv<\/code><\/h1>\n\n\n\n
                          What<\/h2>\n\n\n\n
                          tenv<\/code> is a Go-based version manager for Terraform, OpenTofu, Terragrunt, Terramate, and Atmos. It is the successor to tfenv\/tofuenv.<\/p>\n\n\n\n
                          Why<\/h2>\n\n\n\n
                          One globally installed Terraform version creates avoidable problems:<\/p>\n\n\n\n
                            \n
                          • project A needs a new language feature,<\/li>\n\n\n\n
                          • project B is still validated on an older minor version,<\/li>\n\n\n\n
                          • CI and laptop silently differ,<\/li>\n\n\n\n
                          • developers accidentally upgrade providers\/state behavior by upgrading the CLI.<\/li>\n<\/ul>\n\n\n\n
                            Installation<\/h2>\n\n\n\n
                            macOS:<\/p>\n\n\n
                            brew install tofuutils\/tap\/tenv\n<\/code><\/span><\/pre>\n\n\n
                            Verify:<\/p>\n\n\n
                            tenv --version\ntenv tf --help\n<\/code><\/span><\/pre>\n\n\n
                            Common usage<\/h2>\n\n\n
                            tenv<\/span> tf<\/span> install<\/span> 1.16<\/span>.0<\/span>\ntenv<\/span> tf<\/span> use<\/span> 1.16<\/span>.0<\/span>\nterraform<\/span> version<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
                            Project file:<\/p>\n\n\n
                            # .terraform-version<\/span>\n1.16<\/span>.0<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
                            tenv<\/code> can also resolve compatible Terraform versions from required_version<\/code> constraints.<\/p>\n\n\n\n
                            Team policy<\/h2>\n\n\n\n
                            For root configurations:<\/p>\n\n\n
                            terraform {\n  required_version = \"~> 1.16.0\"<\/span>\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                            and use the same minor\/patch policy in CI.<\/p>\n\n\n\n
                            For reusable modules, avoid unnecessarily over-constraining callers. If the module only needs a feature introduced in 1.7:<\/p>\n\n\n
                            terraform {\n  required_version = \">= 1.7.0\"<\/span>\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                            Comparison<\/h2>\n\n\n\n
                            Tool<\/th>Best fit<\/th>Strength<\/th>Limitation<\/th><\/tr><\/thead>
                            tenv<\/code><\/td>Terraform\/OpenTofu\/Terragrunt-centric teams<\/td>Purpose-built, multi-IaC binary support<\/td>Another tool to standardize<\/td><\/tr>
                            tfenv<\/code><\/td>Existing Terraform-only estates<\/td>Familiar and simple<\/td>tenv<\/code> is its modern successor<\/td><\/tr>
                            asdf<\/code><\/td>Polyglot toolchains<\/td>One manager for many ecosystems<\/td>Plugin lifecycle\/UX<\/td><\/tr>
                            mise<\/code><\/td>Modern polyglot developer environments<\/td>Fast, broad tooling and task support<\/td>Broader than Terraform-specific need<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                            Default recommendation:<\/strong> tenv<\/code> for Terraform-centric teams; mise<\/code> is an excellent choice if the organization already standardizes all developer tools through it.<\/p>\n\n\n\n
                            \n\n\n\n
                            PART 4 \u2014 Terraform Code Quality<\/h1>\n\n\n\n
                            7. terraform fmt<\/code><\/h1>\n\n\n\n
                            Formatting is non-negotiable because it removes style arguments from review.<\/p>\n\n\n
                            terraform fmt -recursive\nterraform fmt -check -recursive\n<\/code><\/span><\/pre>\n\n\n
                            Local:<\/strong> write\/fix.
                            CI:<\/strong> -check<\/code>.<\/p>\n\n\n\n
                            Do not build an internal HCL formatting standard that conflicts with terraform fmt<\/code>.<\/p>\n\n\n\n
                            \n\n\n\n
                            8. terraform validate<\/code><\/h1>\n\n\n\n
                            Use it as a structural gate, not as a linter or security test.<\/p>\n\n\n\n
                            CI-friendly:<\/p>\n\n\n
                            terraform init -backend=false<\/span> -input=false<\/span>\nterraform validate -no-color\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                            Use a real plan later when values\/backend\/provider runtime context matters.<\/p>\n\n\n\n
                            \n\n\n\n
                            9. TFLint<\/h1>\n\n\n\n
                            What<\/h2>\n\n\n\n
                            TFLint is a pluggable Terraform linter. Its built-in Terraform rules catch language-level issues, and cloud provider rulesets add checks that Terraform’s core validation cannot know.<\/p>\n\n\n\n
                            Problems it solves<\/h2>\n\n\n\n
                              \n
                            • deprecated HCL patterns,<\/li>\n\n\n\n
                            • unused declarations,<\/li>\n\n\n\n
                            • missing required provider\/version constraints,<\/li>\n\n\n\n
                            • unpinned Registry modules,<\/li>\n\n\n\n
                            • invalid or discouraged provider-specific values,<\/li>\n\n\n\n
                            • invalid instance types,<\/li>\n\n\n\n
                            • organization naming conventions through configured\/custom rules.<\/li>\n<\/ul>\n\n\n\n
                              Installation<\/h2>\n\n\n\n
                              macOS:<\/p>\n\n\n
                              brew install terraform-linters\/tap\/tflint\n<\/code><\/span><\/pre>\n\n\n
                              Windows:<\/p>\n\n\n
                              winget<\/span> install<\/span> -e<\/span> --id<\/span> TerraformLinters<\/span>.tflint<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
                              Linux: use the signed\/attested release artifacts or the project’s documented installer.<\/p>\n\n\n\n
                              Production-oriented .tflint.hcl<\/code><\/h2>\n\n\n
                              tflint {\n  required_version = \">= 0.64.0\"<\/span>\n}\n\nconfig {\n  call_module_type    = \"all\"<\/span>\n  disabled_by_default = false<\/span>\n}\n\nplugin \"terraform\"<\/span> {\n  enabled = true<\/span>\n  preset  = \"recommended\"<\/span>\n}\n\nplugin \"aws\"<\/span> {\n  enabled = true<\/span>\n  version = \"0.48.0\"<\/span>\n  source  = \"github.com\/terraform-linters\/tflint-ruleset-aws\"<\/span>\n}\n\n# Useful team-level additions beyond the recommended preset.<\/span>\nrule \"terraform_documented_variables\"<\/span> {\n  enabled = true<\/span>\n}\n\nrule \"terraform_documented_outputs\"<\/span> {\n  enabled = true<\/span>\n}\n\nrule \"terraform_naming_convention\"<\/span> {\n  enabled = true<\/span>\n}\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                              Initialize and run:<\/p>\n\n\n
                              tflint --init\ntflint --recursive --format=compact\n<\/code><\/span><\/pre>\n\n\n
                              For CI systems repeatedly running tflint --init<\/code>, provide an authenticated GitHub token to avoid anonymous GitHub API rate limits.<\/p>\n\n\n\n
                              TFLint vs validate<\/h2>\n\n\n\n
                              terraform validate<\/code><\/th>TFLint<\/th><\/tr><\/thead>
                              Terraform-native structural validity<\/td>Static lint\/best-practice checks<\/td><\/tr>
                              Understands Terraform language\/module configuration<\/td>Extensible provider-specific rules<\/td><\/tr>
                              Not a style\/security scanner<\/td>Can catch deprecated\/invalid provider patterns<\/td><\/tr>
                              Mandatory baseline<\/td>Strongly recommended complement<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                              \n\n\n\n
                              PART 5 \u2014 Terraform Security<\/h1>\n\n\n\n
                              10. Trivy<\/h1>\n\n\n\n
                              What<\/h2>\n\n\n\n
                              Trivy scans Terraform\/IaC for misconfiguration and can also scan repositories\/filesystems for secrets and other security problems.<\/p>\n\n\n\n
                              Common findings<\/h2>\n\n\n\n
                                \n
                              • public exposure,<\/li>\n\n\n\n
                              • weak encryption,<\/li>\n\n\n\n
                              • risky IAM,<\/li>\n\n\n\n
                              • permissive security groups,<\/li>\n\n\n\n
                              • weak storage policies,<\/li>\n\n\n\n
                              • Kubernetes misconfiguration,<\/li>\n\n\n\n
                              • plaintext secret patterns.<\/li>\n<\/ul>\n\n\n\n
                                Commands<\/h2>\n\n\n\n
                                IaC misconfiguration:<\/p>\n\n\n
                                trivy config .\n<\/code><\/span><\/pre>\n\n\n
                                Block high\/critical findings:<\/p>\n\n\n
                                trivy config --severity HIGH,CRITICAL --exit<\/span>-code 1<\/span> .\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                                Scan repository\/filesystem for both misconfiguration and secrets:<\/p>\n\n\n
                                trivy fs --scanners misconfig,secret --severity HIGH,CRITICAL .\n<\/code><\/span><\/pre>\n\n\n
                                Use tfvars when appropriate:<\/p>\n\n\n
                                trivy config --tf-vars environments\/staging\/staging.tfvars .\n<\/code><\/span><\/pre>\n\n\n
                                Policy<\/h2>\n\n\n\n
                                  \n
                                • Run a fast high\/critical gate locally.<\/li>\n\n\n\n
                                • Run the authoritative scan in CI.<\/li>\n\n\n\n
                                • Exceptions need a reason, owner, and preferably expiration date.<\/li>\n\n\n\n
                                • Treat scanner output as a risk signal, not proof of exploitability.<\/li>\n<\/ul>\n\n\n\n
                                  \n\n\n\n
                                  11. Checkov<\/h1>\n\n\n\n
                                  What<\/h2>\n\n\n\n
                                  Checkov is an IaC static analysis and compliance\/policy scanner with Terraform source and Terraform plan scanning.<\/p>\n\n\n\n
                                  Install in an isolated Python environment:<\/p>\n\n\n
                                  pipx install checkov\ncheckov --version\n<\/code><\/span><\/pre>\n\n\n
                                  Source scan:<\/p>\n\n\n
                                  checkov -d .\n<\/code><\/span><\/pre>\n\n\n
                                  Plan scan:<\/p>\n\n\n
                                  terraform plan -out=tfplan.binary\nterraform show -json tfplan.binary > tfplan.json\ncheckov -f tfplan.json\n<\/code><\/span><\/pre>\n\n\n
                                  Security:<\/strong> plan JSON may contain injected values and secrets. Create and scan it only in trusted CI and avoid publishing it as a broadly readable artifact.<\/p>\n\n\n\n
                                  Trivy vs Checkov<\/h2>\n\n\n\n
                                  Situation<\/th>Recommendation<\/th><\/tr><\/thead>
                                  Small\/medium team wants one broad security tool<\/td>Trivy only<\/strong><\/td><\/tr>
                                  Organization already standardizes Prisma\/Checkov policies\/compliance<\/td>Checkov only<\/strong> can be enough<\/td><\/tr>
                                  Regulated org has distinct, non-overlapping policy packs and accepts runtime cost<\/td>Both<\/strong>, but define ownership<\/td><\/tr>
                                  Same findings duplicated in both with no governance benefit<\/td>Remove one<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                  Do not add both simply to create the appearance of more security.<\/p>\n\n\n\n
                                  \n\n\n\n
                                  PART 6 \u2014 Terraform Testing<\/h1>\n\n\n\n
                                  12. Native terraform test<\/code><\/h1>\n\n\n\n
                                  What<\/h2>\n\n\n\n
                                  Terraform’s native test framework executes .tftest.hcl<\/code> files with run<\/code>, variables, assertions, plan\/apply modes, helper modules, and provider\/resource mocking.<\/p>\n\n\n\n
                                  Minimal example<\/h2>\n\n\n\n
                                  main.tf<\/code>:<\/p>\n\n\n
                                  variable \"environment\"<\/span> {\n  type = string\n\n  validation {\n    condition     = contains([\"dev\"<\/span>, \"staging\"<\/span>, \"prod\"<\/span>], var<\/span>.environment)\n    error_message = \"environment must be dev, staging, or prod\"<\/span>\n  }\n}\n\nlocals {\n  name = \"payments-${var.environment}\"<\/span>\n}\n\noutput \"name\"<\/span> {\n  description = \"Generated workload name.\"<\/span>\n  value       = local.name\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                  tests\/name.tftest.hcl<\/code>:<\/p>\n\n\n
                                  run \"staging_name\"<\/span> {\n  command = plan\n\n  variables {\n    environment = \"staging\"<\/span>\n  }\n\n  assert {\n    condition     = output.name == \"payments-staging\"<\/span>\n    error_message = \"Unexpected generated name.\"<\/span>\n  }\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                  Run:<\/p>\n\n\n
                                  terraform test\nterraform test -filter=tests\/name.tftest.hcl\n<\/code><\/span><\/pre>\n\n\n
                                  Provider mocking<\/h2>\n\n\n\n
                                  For modules using real providers, Terraform 1.7+ can mock providers:<\/p>\n\n\n
                                  mock_provider \"aws\"<\/span> {}\n\nrun \"secure_bucket_configuration\"<\/span> {\n  command = plan\n\n  assert {\n    condition     = aws_s3_bucket.example.bucket == var<\/span>.bucket_name\n    error_message = \"Bucket name wiring is incorrect.\"<\/span>\n  }\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                  This is excellent for logic\/interface tests without cloud credentials or real resources.<\/p>\n\n\n\n
                                  Test pyramid<\/h2>\n\n\n\n
                                              Live E2E \/ integration\n          Terratest \/ custom tests\n        -----------------------------\n             terraform test\n        plan\/apply + mocks\/assertions\n      ---------------------------------\n      validate + TFLint + security scan\n    -------------------------------------\n                  fmt\n<\/code><\/pre>\n\n\n\n
                                  What each layer proves<\/h2>\n\n\n\n
                                  Tool<\/th>Proves<\/th><\/tr><\/thead>
                                  validate<\/code><\/td>Terraform configuration can be parsed\/validated<\/td><\/tr>
                                  TFLint<\/td>Lint\/provider conventions<\/td><\/tr>
                                  terraform test<\/code><\/td>Declared module behavior\/assertions<\/td><\/tr>
                                  Real plan<\/code><\/td>Concrete proposed change in target context<\/td><\/tr>
                                  Terratest<\/td>Deployed infrastructure actually behaves as expected<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                  Terratest<\/h2>\n\n\n\n
                                  Use when you need:<\/p>\n\n\n\n
                                    \n
                                  • actual AWS\/Azure\/GCP API behavior,<\/li>\n\n\n\n
                                  • HTTP\/DNS\/TLS checks,<\/li>\n\n\n\n
                                  • retries\/eventual consistency,<\/li>\n\n\n\n
                                  • cross-component E2E validation,<\/li>\n\n\n\n
                                  • deploy \u2192 validate \u2192 destroy workflows.<\/li>\n<\/ul>\n\n\n\n
                                    Costs:<\/p>\n\n\n\n
                                      \n
                                    • slower,<\/li>\n\n\n\n
                                    • cloud cost,<\/li>\n\n\n\n
                                    • credential requirements,<\/li>\n\n\n\n
                                    • cleanup complexity,<\/li>\n\n\n\n
                                    • flaky external dependencies.<\/li>\n<\/ul>\n\n\n\n
                                      Default:<\/strong> native terraform test<\/code> first; Terratest only for gaps.<\/p>\n\n\n\n
                                      Kitchen-Terraform<\/h3>\n\n\n\n
                                      Still useful in teams already invested in Test Kitchen\/Ruby-based infrastructure testing. It is rarely the first recommendation for a new Terraform-only test platform in 2026.<\/p>\n\n\n\n
                                      \n\n\n\n
                                      PART 7 \u2014 Terraform Documentation<\/h1>\n\n\n\n
                                      13. terraform-docs<\/code><\/h1>\n\n\n\n
                                      What<\/h2>\n\n\n\n
                                      Generates Terraform module documentation from source:<\/p>\n\n\n\n
                                        \n
                                      • requirements,<\/li>\n\n\n\n
                                      • providers,<\/li>\n\n\n\n
                                      • modules,<\/li>\n\n\n\n
                                      • resources,<\/li>\n\n\n\n
                                      • inputs,<\/li>\n\n\n\n
                                      • outputs.<\/li>\n<\/ul>\n\n\n\n
                                        Installation<\/h2>\n\n\n\n
                                        macOS:<\/p>\n\n\n
                                        brew install terraform-docs\n<\/code><\/span><\/pre>\n\n\n
                                        Usage<\/h2>\n\n\n
                                        terraform-docs<\/span> markdown<\/span> table<\/span> .\nterraform-docs<\/span> markdown<\/span> table<\/span> --output-file<\/span> README<\/span>.md<\/span> --output-mode<\/span> inject<\/span> .\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
                                        README before<\/h2>\n\n\n
                                        # VPC module<\/span>\n\nCreates a VPC.\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                                        README with markers<\/h2>\n\n\n
                                        # VPC module\n\nCreates a VPC.\n\n<!-- BEGIN<em>_TF_<\/em>DOCS --><\/span>\n<!-- END<em>_TF_<\/em>DOCS --><\/span>\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
                                        After terraform-docs<\/code>, the marker section contains generated Requirements, Providers, Inputs, Outputs, etc.<\/p>\n\n\n\n
                                        .terraform-docs.yml<\/code><\/h2>\n\n\n
                                        formatter: \"markdown table\"\n\noutput:\n  file: \"README.md\"\n  mode: \"inject\"\n  template: |-\n    <!-- BEGIN_TF_DOCS --><\/span>\n    {{ .Content }}\n    <!-- END_TF_DOCS --><\/span>\n\nsort:\n  enabled: true\n  by: \"required\"\n\nsettings:\n  anchor: true\n  default: true\n  description: true\n  escape: true\n  hide-empty: false\n  html: true\n  lockfile: true\n  read-comments: true\n  required: true\n  sensitive: true\n  type: true\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
                                        Best practice<\/h2>\n\n\n\n
                                        Generated interface reference is not a replacement for authored documentation. A gold-standard module README has:<\/p>\n\n\n\n
                                          \n
                                        1. purpose,<\/li>\n\n\n\n
                                        2. architecture\/behavior,<\/li>\n\n\n\n
                                        3. security assumptions,<\/li>\n\n\n\n
                                        4. usage example,<\/li>\n\n\n\n
                                        5. generated inputs\/outputs,<\/li>\n\n\n\n
                                        6. upgrade notes,<\/li>\n\n\n\n
                                        7. operational caveats.<\/li>\n<\/ol>\n\n\n\n
                                          \n\n\n\n
                                          PART 8 \u2014 Terraform Cost Management<\/h1>\n\n\n\n
                                          14. Infracost<\/h1>\n\n\n\n
                                          What<\/h2>\n\n\n\n
                                          Infracost estimates cloud cost and turns Terraform changes into a cost delta visible during review.<\/p>\n\n\n\n
                                          Workflow<\/h2>\n\n\n
                                          Terraform change\n      \u2193\nPlan\/HCL analysis\n      \u2193\nInfracost\n      \u2193\nMonthly cost estimate + delta\n      \u2193\nPR reviewer sees cost impact\n      \u2193\nBudget \/ FinOps decision\n<\/code><\/span><\/pre>\n\n\n
                                          CLI<\/h2>\n\n\n
                                          infracost<\/span> breakdown<\/span> --path<\/span> .\ninfracost<\/span> breakdown<\/span> --path<\/span> . --format<\/span> json<\/span> --out-file<\/span> infracost-base<\/span>.json<\/span>\ninfracost<\/span> diff<\/span> --path<\/span> . --compare-to<\/span> infracost-base<\/span>.json<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
                                          It can also consume Terraform plan JSON when source parsing is not sufficient.<\/p>\n\n\n\n
                                          CI recommendation<\/h2>\n\n\n\n
                                          For GitHub, prefer the vendor’s current GitHub App or modern diff<\/code>\/scan<\/code> actions where allowed. Avoid building new integrations around legacy action patterns unless you need the lower-level CLI.<\/p>\n\n\n\n
                                          Policy<\/h2>\n\n\n\n
                                          Cost estimation is advisory unless your organization has explicitly defined budgets\/thresholds. A small cost increase may be correct; a zero-cost plan may still be dangerously destructive.<\/p>\n\n\n\n
                                          \n\n\n\n
                                          PART 9 \u2014 Git Automation<\/h1>\n\n\n\n
                                          15. pre-commit-terraform<\/code><\/h1>\n\n\n\n
                                          Why high value<\/h2>\n\n\n\n
                                          It moves deterministic checks left:<\/p>\n\n\n
                                          git commit\n    \u2193\nfmt\n    \u2193\nvalidate\n    \u2193\nTFLint\n    \u2193\nTrivy\n    \u2193\nterraform-docs\n    \u2193\ncommit accepted\n<\/code><\/span><\/pre>\n\n\n
                                          Installation<\/h2>\n\n\n
                                          brew install pre-commit\n<em<\/span>><\/span># or<\/em<\/span>><\/span>\npipx install pre-commit\n\npre-commit --version\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
                                          Production-ready .pre-commit-config.yaml<\/code><\/h2>\n\n\n
                                          repos:\n  - repo: https:\/\/github.com\/antonbabenko\/pre-commit-terraform<\/span>\n    rev: v1.108<\/span>.1<\/span>\n    hooks<\/span>:\n      - id: terraform_fmt\n\n      - id: terraform_validate\n        args<\/span>:\n          - --hook-config=--retry-once-with<\/span>-cleanup=true<\/span>\n\n      - id: terraform_tflint\n\n      - id: terraform_trivy\n        args<\/span>:\n          - --args=--severity=HIGH,CRITICAL\n          - --args=--exit-code=1<\/span>\n\n      - id: terraform_docs\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                          Enable:<\/p>\n\n\n
                                          pre-commit install\npre-commit run --all-files\n<\/code><\/span><\/pre>\n\n\n
                                          Local vs CI split<\/h2>\n\n\n\n
                                          Local<\/h3>\n\n\n\n
                                          Run checks that are fast and deterministic:<\/p>\n\n\n\n
                                            \n
                                          • fmt,<\/li>\n\n\n\n
                                          • validate,<\/li>\n\n\n\n
                                          • TFLint,<\/li>\n\n\n\n
                                          • focused Trivy,<\/li>\n\n\n\n
                                          • docs.<\/li>\n<\/ul>\n\n\n\n
                                            CI<\/h3>\n\n\n\n
                                            Re-run them authoritatively and add:<\/p>\n\n\n\n
                                              \n
                                            • full security policy,<\/li>\n\n\n\n
                                            • terraform test<\/code>,<\/li>\n\n\n\n
                                            • target-context plan,<\/li>\n\n\n\n
                                            • Infracost,<\/li>\n\n\n\n
                                            • plan-policy checks,<\/li>\n\n\n\n
                                            • approval\/apply rules.<\/li>\n<\/ul>\n\n\n\n
                                              Never rely solely on local hooks; users can skip them and environments differ.<\/p>\n\n\n\n
                                              \n\n\n\n
                                              PART 10 \u2014 Terraform Project Structure<\/h1>\n\n\n\n
                                              16. Recommended repository layout<\/h1>\n\n\n\n
                                              For a moderate monorepo:<\/p>\n\n\n
                                              terraform\/\n\u251c\u2500\u2500 modules\/\n\u2502   \u251c\u2500\u2500 vpc\/\n\u2502   \u2502   \u251c\u2500\u2500 main.tf\n\u2502   \u2502   \u251c\u2500\u2500 variables.tf\n\u2502   \u2502   \u251c\u2500\u2500 outputs.tf\n\u2502   \u2502   \u251c\u2500\u2500 versions.tf\n\u2502   \u2502   \u251c\u2500\u2500 tests\/\n\u2502   \u2502   \u2514\u2500\u2500 README.md\n\u2502   \u251c\u2500\u2500 eks\/\n\u2502   \u251c\u2500\u2500 rds\/\n\u2502   \u2514\u2500\u2500 iam\/\n\u2502\n\u251c\u2500\u2500 environments\/\n\u2502   \u251c\u2500\u2500 development\/\n\u2502   \u251c\u2500\u2500 staging\/\n\u2502   \u2514\u2500\u2500 production\/\n\u2502\n\u251c\u2500\u2500 .github\/\n\u2502   \u2514\u2500\u2500 workflows\/\n\u251c\u2500\u2500 .pre-commit-config.yaml\n\u251c\u2500\u2500 .tflint.hcl\n\u251c\u2500\u2500 renovate.json\n\u2514\u2500\u2500 README.md\n<\/code><\/span><\/pre>\n\n\n
                                              Root module vs child module<\/h2>\n\n\n\n
                                              Root module:<\/strong> deployment unit. Owns backend, environment composition, concrete provider constraints, and state.<\/p>\n\n\n\n
                                              Child\/reusable module:<\/strong> abstraction with documented inputs\/outputs. It should not normally own a backend or assume one environment\/account.<\/p>\n\n\n\n
                                              Files<\/h2>\n\n\n\n
                                              Recommended per module:<\/p>\n\n\n
                                              main.tf        # primary resources\/module calls<\/span>\nvariables.tf   # inputs<\/span>\noutputs.tf     # outputs<\/span>\nversions.tf    # Terraform\/provider requirements<\/span>\nlocals.tf      # optional, when locals warrant separation<\/span>\ndata.tf        # optional<\/span>\ntests\/         # native tests<\/span>\nREADME.md\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                                              Split further by domain only when it improves readability; Terraform loads all .tf<\/code> files in the directory together.<\/p>\n\n\n\n
                                              Environment separation<\/h2>\n\n\n\n
                                              Prefer separate state per meaningful failure\/ownership boundary:<\/p>\n\n\n
                                              production\/network\nproduction\/cluster\nproduction\/database\nproduction\/app-platform\n<\/code><\/span><\/pre>\n\n\n
                                              rather than one giant production state.<\/p>\n\n\n\n
                                              Reasons:<\/p>\n\n\n\n
                                                \n
                                              • smaller blast radius,<\/li>\n\n\n\n
                                              • simpler permissions,<\/li>\n\n\n\n
                                              • faster plan,<\/li>\n\n\n\n
                                              • clearer ownership,<\/li>\n\n\n\n
                                              • fewer unrelated lock conflicts.<\/li>\n<\/ul>\n\n\n\n
                                                Repository strategy<\/h2>\n\n\n\n
                                                Strategy<\/th>Pros<\/th>Cons<\/th>Best fit<\/th><\/tr><\/thead>
                                                Monorepo<\/td>Shared standards, atomic changes, discovery<\/td>CI\/path complexity, repo scale<\/td>Central platform teams<\/td><\/tr>
                                                Multi-repo by system<\/td>Strong ownership boundaries<\/td>Cross-repo upgrades harder<\/td>Independent teams<\/td><\/tr>
                                                One repo per environment<\/td>Strong isolation<\/td>Duplication\/drift risk<\/td>Strict org separation<\/td><\/tr>
                                                One repo per reusable module<\/td>Independent versioning\/release<\/td>Many repos<\/td>Mature internal module ecosystem<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                                There is no universal “one repo per environment” rule. Choose boundaries from ownership, release cadence, permissions, and blast radius.<\/p>\n\n\n\n
                                                \n\n\n\n
                                                PART 11 \u2014 Terragrunt<\/h1>\n\n\n\n
                                                17. Terragrunt<\/h1>\n\n\n\n
                                                Why it exists<\/h2>\n\n\n\n
                                                Terragrunt wraps Terraform\/OpenTofu to reduce repetition and orchestrate many related root modules.<\/p>\n\n\n\n
                                                Common value:<\/p>\n\n\n\n
                                                  \n
                                                • shared remote-state configuration,<\/li>\n\n\n\n
                                                • generated provider configuration,<\/li>\n\n\n\n
                                                • reusable environment\/account configuration,<\/li>\n\n\n\n
                                                • dependency outputs,<\/li>\n\n\n\n
                                                • multi-account\/multi-region layouts,<\/li>\n\n\n\n
                                                • ordered execution across units.<\/li>\n<\/ul>\n\n\n\n
                                                  Current CLI model<\/h2>\n\n\n\n
                                                  Modern Terragrunt 1.x:<\/p>\n\n\n
                                                  terragrunt plan\nterragrunt apply\nterragrunt run --all plan\nterragrunt run --all apply\n<\/code><\/span><\/pre>\n\n\n
                                                  Do not teach new teams to standardize on legacy run-all<\/code>.<\/p>\n\n\n\n
                                                  Example<\/h2>\n\n\n
                                                  live\/\n\u251c\u2500\u2500 root.hcl\n\u251c\u2500\u2500 dev\/\n\u2502   \u251c\u2500\u2500 vpc\/terragrunt.hcl\n\u2502   \u2514\u2500\u2500 app\/terragrunt.hcl\n\u2514\u2500\u2500 prod\/\n    \u251c\u2500\u2500 vpc\/terragrunt.hcl\n    \u2514\u2500\u2500 app\/terragrunt.hcl\n<\/code><\/span><\/pre>\n\n\n
                                                  root.hcl<\/code>:<\/p>\n\n\n
                                                  remote_state {\n  backend = \"s3\"<\/span>\n\n  config = {\n    bucket       = \"example-terraform-state\"<\/span>\n    key          = \"${path_relative_to_include()}\/terraform.tfstate\"<\/span>\n    region       = \"ap-northeast-1\"<\/span>\n    encrypt      = true<\/span>\n    use_lockfile = true<\/span>\n  }\n}\n\ngenerate \"provider\"<\/span> {\n  path      = \"provider.generated.tf\"<\/span>\n  if_exists = \"overwrite_terragrunt\"<\/span>\n\n  contents = <<EOF\nprovider \"aws\"<\/span> {\n  region = \"ap-northeast-1\"<\/span>\n}\nEOF\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                  prod\/app\/terragrunt.hcl<\/code>:<\/p>\n\n\n
                                                  include<\/span> \"root\"<\/span> {\n  path = find_in_parent_folders(\"root.hcl\"<\/span>)\n}\n\nterraform {\n  source = \"..\/..\/..\/modules\/app\"<\/span>\n}\n\ndependency \"vpc\"<\/span> {\n  config_path = \"..\/vpc\"<\/span>\n}\n\ninputs = {\n  vpc_id = dependency.vpc.outputs.vpc_id\n}\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                  When Terragrunt is unnecessary<\/h2>\n\n\n\n
                                                  Do not add it when:<\/p>\n\n\n\n
                                                    \n
                                                  • you have a few simple root modules,<\/li>\n\n\n\n
                                                  • HCP Terraform already removes the orchestration pain you were trying to solve,<\/li>\n\n\n\n
                                                  • duplication is small and explicit,<\/li>\n\n\n\n
                                                  • the team does not need multi-unit orchestration,<\/li>\n\n\n\n
                                                  • introducing a second language\/workflow would cost more than it saves.<\/li>\n<\/ul>\n\n\n\n
                                                    Terraform alone is a valid production architecture.<\/p>\n\n\n\n
                                                    \n\n\n\n
                                                    PART 12 \u2014 CI\/CD<\/h1>\n\n\n\n
                                                    18. GitHub Actions<\/h1>\n\n\n\n
                                                    Pipeline architecture<\/h2>\n\n\n
                                                    Pull request\n   \u2193\ncheckout\n   \u2193\nsetup pinned Terraform\n   \u2193\nfmt -check\n   \u2193\ninit -backend=false<\/span> (static<\/span>\/test jobs)\n   \u2193\nvalidate\n   \u2193\nTFLint\n   \u2193\nTrivy\n   \u2193\nterraform test\n   \u2193\nOIDC \u2192 target read\/plan role\n   \u2193\nterraform init\n   \u2193\nterraform plan\n   \u2193\nInfracost \/ policy \/ review\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                    Apply should be a separate controlled phase<\/strong>, not an automatic side effect of every PR plan.<\/p>\n\n\n\n
                                                    Example CI workflow<\/h2>\n\n\n
                                                    name: terraform-ci\n\non:\n  pull_request:\n    paths:\n      - \"**\/*.tf\"<\/span>\n      - \"**\/*.tfvars\"<\/span>\n      - \"**\/*.tftest.hcl\"<\/span>\n      - \".github\/workflows\/terraform-ci.yml\"<\/span>\n\npermissions:\n  contents: read\n\njobs:\n  quality:\n    runs-on: ubuntu-latest\n\n    steps:\n      - uses: actions\/checkout@v4\n\n      - name: Setup Terraform\n        uses: hashicorp\/setup-terraform@v3\n        with:\n          terraform_version: \"1.16.0\"<\/span>\n          terraform_wrapper: false<\/span>\n\n      - name: Format\n        run: terraform fmt -check -recursive\n\n      - name: Init without backend\n        run: terraform init -backend=false<\/span> -input=false<\/span>\n\n      - name: Validate\n        run: terraform validate -no-color\n\n      - name: Setup TFLint\n        uses: terraform-linters\/setup-tflint@v6\n        with:\n          tflint_version: \"v0.64.0\"<\/span>\n          cache: true<\/span>\n\n      - name: Init TFLint plugins\n        run: tflint --init\n        env:\n          GITHUB_TOKEN: ${{ github.token }}\n\n      - name: TFLint\n        run: tflint --recursive --format=compact\n\n      - name: Trivy IaC\n        uses: aquasecurity\/trivy-action@master\n        with:\n          scan-type: config\n          scan-ref: .\n          severity: HIGH,CRITICAL\n          exit<\/span>-code: \"1\"<\/span>\n\n      - name: Terraform tests\n        run: terraform test\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                    Supply-chain hardening note<\/h3>\n\n\n\n
                                                    For a true enterprise workflow, pin reusable GitHub Actions to reviewed immutable commit SHAs or enforce an organization action allowlist. Major tags are easier to read in a handbook but are mutable references.<\/p>\n\n\n\n
                                                    Plan job with AWS OIDC<\/h2>\n\n\n\n
                                                      plan:\n    needs: quality\n    runs-on: ubuntu-latest\n\n    permissions:\n      contents: read\n      id-token: write\n\n    environment: staging\n\n    steps:\n      - uses: actions\/checkout@v4\n\n      - uses: hashicorp\/setup-terraform@v3\n        with:\n          terraform_version: \"1.16.0\"\n          terraform_wrapper: false\n\n      - name: Authenticate to AWS using OIDC\n        uses: aws-actions\/configure-aws-credentials@v6\n        with:\n          role-to-assume: arn:aws:iam::123456789012:role\/terraform-staging-plan\n          aws-region: ap-northeast-1\n\n      - name: Init\n        working-directory: environments\/staging\n        run: terraform init -input=false\n\n      - name: Plan\n        working-directory: environments\/staging\n        run: terraform plan -input=false -no-color\n<\/code><\/pre>\n\n\n\n
                                                    OIDC design<\/h3>\n\n\n\n
                                                    Trust should be constrained by claims such as:<\/p>\n\n\n\n
                                                      \n
                                                    • organization\/repository identity,<\/li>\n\n\n\n
                                                    • environment,<\/li>\n\n\n\n
                                                    • branch\/tag,<\/li>\n\n\n\n
                                                    • immutable repository\/org IDs where supported.<\/li>\n<\/ul>\n\n\n\n
                                                      The plan role and apply role should be separate when practical.<\/p>\n\n\n\n
                                                      Apply model<\/h2>\n\n\n\n
                                                      Recommended:<\/p>\n\n\n
                                                      PR merged to protected<\/span> branch\n       \u2193\nnew<\/span> plan in controlled execution context\n       \u2193\npolicy checks\n       \u2193\nenvironment approval\n       \u2193\nassume apply role using OIDC\n       \u2193\nterraform apply\n       \u2193\nverification\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                      Why re-plan after merge? The reviewed branch may no longer be identical to the final protected branch if multiple changes merged.<\/p>\n\n\n\n
                                                      If your system securely preserves a reviewed saved plan and guarantees code\/state identity, applying the preserved plan is also valid.<\/p>\n\n\n\n
                                                      Secrets<\/h2>\n\n\n\n
                                                      Never store:<\/p>\n\n\n
                                                      AWS_ACCESS_KEY_ID\nAWS_SECRET_ACCESS_KEY\nlong-lived Azure client secrets\nlong-lived GCP service-account JSON<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                      when federation is available.<\/p>\n\n\n\n
                                                      \n\n\n\n
                                                      19. GitLab CI<\/h1>\n\n\n\n
                                                      Use the same gates:<\/p>\n\n\n
                                                      validate \u2192 lint \u2192 security \u2192 test \u2192 plan \u2192 policy \u2192 approval \u2192 apply\n<\/code><\/span><\/pre>\n\n\n
                                                      GitLab supports OIDC ID tokens for cloud federation. Modern GitLab uses ID tokens<\/strong>, not the removed legacy CI_JOB_JWT_V2<\/code>.<\/p>\n\n\n\n
                                                      Illustrative shape:<\/p>\n\n\n
                                                      stages:\n  - quality\n  - plan\n  - apply\n\nterraform-quality:\n  stage: quality\n  image: hashicorp\/terraform:1.16<\/span>.0<\/span>\n  script:\n    - terraform fmt -check -recursive\n    - terraform init -backend=false<\/span> -input=false<\/span>\n    - terraform validate\n    - terraform test\n\nterraform-plan:\n  stage: plan\n  id_tokens:\n    GITLAB_OIDC_TOKEN:\n      aud: sts.amazonaws.com\n  script:\n    - echo<\/span> \"Exchange GitLab OIDC token for short-lived cloud credentials\"<\/span>\n    - terraform init -input=false<\/span>\n    - terraform plan -input=false<\/span>\n\nterraform-apply:\n  stage: apply\n  when: manual\n  rules:\n    - if<\/span>: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'<\/span>\n  script:\n    - terraform apply -input=false<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                      Exact AWS\/Azure\/GCP token-exchange steps should follow the current cloud\/GitLab federation documentation and your organization’s role design.<\/p>\n\n\n\n
                                                      \n\n\n\n
                                                      PART 13 \u2014 Atlantis<\/h1>\n\n\n\n
                                                      20. Atlantis<\/h1>\n\n\n\n
                                                      What<\/h2>\n\n\n\n
                                                      Atlantis is a server that reacts to pull-request comments\/events and runs Terraform plans\/applies in a PR-driven workflow.<\/p>\n\n\n
                                                      PR opened\n   \u2193\nAtlantis autoplan\n   \u2193\nreview plan\n   \u2193\napproval\n   \u2193\natlantis apply\n<\/code><\/span><\/pre>\n\n\n
                                                      Commands<\/h2>\n\n\n
                                                      atlantis plan\natlantis apply\n<\/code><\/span><\/pre>\n\n\n
                                                      Strengths<\/h2>\n\n\n\n
                                                        \n
                                                      • PR-native workflow,<\/li>\n\n\n\n
                                                      • project\/workspace awareness,<\/li>\n\n\n\n
                                                      • locking,<\/li>\n\n\n\n
                                                      • plan\/apply conversation in VCS,<\/li>\n\n\n\n
                                                      • works across multiple Terraform projects.<\/li>\n<\/ul>\n\n\n\n
                                                        Atlantis locks a directory\/workspace when a plan is active so competing PRs do not casually race the same deployment unit.<\/p>\n\n\n\n
                                                        Atlantis vs GitHub Actions vs HCP Terraform<\/h2>\n\n\n\n
                                                        Need<\/th>Better fit<\/th><\/tr><\/thead>
                                                        Generic build\/test ecosystem<\/td>GitHub\/GitLab CI<\/td><\/tr>
                                                        Comment-driven Terraform workflow you operate<\/td>Atlantis<\/td><\/tr>
                                                        Managed state, remote runs, RBAC, registry, run tasks, policy, health<\/td>HCP Terraform<\/td><\/tr>
                                                        Self-hosted HCP feature set<\/td>Terraform Enterprise<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                                        Avoid running Atlantis and<\/em> a separate CI apply system against the same state without a very explicit ownership model.<\/p>\n\n\n\n
                                                        \n\n\n\n
                                                        PART 14 \u2014 HCP Terraform<\/h1>\n\n\n\n
                                                        21. HCP Terraform<\/h1>\n\n\n\n
                                                        What it adds beyond CLI<\/h2>\n\n\n\n
                                                          \n
                                                        • remote state and state history,<\/li>\n\n\n\n
                                                        • stronger centralized run coordination,<\/li>\n\n\n\n
                                                        • remote runs,<\/li>\n\n\n\n
                                                        • workspaces,<\/li>\n\n\n\n
                                                        • projects,<\/li>\n\n\n\n
                                                        • variable sets,<\/li>\n\n\n\n
                                                        • self-hosted agents,<\/li>\n\n\n\n
                                                        • private module\/provider registry,<\/li>\n\n\n\n
                                                        • run tasks,<\/li>\n\n\n\n
                                                        • policy enforcement,<\/li>\n\n\n\n
                                                        • VCS-driven speculative plans,<\/li>\n\n\n\n
                                                        • team\/project\/workspace RBAC,<\/li>\n\n\n\n
                                                        • health assessments including drift detection and continuous validation,<\/li>\n\n\n\n
                                                        • API\/audit capabilities depending on edition.<\/li>\n<\/ul>\n\n\n\n
                                                          Enterprise workflow<\/h2>\n\n\n
                                                          Git branch\n   \u2193\nPull request\n   \u2193\nHCP speculative plan\n   \u2193\nCI\/security\/cost checks\n   \u2193\nreview\n   \u2193\nmerge\n   \u2193\nHCP run\n   \u2193\npolicy checks \/ run tasks\n   \u2193\napproval\n   \u2193\nremote worker or<\/span> private<\/span> agent\n   \u2193\ncloud\n   \u2193\nhealth assessment \/ drift detection\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                          Workspaces<\/h2>\n\n\n\n
                                                          An HCP Terraform workspace is a deployment\/state boundary, not the same concept as a Terraform CLI workspace.<\/p>\n\n\n\n
                                                          Use workspaces to separate infrastructure with different:<\/p>\n\n\n\n
                                                            \n
                                                          • state,<\/li>\n\n\n\n
                                                          • permissions,<\/li>\n\n\n\n
                                                          • ownership,<\/li>\n\n\n\n
                                                          • credentials,<\/li>\n\n\n\n
                                                          • run cadence,<\/li>\n\n\n\n
                                                          • blast radius.<\/li>\n<\/ul>\n\n\n\n
                                                            Avoid a single giant workspace for an entire company environment.<\/p>\n\n\n\n
                                                            Projects<\/h2>\n\n\n\n
                                                            Use projects as access-control\/organizational boundaries grouping workspaces and Stacks.<\/p>\n\n\n\n
                                                            Good project boundaries:<\/p>\n\n\n\n
                                                              \n
                                                            • platform,<\/li>\n\n\n\n
                                                            • analytics,<\/li>\n\n\n\n
                                                            • security,<\/li>\n\n\n\n
                                                            • business unit,<\/li>\n\n\n\n
                                                            • account\/portfolio.<\/li>\n<\/ul>\n\n\n\n
                                                              Variable sets<\/h2>\n\n\n\n
                                                              Good uses:<\/p>\n\n\n\n
                                                                \n
                                                              • common non-secret environment settings,<\/li>\n\n\n\n
                                                              • dynamic credential configuration,<\/li>\n\n\n\n
                                                              • shared provider settings,<\/li>\n\n\n\n
                                                              • organization\/project-wide standards.<\/li>\n<\/ul>\n\n\n\n
                                                                Do not use variable sets as an excuse to hide every important deployment value from code review.<\/p>\n\n\n\n
                                                                Agents<\/h2>\n\n\n\n
                                                                Use HCP Terraform Agents when the run must reach:<\/p>\n\n\n\n
                                                                  \n
                                                                • private VPC\/VNet resources,<\/li>\n\n\n\n
                                                                • on-premises services,<\/li>\n\n\n\n
                                                                • private APIs,<\/li>\n\n\n\n
                                                                • network-isolated providers.<\/li>\n<\/ul>\n\n\n\n
                                                                  Agents need only outbound connectivity to HCP Terraform.<\/p>\n\n\n\n
                                                                  Do not deploy agents merely because “enterprise teams use agents.” Built-in workers are simpler when private network access\/custom tooling is not required.<\/p>\n\n\n\n
                                                                  Private registry<\/h2>\n\n\n\n
                                                                  Use the private registry for:<\/p>\n\n\n\n
                                                                    \n
                                                                  • approved reusable modules,<\/li>\n\n\n\n
                                                                  • internally developed providers,<\/li>\n\n\n\n
                                                                  • versioned organization patterns.<\/li>\n<\/ul>\n\n\n\n
                                                                    A mature platform team should make the secure path the easy path:<\/p>\n\n\n
                                                                    developer need \u2192 approved private module<\/span> \u2192 small set<\/span> of inputs \u2192 tests\/policy \u2192 deploy\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                    Run tasks<\/h2>\n\n\n\n
                                                                    Useful for third-party checks at lifecycle stages such as:<\/p>\n\n\n\n
                                                                      \n
                                                                    • pre-plan,<\/li>\n\n\n\n
                                                                    • post-plan,<\/li>\n\n\n\n
                                                                    • pre-apply,<\/li>\n\n\n\n
                                                                    • post-apply.<\/li>\n<\/ul>\n\n\n\n
                                                                      Examples:<\/p>\n\n\n\n
                                                                        \n
                                                                      • security platform,<\/li>\n\n\n\n
                                                                      • cost governance,<\/li>\n\n\n\n
                                                                      • custom compliance,<\/li>\n\n\n\n
                                                                      • image validation.<\/li>\n<\/ul>\n\n\n\n
                                                                        Only integrate trusted run-task services because run-related information can be sensitive.<\/p>\n\n\n\n
                                                                        HCP Terraform vs Terraform Enterprise vs CLI<\/h2>\n\n\n\n
                                                                        Capability<\/th>Terraform CLI<\/th>HCP Terraform<\/th>Terraform Enterprise<\/th><\/tr><\/thead>
                                                                        Terraform engine<\/td>Yes<\/td>Yes<\/td>Yes<\/td><\/tr>
                                                                        Local execution<\/td>Yes<\/td>Can integrate<\/td>Can integrate<\/td><\/tr>
                                                                        Managed SaaS<\/td>No<\/td>Yes<\/td>No<\/td><\/tr>
                                                                        Self-hosted platform<\/td>No<\/td>No<\/td>Yes<\/td><\/tr>
                                                                        Remote state<\/td>Via backend<\/td>Built in<\/td>Built in<\/td><\/tr>
                                                                        Remote runs<\/td>No platform by itself<\/td>Built in<\/td>Built in<\/td><\/tr>
                                                                        Projects\/RBAC<\/td>No<\/td>Yes<\/td>Yes<\/td><\/tr>
                                                                        Private registry<\/td>No<\/td>Yes<\/td>Yes<\/td><\/tr>
                                                                        Agents<\/td>N\/A<\/td>Yes<\/td>Yes<\/td><\/tr>
                                                                        Policy\/run tasks<\/td>External<\/td>Integrated<\/td>Integrated<\/td><\/tr>
                                                                        Drift\/health<\/td>External<\/td>Integrated by edition<\/td>Integrated<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                                                        Terraform Enterprise is the self-hosted distribution of the HCP Terraform application for organizations requiring private hosting\/advanced architecture\/compliance controls.<\/p>\n\n\n\n
                                                                        \n\n\n\n
                                                                        PART 15 \u2014 Policy as Code<\/h1>\n\n\n\n
                                                                        22. Sentinel<\/h1>\n\n\n\n
                                                                        What<\/h2>\n\n\n\n
                                                                        HashiCorp’s policy-as-code framework integrated with HCP Terraform\/TFE.<\/p>\n\n\n\n
                                                                        Enforcement styles<\/h2>\n\n\n\n
                                                                          \n
                                                                        • Advisory<\/strong>\u00a0\u2014 report failure but allow run.<\/li>\n\n\n\n
                                                                        • Soft mandatory \/ overridable<\/strong>\u00a0\u2014 block unless authorized override.<\/li>\n\n\n\n
                                                                        • Hard mandatory \/ mandatory<\/strong>\u00a0\u2014 block until fixed, subject to platform policy-set semantics.<\/li>\n<\/ul>\n\n\n\n
                                                                          Use terms carefully because HCP Terraform’s UI\/framework-specific naming can differ.<\/p>\n\n\n\n
                                                                          Example policy scenarios<\/h2>\n\n\n\n
                                                                            \n
                                                                          • approved AWS regions,<\/li>\n\n\n\n
                                                                          • no public storage,<\/li>\n\n\n\n
                                                                          • allowed EC2 families,<\/li>\n\n\n\n
                                                                          • mandatory tags,<\/li>\n\n\n\n
                                                                          • encryption required,<\/li>\n\n\n\n
                                                                          • restrict resource deletion,<\/li>\n\n\n\n
                                                                          • only approved modules.<\/li>\n<\/ul>\n\n\n\n
                                                                            Rollout model<\/h2>\n\n\n
                                                                            new<\/span> rule\n  \u2193\nadvisory\n  \u2193\nobserve false<\/span> positives\n  \u2193\nfix existing estate\n  \u2193\nmandatory with<\/span> controlled exception process\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                            Do not deploy dozens of untested hard-blocking policies on day one.<\/p>\n\n\n\n
                                                                            \n\n\n\n
                                                                            23. OPA \/ Conftest<\/h1>\n\n\n\n
                                                                            OPA<\/h2>\n\n\n\n
                                                                            OPA evaluates Rego policies against structured input. Terraform plan JSON is a common input:<\/p>\n\n\n
                                                                            terraform plan -out=tfplan\nterraform show -json tfplan > tfplan.json\nopa exec --decision terraform\/analysis\/authz --bundle policy\/ tfplan.json\n<\/code><\/span><\/pre>\n\n\n
                                                                            Caveat: plan-time unknown values can limit what a policy can know.<\/p>\n\n\n\n
                                                                            Conftest<\/h2>\n\n\n\n
                                                                            Conftest is a convenient CLI for executing Rego checks against structured files.<\/p>\n\n\n
                                                                            conftest test tfplan.json --policy policy\/\nconftest verify --policy policy\/\n<\/code><\/span><\/pre>\n\n\n
                                                                            Typical policy:<\/p>\n\n\n
                                                                            package main\n\ndeny contains msg if<\/span> {\n  some rc in<\/span> input.resource_changes\n  rc.type == \"aws_security_group_rule\"<\/span>\n  some cidr in<\/span> rc.change.after.cidr_blocks\n  cidr == \"0.0.0.0\/0\"<\/span>\n  msg<\/span> := sprintf(\"Public ingress is not allowed: %s\"<\/span>, [rc.address])\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                            Production policies need careful handling for null\/unknown\/alternate resource shapes; the snippet is intentionally small.<\/p>\n\n\n\n
                                                                            Decision guide<\/h2>\n\n\n\n
                                                                            Framework<\/th>Best fit<\/th><\/tr><\/thead>
                                                                            Terraform Policy (HCL)<\/td>Terraform-centric HCP teams wanting native HCL policy; evaluate maturity while beta<\/td><\/tr>
                                                                            Sentinel<\/td>HCP\/TFE estates with HashiCorp governance investment<\/td><\/tr>
                                                                            OPA<\/td>Vendor-neutral enterprise policy platform<\/td><\/tr>
                                                                            Conftest<\/td>Lightweight local\/CI Rego execution<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                                                            \n\n\n\n
                                                                            PART 16 \u2014 Dependency Management<\/h1>\n\n\n\n
                                                                            24. Renovate<\/h1>\n\n\n\n
                                                                            What<\/h2>\n\n\n\n
                                                                            Automates dependency update PRs for:<\/p>\n\n\n\n
                                                                              \n
                                                                            • Terraform\u00a0required_version<\/code>,<\/li>\n\n\n\n
                                                                            • .terraform-version<\/code>,<\/li>\n\n\n\n
                                                                            • providers,<\/li>\n\n\n\n
                                                                            • Registry modules,<\/li>\n\n\n\n
                                                                            • Git-based modules where supported,<\/li>\n\n\n\n
                                                                            • GitHub Actions,<\/li>\n\n\n\n
                                                                            • many surrounding build dependencies.<\/li>\n<\/ul>\n\n\n\n
                                                                              Recommended renovate.json<\/code><\/h2>\n\n\n
                                                                              {\n  \"extends\"<\/span>: [\"config:recommended\"<\/span>],\n  \"labels\"<\/span>: [\"dependencies\"<\/span>],\n  \"packageRules\"<\/span>: [\n    {\n      \"matchManagers\"<\/span>: [\"terraform\"<\/span>, \"terraform-version\"<\/span>],\n      \"groupName\"<\/span>: \"terraform dependencies\"<\/span>,\n      \"schedule\"<\/span>: [\"before 6am on monday\"<\/span>]\n    },\n    {\n      \"matchManagers\"<\/span>: [\"github-actions\"<\/span>],\n      \"groupName\"<\/span>: \"github actions\"<\/span>\n    },\n    {\n      \"matchUpdateTypes\"<\/span>: [\"major\"<\/span>],\n      \"dependencyDashboardApproval\"<\/span>: true<\/span>\n    }\n  ]\n}\n<\/code><\/span>Code language:<\/span> JSON \/ JSON with Comments<\/span> (<\/span>json<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                              Upgrade policy<\/h2>\n\n\n\n
                                                                              Do not auto-merge major Terraform\/provider\/module upgrades into production infrastructure merely because CI is green.<\/p>\n\n\n\n
                                                                              Recommended:<\/p>\n\n\n
                                                                              patch \u2192 may auto-merge after strong test gates\nminor \u2192 normal PR review\nmajor \u2192 explicit upgrade issue, changelog review, staged rollout\n<\/code><\/span><\/pre>\n\n\n
                                                                              \n\n\n\n
                                                                              25. tfupdate<\/code><\/h1>\n\n\n\n
                                                                              tfupdate<\/code> is a focused utility for rewriting Terraform\/OpenTofu core\/provider\/module version constraints and lock files.<\/p>\n\n\n\n
                                                                              Example:<\/p>\n\n\n
                                                                              tfupdate<\/span> terraform<\/span> -v<\/span> 1.16<\/span>.0<\/span> -r<\/span> .\ntfupdate<\/span> provider<\/span> aws<\/span> -v<\/span> \"~> 6.0<\/span>\" -r<\/span> .\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                              It is still useful for scripts and specialized bulk updates.<\/p>\n\n\n\n
                                                                              Default recommendation:<\/strong> prefer Renovate for continuous dependency management because it covers Terraform, modules, providers, actions, and many other dependencies with PR workflows. Use tfupdate<\/code> when you specifically need command-line rewriting\/automation.<\/p>\n\n\n\n
                                                                              \n\n\n\n
                                                                              PART 17 \u2014 Terraform Console<\/h1>\n\n\n\n
                                                                              26. terraform console<\/code><\/h1>\n\n\n\n
                                                                              The console is one of the fastest ways to debug Terraform expressions without creating resources.<\/p>\n\n\n
                                                                              terraform console<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                              Examples:<\/p>\n\n\n
                                                                              > upper(\"prod\"<\/span>)\n\"PROD\"<\/span>\n\n> length([\"a\"<\/span>, \"b\"<\/span>, \"c\"<\/span>])\n3<\/span>\n\n> contains([\"dev\"<\/span>, \"prod\"<\/span>], \"prod\"<\/span>)\ntrue<\/span>\n\n> merge({a = 1<\/span>}, {b = 2<\/span>})\n{\n  \"a\"<\/span> = 1<\/span>\n  \"b\"<\/span> = 2<\/span>\n}\n\n> [for<\/span> x in<\/span> [\"api\"<\/span>, \"worker\"<\/span>] : \"prod-${x}\"<\/span>]\n[\n  \"prod-api\"<\/span>,\n  \"prod-worker\"<\/span>,\n]\n\n> { for<\/span> x in<\/span> [\"api\"<\/span>, \"worker\"<\/span>] : x<\/span> =><\/span> upper(x) }\n{\n  \"api\"<\/span> = \"API\"<\/span>\n  \"worker\"<\/span> = \"WORKER\"<\/span>\n}\n\n> cidrsubnet(\"10.0.0.0\/16\"<\/span>, 8<\/span>, 1<\/span>)\n\"10.0.1.0\/24\"<\/span>\n\n> try<\/span>({a = 1<\/span>}.b, \"fallback\"<\/span>)\n\"fallback\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                              Use it to prototype:<\/p>\n\n\n\n
                                                                                \n
                                                                              • for<\/code>\u00a0expressions,<\/li>\n\n\n\n
                                                                              • map merging,<\/li>\n\n\n\n
                                                                              • conditionals,<\/li>\n\n\n\n
                                                                              • CIDR subdivision,<\/li>\n\n\n\n
                                                                              • string transformations,<\/li>\n\n\n\n
                                                                              • try<\/code>\/can<\/code>,<\/li>\n\n\n\n
                                                                              • regex,<\/li>\n\n\n\n
                                                                              • collection conversion.<\/li>\n<\/ul>\n\n\n\n
                                                                                Do not use console output as a substitute for a repeatable test when the expression matters to production behavior.<\/p>\n\n\n\n
                                                                                \n\n\n\n
                                                                                PART 18 \u2014 IDE + AI Development Workflow<\/h1>\n\n\n\n
                                                                                27. Modern AI-assisted workflow<\/h1>\n\n\n
                                                                                Developer intent\n      \u2193\nAI agent\n      \u2193\nTerraform MCP \/ current provider docs\n      \u2193\nGenerate\/refactor HCL\n      \u2193\nterraform fmt\n      \u2193\nterraform validate\n      \u2193\nTFLint\n      \u2193\nTrivy\n      \u2193\nterraform test\n      \u2193\nhuman review\n      \u2193\nreal plan\n<\/code><\/span><\/pre>\n\n\n
                                                                                Good AI tasks<\/h2>\n\n\n\n
                                                                                  \n
                                                                                • generate boilerplate,<\/li>\n\n\n\n
                                                                                • explain resources,<\/li>\n\n\n\n
                                                                                • draft variables\/outputs,<\/li>\n\n\n\n
                                                                                • create native tests,<\/li>\n\n\n\n
                                                                                • refactor repeated HCL,<\/li>\n\n\n\n
                                                                                • produce module documentation,<\/li>\n\n\n\n
                                                                                • identify likely missing validation,<\/li>\n\n\n\n
                                                                                • compare plan output,<\/li>\n\n\n\n
                                                                                • search current provider docs through MCP.<\/li>\n<\/ul>\n\n\n\n
                                                                                  Never blindly trust AI for<\/h2>\n\n\n\n
                                                                                    \n
                                                                                  • IAM,<\/li>\n\n\n\n
                                                                                  • security-group\/network exposure,<\/li>\n\n\n\n
                                                                                  • KMS\/key policy,<\/li>\n\n\n\n
                                                                                  • destructive lifecycle changes,<\/li>\n\n\n\n
                                                                                  • provider upgrade compatibility,<\/li>\n\n\n\n
                                                                                  • terraform state<\/code>\u00a0operations,<\/li>\n\n\n\n
                                                                                  • imports\/moves without address review,<\/li>\n\n\n\n
                                                                                  • production apply,<\/li>\n\n\n\n
                                                                                  • secret handling,<\/li>\n\n\n\n
                                                                                  • cost assumptions.<\/li>\n<\/ul>\n\n\n\n
                                                                                    AI prompt template<\/h2>\n\n\n
                                                                                    Act as a senior Terraform reviewer.\n\nContext:\n- Terraform: <constraint<\/span>><\/span>\n- Provider: <source<\/span> + constraint<\/span>><\/span>\n- Execution: <HCP<\/span> Terraform<\/span> \/ CI<\/span> \/ local<\/span>><\/span>\n- Environment: <dev<\/span>\/stage<\/span>\/prod<\/span>><\/span>\n- State boundary: <description<\/span>><\/span>\n\nTask:\n<requested<\/span> change<\/span>><\/span>\n\nBefore writing code:\n1. Use current Terraform\/provider documentation or Terraform MCP.\n2. Identify security, state, replacement, and cost risks.\n3. Preserve resource addresses unless a move is explicitly required.\n4. Do not hardcode credentials\/secrets.\n5. Prefer OIDC\/workload identity.\n\nAfter writing code:\n1. terraform fmt\n2. terraform validate\n3. TFLint\n4. Trivy\n5. terraform test\n6. explain expected plan and anything requiring human verification.\n\nNever run or recommend an unreviewed production apply.\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                    \n\n\n\n
                                                                                    PART 19 \u2014 Terraform Developer Daily Workflow<\/h1>\n\n\n\n
                                                                                    28. Daily workflow<\/h1>\n\n\n\n
                                                                                      \n
                                                                                    1. Pull latest code<\/strong>git switch main git pull --ff-only<\/code><\/li>\n\n\n\n
                                                                                    2. Select project tool version<\/strong>tenv tf install terraform version<\/code><\/li>\n\n\n\n
                                                                                    3. Create a branch<\/strong>git switch -c feat\/add-private-endpoint<\/code><\/li>\n\n\n\n
                                                                                    4. Initialize<\/strong>terraform init<\/code><\/li>\n\n\n\n
                                                                                    5. Write\/change Terraform<\/strong><\/li>\n\n\n\n
                                                                                    6. Format<\/strong>terraform fmt -recursive<\/code><\/li>\n\n\n\n
                                                                                    7. Validate<\/strong>terraform validate<\/code><\/li>\n\n\n\n
                                                                                    8. Lint<\/strong>tflint --init tflint --recursive<\/code><\/li>\n\n\n\n
                                                                                    9. Security scan<\/strong>trivy config --severity HIGH,CRITICAL --exit-code 1 .<\/code><\/li>\n\n\n\n
                                                                                    10. Run tests<\/strong>terraform test<\/code><\/li>\n\n\n\n
                                                                                    11. Generate docs<\/strong>terraform-docs markdown table --output-file README.md --output-mode inject .<\/code><\/li>\n\n\n\n
                                                                                    12. Plan in a safe target context<\/strong>terraform plan<\/code><\/li>\n\n\n\n
                                                                                    13. Inspect cost delta<\/strong>infracost breakdown --path .<\/code><\/li>\n\n\n\n
                                                                                    14. Review your own diff<\/strong>git diff git status<\/code><\/li>\n\n\n\n
                                                                                    15. Commit<\/strong>git add . git commit -m \"feat: add private endpoint\"<\/code><\/li>\n\n\n\n
                                                                                    16. Pre-commit hooks execute<\/strong><\/li>\n\n\n\n
                                                                                    17. Push<\/strong>git push -u origin HEAD<\/code><\/li>\n\n\n\n
                                                                                    18. CI reproduces checks and plan<\/strong><\/li>\n\n\n\n
                                                                                    19. PR review<\/strong>\u00a0Reviewer checks security, replacement, blast radius, cost, test quality.<\/li>\n\n\n\n
                                                                                    20. Policy validation<\/strong><\/li>\n\n\n\n
                                                                                    21. Controlled apply<\/strong><\/li>\n\n\n\n
                                                                                    22. Post-deployment verification<\/strong>\u00a0Check service health, metrics, logs, connectivity, and expected outputs.<\/li>\n\n\n\n
                                                                                    23. Drift\/health feedback<\/strong>\u00a0Operational system closes the loop.<\/li>\n<\/ol>\n\n\n\n
                                                                                      \n\n\n\n
                                                                                      PART 20 \u2014 Complete Developer Toolchain Reference<\/h1>\n\n\n\n
                                                                                      29. Master reference<\/h1>\n\n\n\n
                                                                                      Tool<\/th>Problem solved<\/th>Basic usage<\/th>Value<\/th>Limitation<\/th>Classification<\/th><\/tr><\/thead>
                                                                                      Terraform CLI<\/td>IaC lifecycle<\/td>terraform plan<\/code><\/td>Core engine<\/td>Needs surrounding controls<\/td>MUST<\/td><\/tr>
                                                                                      VS Code<\/td>Authoring<\/td>open project<\/td>Productivity<\/td>Editor only<\/td>Recommended<\/td><\/tr>
                                                                                      HashiCorp extension<\/td>Terraform IDE<\/td>install extension<\/td>Completion\/diagnostics<\/td>VS Code focused<\/td>Recommended<\/td><\/tr>
                                                                                      terraform-ls<\/code><\/td>LSP intelligence<\/td>normally bundled<\/td>Schema\/navigation<\/td>Not security\/policy<\/td>Recommended<\/td><\/tr>
                                                                                      Terraform MCP<\/td>AI current context<\/td>configure MCP host<\/td>Reduces stale AI output<\/td>Trust\/access design<\/td>Recommended with AI<\/td><\/tr>
                                                                                      tenv<\/code><\/td>Binary versions<\/td>tenv tf use<\/code><\/td>Reproducibility<\/td>Extra dependency<\/td>Recommended<\/td><\/tr>
                                                                                      terraform fmt<\/code><\/td>Style<\/td>fmt -recursive<\/code><\/td>Deterministic format<\/td>Not validation<\/td>MUST<\/td><\/tr>
                                                                                      terraform validate<\/code><\/td>Config validity<\/td>validate<\/code><\/td>Cheap errors<\/td>Not provider runtime security<\/td>MUST<\/td><\/tr>
                                                                                      TFLint<\/td>Lint\/provider checks<\/td>tflint --recursive<\/code><\/td>Higher code quality<\/td>Not full security<\/td>Recommended<\/td><\/tr>
                                                                                      Trivy<\/td>Misconfig\/secrets<\/td>trivy config .<\/code><\/td>Broad security<\/td>Policy noise possible<\/td>Recommended<\/td><\/tr>
                                                                                      Checkov<\/td>Compliance\/IaC policy<\/td>checkov -d .<\/code><\/td>Broad policy library<\/td>Overlap<\/td>Optional<\/td><\/tr>
                                                                                      terraform test<\/code><\/td>Native behavior tests<\/td>terraform test<\/code><\/td>Fast\/native<\/td>Live behavior may need more<\/td>Recommended<\/td><\/tr>
                                                                                      Terratest<\/td>Real integration tests<\/td>go test<\/code><\/td>Strong E2E<\/td>Slow\/cost\/flakiness<\/td>Optional<\/td><\/tr>
                                                                                      terraform-docs<\/td>Interface docs<\/td>terraform-docs ...<\/code><\/td>No stale input\/output tables<\/td>Doesn’t write architecture narrative<\/td>Recommended<\/td><\/tr>
                                                                                      Infracost<\/td>Cost delta<\/td>infracost diff<\/code><\/td>FinOps in review<\/td>Estimate not invoice<\/td>Recommended<\/td><\/tr>
                                                                                      pre-commit-terraform<\/td>Local gates<\/td>pre-commit run<\/code><\/td>Fast feedback<\/td>Can be bypassed<\/td>Recommended<\/td><\/tr>
                                                                                      Git<\/td>Version\/review<\/td>git diff<\/code><\/td>Audit\/review<\/td>Needs policy<\/td>MUST<\/td><\/tr>
                                                                                      GitHub\/GitLab<\/td>Collaboration<\/td>PR\/MR<\/td>Review controls<\/td>Platform dependency<\/td>MUST for teams<\/td><\/tr>
                                                                                      GitHub Actions\/GitLab CI<\/td>Automation<\/td>pipeline<\/td>Reproducible checks<\/td>Runner\/security design needed<\/td>MUST for prod teams<\/td><\/tr>
                                                                                      Terragrunt<\/td>Multi-unit DRY\/orchestration<\/td>run --all plan<\/code><\/td>Scale multi-env layouts<\/td>Added abstraction<\/td>Optional<\/td><\/tr>
                                                                                      Atlantis<\/td>PR-driven Terraform<\/td>PR commands<\/td>Terraform-focused UX<\/td>Operate server\/security<\/td>Optional<\/td><\/tr>
                                                                                      HCP Terraform<\/td>Remote Terraform platform<\/td>workspace runs<\/td>State\/runs\/RBAC\/policy<\/td>Commercial\/platform choice<\/td>Recommended\/Enterprise<\/td><\/tr>
                                                                                      Terraform Enterprise<\/td>Self-hosted HCP<\/td>self-host<\/td>Compliance\/private hosting<\/td>Operational burden<\/td>Enterprise<\/td><\/tr>
                                                                                      Sentinel<\/td>HCP\/TFE policy<\/td>policy sets<\/td>Integrated governance<\/td>HashiCorp-specific<\/td>Enterprise<\/td><\/tr>
                                                                                      OPA<\/td>Vendor-neutral policy<\/td>opa exec<\/code><\/td>Reusable policy platform<\/td>Rego learning curve<\/td>Enterprise\/Optional<\/td><\/tr>
                                                                                      Conftest<\/td>Rego CLI<\/td>conftest test<\/code><\/td>Easy CI integration<\/td>Not Terraform orchestrator<\/td>Optional<\/td><\/tr>
                                                                                      Renovate<\/td>Dependency PRs<\/td>bot\/app<\/td>Sustainable upgrades<\/td>Needs grouping\/rules<\/td>Recommended<\/td><\/tr>
                                                                                      tfupdate<\/code><\/td>Constraint rewrites<\/td>tfupdate provider<\/code><\/td>Focused automation<\/td>Narrower than Renovate<\/td>Optional<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                                                                      \n\n\n\n
                                                                                      PART 21 \u2014 Recommended Stacks by Maturity<\/h1>\n\n\n\n
                                                                                      30. Beginner<\/h1>\n\n\n
                                                                                      Terraform CLI\nVS Code\nHashiCorp Terraform Extension\nterraform fmt\nterraform validate\nGit\n<\/code><\/span><\/pre>\n\n\n
                                                                                      Add a remote backend once working with others.<\/p>\n\n\n\n
                                                                                      31. Professional developer<\/h1>\n\n\n
                                                                                      Terraform CLI\nVS Code + terraform-ls\ntenv\nTFLint\nTrivy\nterraform test\nterraform-docs\npre-commit-terraform\nGitHub\/GitLab CI\nremote state + locking\nOIDC\n<\/code><\/span><\/pre>\n\n\n
                                                                                      32. Senior \/ Platform engineer<\/h1>\n\n\n
                                                                                      Everything above\nTerraform MCP Server\nInfracost\nreusable module<\/span> standards\nRenovate\nstructured state boundaries\npolicy tests\ncontrolled runners\nHCP Terraform where appropriate\nTerragrunt only if<\/span> complexity justifies it\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                      33. Enterprise platform<\/h1>\n\n\n
                                                                                      approved IDE\/toolchain\nprivate<\/span> module\/provider registry\ncentral CI templates\nOIDC\/workload identity\nremote execution\nHCP Terraform\/TFE\nprivate<\/span> agents where needed\nRBAC\nrun tasks\npolicy-as<\/span>-code\ncost governance\naudit logs\ndrift\/health assessments\ndependency automation\nAI\/MCP governance\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                      \n\n\n\n
                                                                                      PART 22 \u2014 Gold Standard Terraform Pipeline<\/h1>\n\n\n\n
                                                                                      34. Pipeline<\/h1>\n\n\n
                                                                                      Developer\n   \u2193\nIDE\n   \u2193\nAI\/MCP assistance\n   \u2193\nTerraform code\n   \u2193\nFormat\n   \u2193\nValidate\n   \u2193\nLint\n   \u2193\nSecurity scan\n   \u2193\nNative tests\n   \u2193\nDocumentation\n   \u2193\nPre-commit\n   \u2193\nPush\n   \u2193\nCI reproduces gates\n   \u2193\nOIDC authentication\n   \u2193\nTerraform plan\n   \u2193\nCost analysis\n   \u2193\nPolicy validation\n   \u2193\nCode review\n   \u2193\nApproval\n   \u2193\nControlled apply\n   \u2193\nPost-deploy verification\n   \u2193\nMonitoring \/ drift \/ continuous validation\n<\/code><\/span><\/pre>\n\n\n
                                                                                      Quality gates<\/h2>\n\n\n\n
                                                                                      Gate<\/th>Failure means<\/th><\/tr><\/thead>
                                                                                      Format<\/td>Code not canonical<\/td><\/tr>
                                                                                      Validate<\/td>Terraform config invalid<\/td><\/tr>
                                                                                      TFLint<\/td>Quality\/provider rule violation<\/td><\/tr>
                                                                                      Security<\/td>Risk exceeds accepted threshold<\/td><\/tr>
                                                                                      Test<\/td>Contract\/behavior regression<\/td><\/tr>
                                                                                      Docs<\/td>Module API reference stale<\/td><\/tr>
                                                                                      Plan<\/td>Change differs from developer intent<\/td><\/tr>
                                                                                      Cost<\/td>Material unexpected spend<\/td><\/tr>
                                                                                      Policy<\/td>Organization rule violated<\/td><\/tr>
                                                                                      Review<\/td>Human risk\/architecture concerns<\/td><\/tr>
                                                                                      Approval<\/td>Production change not authorized<\/td><\/tr>
                                                                                      Verify<\/td>Deployment outcome not healthy<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                                                                      \n\n\n\n
                                                                                      PART 23 \u2014 Local Development Setup<\/h1>\n\n\n\n
                                                                                      35. macOS<\/h1>\n\n\n\n
                                                                                      Homebrew-centered setup:<\/p>\n\n\n
                                                                                      brew tap hashicorp\/tap\n\nbrew install hashicorp\/tap\/terraform\nbrew install hashicorp\/tap\/terraform-ls\nbrew install tofuutils\/tap\/tenv\nbrew install terraform-linters\/tap\/tflint\nbrew install trivy\nbrew install terraform-docs\nbrew install infracost\nbrew install pre-commit\nbrew install opa\nbrew install conftest\n<\/code><\/span><\/pre>\n\n\n
                                                                                      For Checkov:<\/p>\n\n\n
                                                                                      brew install pipx\npipx ensurepath\npipx install checkov\n<\/code><\/span><\/pre>\n\n\n
                                                                                      You may omit manual terraform-ls<\/code> if VS Code’s HashiCorp extension is your only LSP client.<\/p>\n\n\n\n
                                                                                      Verify:<\/p>\n\n\n
                                                                                      terraform version\ntenv --version\ntflint --version\ntrivy --version\nterraform-docs --version\ninfracost --version\npre-commit --version\nopa version\nconftest --version\ncheckov --version\n<\/code><\/span><\/pre>\n\n\n
                                                                                      36. Linux<\/h1>\n\n\n\n
                                                                                      Prefer official\/vendor repositories or verified release artifacts rather than random curl-pipe-shell snippets.<\/p>\n\n\n\n
                                                                                      Example base packages:<\/p>\n\n\n
                                                                                      sudo apt-get<\/span> update\nsudo apt-get<\/span> install -y git curl unzip jq pipx\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                      Then install:<\/p>\n\n\n\n
                                                                                        \n
                                                                                      • Terraform from HashiCorp’s official package repository,<\/li>\n\n\n\n
                                                                                      • TFLint from verified GitHub release artifacts,<\/li>\n\n\n\n
                                                                                      • Trivy from Aqua’s official package repository,<\/li>\n\n\n\n
                                                                                      • terraform-docs<\/code>,\u00a0tenv<\/code>, OPA, Conftest from official releases,<\/li>\n\n\n\n
                                                                                      • Checkov with\u00a0pipx install checkov<\/code>,<\/li>\n\n\n\n
                                                                                      • pre-commit with OS package manager or pipx.<\/li>\n<\/ul>\n\n\n\n
                                                                                        Keep installation logic in a reproducible developer bootstrap script or dev-container image.<\/p>\n\n\n\n
                                                                                        37. Windows<\/h1>\n\n\n\n
                                                                                        Good choices:<\/p>\n\n\n\n
                                                                                          \n
                                                                                        • winget<\/code>\u00a0where the project publishes a verified package,<\/li>\n\n\n\n
                                                                                        • Chocolatey in organizations already managing it,<\/li>\n\n\n\n
                                                                                        • official signed release archives.<\/li>\n<\/ul>\n\n\n\n
                                                                                          Known example:<\/p>\n\n\n
                                                                                          winget<\/span> install<\/span> -e<\/span> --id<\/span> TerraformLinters<\/span>.tflint<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                          Terraform itself can be installed via your organization’s package-management standard or HashiCorp’s official release archive.<\/p>\n\n\n\n
                                                                                          Prefer WSL only if your team’s Terraform workflow intentionally standardizes on Linux semantics; do not require it just because Terraform can run there.<\/p>\n\n\n\n
                                                                                          Setup checklist<\/h2>\n\n\n
                                                                                          [ ] Git\n[ ] Terraform version manager\n[ ] Pinned Terraform\n[ ] Editor + HashiCorp Terraform extension\n[ ] TFLint\n[ ] Trivy\n[ ] terraform-docs\n[ ] pre-commit\n[ ] Infracost if used\n[ ] Checkov if selected\n[ ] OPA\/Conftest if selected\n[ ] Cloud CLI\n[ ] SSO\/OIDC-compatible developer authentication\n[ ] No long-lived cloud key in shell profile\n[ ] Project hooks installed\n<\/code><\/span><\/pre>\n\n\n
                                                                                          \n\n\n\n
                                                                                          PART 24 \u2014 Sample Real AWS Project<\/h1>\n\n\n\n
                                                                                          38. Directory<\/h1>\n\n\n
                                                                                          aws-web\/\n\u251c\u2500\u2500 backend.tf\n\u251c\u2500\u2500 versions.tf\n\u251c\u2500\u2500 provider.tf\n\u251c\u2500\u2500 variables.tf\n\u251c\u2500\u2500 main.tf\n\u251c\u2500\u2500 outputs.tf\n\u251c\u2500\u2500 terraform.tfvars.example\n\u251c\u2500\u2500 backend.hcl.example\n\u251c\u2500\u2500 tests\/\n\u2502   \u2514\u2500\u2500 basic.tftest.hcl\n\u251c\u2500\u2500 .tflint.hcl\n\u251c\u2500\u2500 .terraform-docs.yml\n\u251c\u2500\u2500 .pre-commit-config.yaml\n\u251c\u2500\u2500 .gitignore\n\u2514\u2500\u2500 README.md\n<\/code><\/span><\/pre>\n\n\n
                                                                                          versions.tf<\/code><\/h2>\n\n\n
                                                                                          terraform {\n  required_version = \"~> 1.16.0\"<\/span>\n\n  required_providers {\n    aws = {\n      source  = \"hashicorp\/aws\"<\/span>\n      version = \"~> 6.0\"<\/span>\n    }\n  }\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                          backend.tf<\/code><\/h2>\n\n\n
                                                                                          terraform {\n  backend \"s3\"<\/span> {}\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                          backend.hcl.example<\/code><\/h2>\n\n\n
                                                                                          bucket       = \"REPLACE-ME-terraform-state\"<\/span>\nkey          = \"examples\/aws-web\/terraform.tfstate\"<\/span>\nregion       = \"ap-northeast-1\"<\/span>\nencrypt      = true<\/span>\nuse_lockfile = true<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                          Initialize:<\/p>\n\n\n
                                                                                          cp backend.hcl.example backend.hcl\n<em<\/span>><\/span># edit backend.hcl for your non-secret account settings<\/em<\/span>><\/span>\nterraform init -backend-config=backend.hcl\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                          Do not<\/strong> put access keys in backend config.<\/p>\n\n\n\n
                                                                                          provider.tf<\/code><\/h2>\n\n\n
                                                                                          provider \"aws\"<\/span> {\n  region = var<\/span>.aws_region\n\n  default_tags {\n    tags = {\n      ManagedBy   = \"Terraform\"<\/span>\n      Project     = var<\/span>.project_name\n      Environment = var<\/span>.environment\n    }\n  }\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                          Authentication comes from the AWS SDK credential chain: SSO\/profile locally, OIDC\/workload identity in CI.<\/p>\n\n\n\n
                                                                                          variables.tf<\/code><\/h2>\n\n\n
                                                                                          variable \"aws_region\"<\/span> {\n  description = \"AWS region for this deployment.\"<\/span>\n  type        = string\n  default<\/span>     = \"ap-northeast-1\"<\/span>\n}\n\nvariable \"project_name\"<\/span> {\n  description = \"Short project identifier.\"<\/span>\n  type        = string\n  default<\/span>     = \"tf-web\"<\/span>\n}\n\nvariable \"environment\"<\/span> {\n  description = \"Deployment environment.\"<\/span>\n  type        = string\n\n  validation {\n    condition     = contains([\"dev\"<\/span>, \"staging\"<\/span>, \"prod\"<\/span>], var<\/span>.environment)\n    error_message = \"environment must be dev, staging, or prod.\"<\/span>\n  }\n}\n\nvariable \"vpc_cidr\"<\/span> {\n  description = \"CIDR for the VPC.\"<\/span>\n  type        = string\n  default<\/span>     = \"10.42.0.0\/16\"<\/span>\n}\n\nvariable \"azs\"<\/span> {\n  description = \"Availability Zones for public subnets.\"<\/span>\n  type        = list<\/span>(string)\n  default<\/span>     = [\"ap-northeast-1a\"<\/span>, \"ap-northeast-1c\"<\/span>]\n\n  validation {\n    condition     = length(var<\/span>.azs) == 2<\/span>\n    error_message = \"This example expects exactly two AZs.\"<\/span>\n  }\n}\n\nvariable \"public_subnet_cidrs\"<\/span> {\n  description = \"CIDRs for public subnets, one per AZ.\"<\/span>\n  type        = list<\/span>(string)\n  default<\/span>     = [\"10.42.1.0\/24\"<\/span>, \"10.42.2.0\/24\"<\/span>]\n\n  validation {\n    condition     = length(var<\/span>.public_subnet_cidrs) == 2<\/span>\n    error_message = \"This example expects exactly two public subnet CIDRs.\"<\/span>\n  }\n}\n\nvariable \"ami_id\"<\/span> {\n  description = \"Approved AMI ID for the EC2 instance.\"<\/span>\n  type        = string\n}\n\nvariable \"instance_type\"<\/span> {\n  description = \"EC2 instance type.\"<\/span>\n  type        = string\n  default<\/span>     = \"t3.micro\"<\/span>\n}\n\nvariable \"allowed_http_cidrs\"<\/span> {\n  description = \"CIDRs permitted to access TCP\/80. Do not use 0.0.0.0\/0 unless public exposure is intended and approved.\"<\/span>\n  type        = list<\/span>(string)\n}\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                          main.tf<\/code><\/h2>\n\n\n
                                                                                          locals {\n  subnet_map = {\n    for<\/span> idx, az in var<\/span>.azs :\n    az => var<\/span>.public_subnet_cidrs[idx]\n  }\n}\n\nresource \"aws_vpc\"<\/span> \"this\"<\/span> {\n  cidr_block           = var<\/span>.vpc_cidr\n  enable_dns_support   = true<\/span>\n  enable_dns_hostnames = true<\/span>\n\n  tags = {\n    Name = \"${var.project_name}-${var.environment}\"<\/span>\n  }\n}\n\nresource \"aws_internet_gateway\"<\/span> \"this\"<\/span> {\n  vpc_id = aws_vpc.this.id\n\n  tags = {\n    Name = \"${var.project_name}-${var.environment}\"<\/span>\n  }\n}\n\nresource \"aws_subnet\"<\/span> \"public\"<\/span> {\n  for_each = local.subnet_map\n\n  vpc_id                  = aws_vpc.this.id\n  availability_zone       = each.key\n  cidr_block              = each.value\n  map_public_ip_on_launch = true<\/span>\n\n  tags = {\n    Name = \"${var.project_name}-${var.environment}-${each.key}\"<\/span>\n  }\n}\n\nresource \"aws_route_table\"<\/span> \"public\"<\/span> {\n  vpc_id = aws_vpc.this.id\n\n  route {\n    cidr_block = \"0.0.0.0\/0\"<\/span>\n    gateway_id = aws_internet_gateway.this.id\n  }\n\n  tags = {\n    Name = \"${var.project_name}-${var.environment}-public\"<\/span>\n  }\n}\n\nresource \"aws_route_table_association\"<\/span> \"public\"<\/span> {\n  for_each = aws_subnet.public<\/span>\n\n  subnet_id      = each.value.id\n  route_table_id = aws_route_table.public<\/span>.id\n}\n\nresource \"aws_security_group\"<\/span> \"web\"<\/span> {\n  name_prefix = \"${var.project_name}-${var.environment}-web-\"<\/span>\n  description = \"HTTP access for example web instance\"<\/span>\n  vpc_id      = aws_vpc.this.id\n\n  ingress {\n    description = \"Approved HTTP clients\"<\/span>\n    from_port   = 80<\/span>\n    to_port     = 80<\/span>\n    protocol    = \"tcp\"<\/span>\n    cidr_blocks = var<\/span>.allowed_http_cidrs\n  }\n\n  egress {\n    description = \"Outbound access\"<\/span>\n    from_port   = 0<\/span>\n    to_port     = 0<\/span>\n    protocol    = \"-1\"<\/span>\n    cidr_blocks = [\"0.0.0.0\/0\"<\/span>]\n  }\n}\n\nresource \"aws_instance\"<\/span> \"web\"<\/span> {\n  ami                         = var<\/span>.ami_id\n  instance_type               = var<\/span>.instance_type\n  subnet_id                   = values(aws_subnet.public<\/span>)[0<\/span>].id\n  vpc_security_group_ids      = [aws_security_group.web.id]\n  associate_public_ip_address = true<\/span>\n\n  metadata_options {\n    http_endpoint = \"enabled\"<\/span>\n    http_tokens   = \"required\"<\/span>\n  }\n\n  root_block_device {\n    encrypted = true<\/span>\n  }\n\n  tags = {\n    Name = \"${var.project_name}-${var.environment}-web\"<\/span>\n  }\n}\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                          This deliberately exposes no SSH port. In a production design, use SSM\/session tooling or another approved administration path rather than opening port 22 globally.<\/p>\n\n\n\n
                                                                                          outputs.tf<\/code><\/h2>\n\n\n
                                                                                          output \"vpc_id\"<\/span> {\n  description = \"VPC ID.\"<\/span>\n  value       = aws_vpc.this.id\n}\n\noutput \"public_subnet_ids\"<\/span> {\n  description = \"Public subnet IDs keyed by availability zone.\"<\/span>\n  value       = { for<\/span> az, subnet in<\/span> aws_subnet.public : az<\/span> =><\/span> subnet.id }\n}\n\noutput \"instance_id\"<\/span> {\n  description = \"EC2 instance ID.\"<\/span>\n  value       = aws_instance.web.id\n}\n\noutput \"public_ip\"<\/span> {\n  description = \"Public IPv4 address of the example instance.\"<\/span>\n  value       = aws_instance.web.public_ip\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                          terraform.tfvars.example<\/code><\/h2>\n\n\n
                                                                                          environment        = \"dev\"<\/span>\nami_id             = \"ami-REPLACE-WITH-AN-APPROVED-AMI\"<\/span>\nallowed_http_cidrs = [\"203.0.113.0\/24\"<\/span>]\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                          tests\/basic.tftest.hcl<\/code><\/h2>\n\n\n
                                                                                          mock_provider \"aws\"<\/span> {}\n\nrun \"basic_plan\"<\/span> {\n  command = plan\n\n  variables {\n    environment        = \"dev\"<\/span>\n    ami_id             = \"ami-0123456789abcdef0\"<\/span>\n    allowed_http_cidrs = [\"203.0.113.0\/24\"<\/span>]\n  }\n\n  assert {\n    condition     = aws_vpc.this.cidr_block == \"10.42.0.0\/16\"<\/span>\n    error_message = \"Unexpected VPC CIDR.\"<\/span>\n  }\n\n  assert {\n    condition     = length(aws_subnet.public<\/span>) == 2<\/span>\n    error_message = \"Expected two public subnets.\"<\/span>\n  }\n\n  assert {\n    condition     = aws_instance.web.metadata_options[0<\/span>].http_tokens == \"required\"<\/span>\n    error_message = \"IMDSv2 must be required.\"<\/span>\n  }\n\n  assert {\n    condition     = aws_instance.web.root_block_device[0<\/span>].encrypted == true<\/span>\n    error_message = \"Root volume must be encrypted.\"<\/span>\n  }\n}\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                          .gitignore<\/code><\/h2>\n\n\n
                                                                                          .terraform\/\n*.tfstate\n*.tfstate.*\n*.tfplan\ntfplan*\ncrash.log\ncrash.*.log\noverride.tf\noverride.tf.json\n*_override.tf\n*_override.tf.json\nbackend.hcl\n*.auto.tfvars\n<\/code><\/span><\/pre>\n\n\n
                                                                                          Do commit:<\/strong><\/p>\n\n\n
                                                                                          .terraform<\/span>.lock<\/span>.hcl<\/span>\nTerraform<\/span> source<\/span>\nnon-secret<\/span> examples<\/span>\ntests<\/span>\ntool<\/span> configuration<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                          Run locally<\/h2>\n\n\n
                                                                                          terraform init -backend=false<\/span>\nterraform fmt -recursive\nterraform validate\ntflint --init\ntflint --recursive\ntrivy config --severity HIGH,CRITICAL .\nterraform test\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                          For a real plan, authenticate through AWS SSO\/profile and initialize the real backend:<\/p>\n\n\n
                                                                                          terraform init -backend-config=backend.hcl\nterraform plan -var<\/span>-file=terraform.tfvars\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                          \n\n\n\n
                                                                                          PART 25 \u2014 Common Developer Mistakes<\/h1>\n\n\n\n
                                                                                          39. Mistakes and correct alternatives<\/h1>\n\n\n\n
                                                                                          Mistake<\/th>Why dangerous<\/th>Correct alternative<\/th><\/tr><\/thead>
                                                                                          Hardcoded cloud keys<\/td>Credential leak\/rotation burden<\/td>OIDC, SSO, workload identity<\/td><\/tr>
                                                                                          Hardcoded secrets<\/td>HCL\/plan\/state leak<\/td>Secret manager + ephemeral\/write-only features where provider supports<\/td><\/tr>
                                                                                          Commit .tfstate<\/code><\/td>Secrets + no safe state locking<\/td>Remote state<\/td><\/tr>
                                                                                          Commit .terraform\/<\/code><\/td>Large, platform-specific, unreviewable<\/td>Re-run init<\/td><\/tr>
                                                                                          Ignore .terraform.lock.hcl<\/code><\/td>Provider drift<\/td>Commit root lock file<\/td><\/tr>
                                                                                          No provider constraints<\/td>Unexpected upgrades<\/td>Declare constraints<\/td><\/tr>
                                                                                          No module versions<\/td>Module drift<\/td>Pin Registry module versions<\/td><\/tr>
                                                                                          Apply from laptops<\/td>Weak audit\/reproducibility<\/td>Controlled runner<\/td><\/tr>
                                                                                          No review<\/td>High blast radius<\/td>Protected PR flow<\/td><\/tr>
                                                                                          No lint\/security tests<\/td>Preventable defects<\/td>Automated gates<\/td><\/tr>
                                                                                          One giant state<\/td>Huge blast radius\/lock contention<\/td>Decompose by ownership\/failure boundary<\/td><\/tr>
                                                                                          Overuse CLI workspaces<\/td>Hidden environment coupling<\/td>Separate roots\/states\/workspaces where environments differ<\/td><\/tr>
                                                                                          Huge root module<\/td>Slow\/unowned\/unreviewable<\/td>Compose smaller deployment units<\/td><\/tr>
                                                                                          Copy\/paste infrastructure<\/td>Drift<\/td>Reusable modules\/templates where repetition is stable<\/td><\/tr>
                                                                                          Weak variable design<\/td>Invalid combinations<\/td>Types, validation, object schemas<\/td><\/tr>
                                                                                          Excessive -target<\/code><\/td>Partial graph surprises<\/td>Normal full plan\/apply; use target for exceptional recovery<\/td><\/tr>
                                                                                          Direct state edits<\/td>Corruption<\/td>Terraform state\/moved\/import mechanisms<\/td><\/tr>
                                                                                          Casual state rm<\/code><\/td>Terraform loses management<\/td>Controlled state procedure<\/td><\/tr>
                                                                                          Blind AI-generated code<\/td>Hallucination\/security bugs<\/td>MCP\/docs + automated gates + review<\/td><\/tr>
                                                                                          Ignore cost<\/td>Surprise spend<\/td>Infracost\/FinOps review<\/td><\/tr>
                                                                                          Auto-apply PRs to prod<\/td>Unreviewed change<\/td>Merge + protected approval<\/td><\/tr>
                                                                                          Long-lived CI credentials<\/td>High-value secret<\/td>OIDC federation<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                                                                          \n\n\n\n
                                                                                          PART 26 \u2014 Security Best Practices<\/h1>\n\n\n\n
                                                                                          40. Security checklist<\/h1>\n\n\n
                                                                                          Identity\n[ ] No hardcoded cloud credentials\n[ ] CI uses OIDC\/workload identity\n[ ] Developer auth uses SSO\/short-lived credentials\n[ ] Plan and<\/span> apply roles follow least privilege\n[ ] Production permissions separated from non-production\n\nState\n[ ] State is remote\n[ ] State is encrypted\n[ ] State access is restricted\n[ ] State locking enabled\n[ ] State versioning\/history enabled where supported\n[ ] State access\/audit is monitored\n[ ] State never committed to Git\n\nCode\/dependencies\n[ ] Terraform version constrained\n[ ] Providers constrained\n[ ] .terraform.lock.hcl committed for<\/span> root configurations\n[ ] Modules explicitly versioned\n[ ] Dependency updates automated but reviewed\n[ ] No secrets in tfvars\/source\n\nReview\n[ ] Branch protection enabled\n[ ] Required reviewers defined\n[ ] Security scan required\n[ ] Tests required\n[ ] Plan required\n[ ] Destruction\/replacement explicitly reviewed\n[ ] Production approval protected<\/span>\n\nRuntime\n[ ] Policy-as<\/span>-code for<\/span> critical invariants where justified\n[ ] Audit logs retained\n[ ] Drift\/health monitoring enabled\n[ ] Break<\/span>-glass process documented\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                          State is a security asset<\/h2>\n\n\n\n
                                                                                          Terraform state may contain:<\/p>\n\n\n\n
                                                                                            \n
                                                                                          • database passwords,<\/li>\n\n\n\n
                                                                                          • generated tokens,<\/li>\n\n\n\n
                                                                                          • private endpoint metadata,<\/li>\n\n\n\n
                                                                                          • identifiers,<\/li>\n\n\n\n
                                                                                          • provider-returned secrets.<\/li>\n<\/ul>\n\n\n\n
                                                                                            Marking an output sensitive = true<\/code> primarily controls display; it does not magically remove the value from all state.<\/p>\n\n\n\n
                                                                                            Prefer Terraform\/provider features that avoid persistence when possible, including ephemeral values and write-only arguments where supported.<\/p>\n\n\n\n
                                                                                            \n\n\n\n
                                                                                            PART 27 \u2014 Terraform Code Review Checklist<\/h1>\n\n\n\n
                                                                                            41. PR checklist<\/h1>\n\n\n\n
                                                                                            Intent<\/h2>\n\n\n
                                                                                            [ ] Ticket\/goal is clear\n[ ] Change is minimal for the intended outcome\n[ ] Correct environment\/account\/region is targeted\n<\/code><\/span><\/pre>\n\n\n
                                                                                            Code quality<\/h2>\n\n\n
                                                                                            [ ] terraform fmt passes\n[ ] terraform validate passes\n[ ] TFLint passes\n[ ] Naming is consistent\n[ ] Variables are typed and validated\n[ ] Inputs\/outputs are documented\n[ ] No unnecessary abstraction\n<\/code><\/span><\/pre>\n\n\n
                                                                                            Dependencies<\/h2>\n\n\n
                                                                                            [ ]<\/span> Terraform<\/span> constraint<\/span> appropriate<\/span>\n[ ]<\/span> Provider<\/span> constraints<\/span> appropriate<\/span>\n[ ]<\/span> Lock-file<\/span> changes<\/span> expected<\/span>\n[ ]<\/span> Reusable<\/span> module<\/span> versions<\/span> pinned<\/span>\n[ ]<\/span> Major<\/span> dependency<\/span> upgrades<\/span> reviewed<\/span> separately<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                            Security<\/h2>\n\n\n
                                                                                            [ ] No credentials\/secrets\n[ ] IAM is least privilege\n[ ] No accidental 0.0.0.0\/0 or ::\/0\n[ ] Encryption settings correct\n[ ] Security scanner result reviewed\n[ ] State\/backend permissions unaffected or intentionally changed\n<\/code><\/span><\/pre>\n\n\n
                                                                                            Plan\/blast radius<\/h2>\n\n\n
                                                                                            [ ] Adds\/changes\/destroys match intent\n[ ] Every replacement (`-\/+`<\/span>) understood\n[ ] Database\/storage replacement scrutinized\n[ ] IAM\/KMS\/networking changes scrutinized\n[ ] for_each\/count key changes understood\n[ ] Moved\/imported resource addresses correct\n[ ] No unexpected state churn\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                            Reliability\/cost<\/h2>\n\n\n
                                                                                            [ ] HA assumptions still valid\n[ ] Capacity\/quotas considered\n[ ] Cost delta acceptable\n[ ] Tests cover important behavior\n[ ] Rollback\/recovery approach understood\n<\/code><\/span><\/pre>\n\n\n
                                                                                            Documentation\/operations<\/h2>\n\n\n
                                                                                            [ ] terraform-docs output current\n[ ] README\/runbook updated if behavior changed\n[ ] Monitoring\/alerts adjusted if needed\n[ ] Post-deploy verification defined\n<\/code><\/span><\/pre>\n\n\n
                                                                                            \n\n\n\n
                                                                                            PART 28 \u2014 Terraform Productivity Best Practices<\/h1>\n\n\n\n
                                                                                            42. Reduce developer time without lowering safety<\/h1>\n\n\n\n
                                                                                            1. Standard repository template<\/h2>\n\n\n\n
                                                                                            Pre-create:<\/p>\n\n\n
                                                                                            versions.tf\nvariables.tf\noutputs.tf\ntests\/\n.tflint.hcl\n.terraform-docs.yml\n.pre-commit-config.yaml\nCI workflow\nRenovate config\nREADME markers\n<\/code><\/span><\/pre>\n\n\n
                                                                                            2. Reusable modules, but not “module everything”<\/h2>\n\n\n\n
                                                                                            Create a module when you have:<\/p>\n\n\n\n
                                                                                              \n
                                                                                            • repeated stable pattern,<\/li>\n\n\n\n
                                                                                            • meaningful abstraction,<\/li>\n\n\n\n
                                                                                            • security defaults worth centralizing,<\/li>\n\n\n\n
                                                                                            • clear consumer interface.<\/li>\n<\/ul>\n\n\n\n
                                                                                              Do not wrap one resource in a module merely to claim standardization.<\/p>\n\n\n\n
                                                                                              3. Fast local path<\/h2>\n\n\n\n
                                                                                              Target:<\/p>\n\n\n
                                                                                              fmt + validate + lint + focused security + mock tests\n<\/code><\/span><\/pre>\n\n\n
                                                                                              in a developer-friendly feedback loop.<\/p>\n\n\n\n
                                                                                              Put slow live integration tests in CI\/nightly pipelines.<\/p>\n\n\n\n
                                                                                              4. Pre-approved module catalog<\/h2>\n\n\n\n
                                                                                              Make secure defaults easy:<\/p>\n\n\n
                                                                                              Need private S3 bucket\n  \u2193\napproved module<\/span>\n  \u2193\n3<\/span>\u20135<\/span> meaningful inputs\n  \u2193\nencryption\/logging\/policy defaults already included\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                              5. Central CI templates<\/h2>\n\n\n\n
                                                                                              Do not copy 100 slightly different Terraform workflows. Provide versioned reusable CI workflows\/components.<\/p>\n\n\n\n
                                                                                              6. Automated documentation<\/h2>\n\n\n\n
                                                                                              Generated docs prevent “variable exists in code but not README.”<\/p>\n\n\n\n
                                                                                              7. Automated dependency updates<\/h2>\n\n\n\n
                                                                                              Small continuous upgrades are usually safer than a two-year provider jump.<\/p>\n\n\n\n
                                                                                              8. Cost feedback in PRs<\/h2>\n\n\n\n
                                                                                              Shift cost discussion before apply.<\/p>\n\n\n\n
                                                                                              9. Remote execution<\/h2>\n\n\n\n
                                                                                              A consistent execution environment eliminates “worked on my laptop” differences and improves auditability.<\/p>\n\n\n\n
                                                                                              10. Use AI for mechanical work<\/h2>\n\n\n\n
                                                                                              AI is excellent at:<\/p>\n\n\n\n
                                                                                                \n
                                                                                              • repetitive HCL,<\/li>\n\n\n\n
                                                                                              • tests,<\/li>\n\n\n\n
                                                                                              • docs,<\/li>\n\n\n\n
                                                                                              • refactors.<\/li>\n<\/ul>\n\n\n\n
                                                                                                Humans remain accountable for:<\/p>\n\n\n\n
                                                                                                  \n
                                                                                                • intent,<\/li>\n\n\n\n
                                                                                                • architecture,<\/li>\n\n\n\n
                                                                                                • security,<\/li>\n\n\n\n
                                                                                                • blast radius,<\/li>\n\n\n\n
                                                                                                • production approval.<\/li>\n<\/ul>\n\n\n\n
                                                                                                  \n\n\n\n
                                                                                                  PART 29 \u2014 Tool Overlap and Decision Guide<\/h1>\n\n\n\n
                                                                                                  43. Overlap matrix<\/h1>\n\n\n\n
                                                                                                  terraform validate<\/code> vs TFLint<\/h2>\n\n\n\n
                                                                                                  Use both<\/strong>. They answer different questions.<\/p>\n\n\n\n
                                                                                                  Trivy vs Checkov<\/h2>\n\n\n\n
                                                                                                  Start with one<\/strong>. Add the second only for distinct policies\/compliance.<\/p>\n\n\n\n
                                                                                                  Sentinel vs OPA<\/h2>\n\n\n\n
                                                                                                    \n
                                                                                                  • HCP-first, integrated governance: Sentinel is natural.<\/li>\n\n\n\n
                                                                                                  • Cross-platform policy strategy: OPA is natural.<\/li>\n\n\n\n
                                                                                                  • HCP Terraform can support OPA too.<\/li>\n\n\n\n
                                                                                                  • Consider Terraform Policy as it matures if HCL-native policy is attractive.<\/li>\n<\/ul>\n\n\n\n
                                                                                                    tfenv vs tenv<\/h2>\n\n\n\n
                                                                                                    For new Terraform-centric standardization, choose tenv<\/strong> unless existing tfenv investment outweighs migration benefit.<\/p>\n\n\n\n
                                                                                                    Terraform vs Terragrunt<\/h2>\n\n\n\n
                                                                                                    Start with Terraform<\/strong>. Add Terragrunt to solve actual repetition\/orchestration pain.<\/p>\n\n\n\n
                                                                                                    GitHub Actions vs Atlantis<\/h2>\n\n\n\n
                                                                                                      \n
                                                                                                    • CI ecosystem + custom workflows: GitHub Actions.<\/li>\n\n\n\n
                                                                                                    • Terraform-specific PR command workflow: Atlantis.<\/li>\n\n\n\n
                                                                                                    • You can combine them if responsibilities are unambiguous: CI validates, Atlantis owns plan\/apply.<\/li>\n<\/ul>\n\n\n\n
                                                                                                      Atlantis vs HCP Terraform<\/h2>\n\n\n\n
                                                                                                      HCP Terraform is a broader platform: state, runs, RBAC, registry, agents, policy, health. Atlantis is a focused PR automation server.<\/p>\n\n\n\n
                                                                                                      terraform test<\/code> vs Terratest<\/h2>\n\n\n\n
                                                                                                      Start native. Add Terratest for real behavioral integration.<\/p>\n\n\n\n
                                                                                                      terraform-docs vs manual README<\/h2>\n\n\n\n
                                                                                                      Use both:<\/p>\n\n\n
                                                                                                      Manual sections \u2192 why\/how\/architecture\nGenerated section \u2192 exact interface<\/span> reference<\/span>\n<\/span><\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                                      pre-commit vs CI<\/h2>\n\n\n\n
                                                                                                      Use both:<\/p>\n\n\n
                                                                                                      pre-commit = developer speed\nCI         = enforcement\n<\/code><\/span><\/pre>\n\n\n
                                                                                                      \n\n\n\n
                                                                                                      PART 30 \u2014 Final Gold Standard Recommendation<\/h1>\n\n\n\n
                                                                                                      44. Final stack<\/h1>\n\n\n\n
                                                                                                      MUST HAVE<\/h2>\n\n\n
                                                                                                      Terraform CLI\nGit\nterraform fmt\nterraform validate\nversion constraints\n.terraform.lock.hcl for root configs\nremote state + locking for teams\ncode review\nCI for production\nOIDC\/workload identity\nplan review\n<\/code><\/span><\/pre>\n\n\n
                                                                                                      STRONGLY RECOMMENDED<\/h2>\n\n\n
                                                                                                      VS Code + HashiCorp Terraform Extension\nterraform-ls\ntenv\nTFLint\nTrivy\nterraform test\nterraform-docs\npre-commit-terraform\nInfracost\nRenovate\nstandard repository templates\nreusable CI templates\npost-deployment verification\n<\/code><\/span><\/pre>\n\n\n
                                                                                                      OPTIONAL<\/h2>\n\n\n
                                                                                                      Terraform MCP Server (recommended if AI is used)\nCheckov\nTerratest\nTerragrunt\nAtlantis\nConftest\ntfupdate\n<\/code><\/span><\/pre>\n\n\n
                                                                                                      ENTERPRISE \/ PLATFORM<\/h2>\n\n\n
                                                                                                      HCP Terraform\nTerraform Enterprise\nprivate<\/span> module\/provider registry\nprivate<\/span> agents\nRBAC\nrun tasks\npolicy sets\nSentinel \/ OPA \/ Terraform Policy\naudit logging\ndrift detection \/ continuous validation\ncentral cost\/security governance\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                                      \n\n\n\n
                                                                                                      Terraform Developer GOLD Standard Checklist Before Merge<\/h1>\n\n\n
                                                                                                      SCOPE\n[ ] I can explain exactly what this<\/span> PR changes and why.\n[ ] I changed only the intended state boundary\/environment.\n\nCODE\n[ ] terraform fmt -check passes.\n[ ] terraform validate passes.\n[ ] TFLint passes.\n[ ] No duplicate\/copy-paste architecture was introduced unnecessarily.\n[ ] Variables are typed, described, and validated where useful.\n[ ] Outputs are intentional and documented.\n\nVERSIONS\n[ ] Terraform version policy is satisfied.\n[ ] Provider constraints are explicit.\n[ ] .terraform.lock.hcl changes are expected and reviewed.\n[ ] Registry module<\/span> versions are explicit.\n\nSECURITY\n[ ] No cloud credentials, passwords, API keys, tokens, or private keys are committed.\n[ ] CI uses OIDC\/workload identity.\n[ ] Trivy\/selected IaC security scan passes or exceptions are approved.\n[ ] IAM follows least privilege.\n[ ] Public ingress\/egress is intentional.\n[ ] Encryption is enabled where required.\n[ ] State remains protected.\n\nTESTING\n[ ] terraform test passes.\n[ ] Important module<\/span> behavior is asserted.\n[ ] Live integration testing is added when native tests cannot prove the requirement.\n\nPLAN\n[ ] A plan exists for<\/span> the correct target.\n[ ] I reviewed additions, changes, deletions, and replacements.\n[ ] I understand every destructive\/replacement action.\n[ ] Resource-address changes are intentional.\n[ ] No unexpected IAM\/KMS\/network\/database changes exist.\n[ ] Blast radius is acceptable.\n\nCOST\n[ ] Cost delta has been reviewed when material.\n[ ] New always-on\/large resources are intentional.\n\nDOCS\n[ ] terraform-docs output is current.\n[ ] Architecture\/runbooks are updated if<\/span> behavior changed.\n\nDEPLOYMENT\n[ ] Apply will run from<\/span> the approved controlled environment.\n[ ] Production approval requirements are met.\n[ ] Rollback\/recovery is understood.\n[ ] Post-deployment verification is defined.\n\nAFTER\n[ ] Monitoring\/alerts will detect regressions.\n[ ] Drift\/continuous validation is enabled where appropriate.\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                                      \n\n\n\n
                                                                                                      Opinionated reference architecture<\/h1>\n\n\n\n
                                                                                                      For most modern platform teams, the cleanest production model is:<\/p>\n\n\n
                                                                                                      Developer laptop\n  \u251c\u2500 SSO \/ short-lived local cloud auth\n  \u251c\u2500 VS Code + HashiCorp extension\n  \u251c\u2500 tenv\n  \u251c\u2500 fmt \/ validate \/ TFLint \/ Trivy \/ terraform test\n  \u2514\u2500 pre-commit\n            \u2193\nProtected<\/span> Git repository\n            \u2193\nCI\n  \u251c\u2500 reproduce local checks\n  \u251c\u2500 dependency\/supply-chain controls\n  \u251c\u2500 OIDC\n  \u251c\u2500 speculative\/real plan\n  \u2514\u2500 cost\/security feedback\n            \u2193\nHCP Terraform \/ TFE or<\/span> dedicated controlled execution\n  \u251c\u2500 remote state\n  \u251c\u2500 locking\n  \u251c\u2500 RBAC\n  \u251c\u2500 private<\/span> agents only when network access requires them\n  \u251c\u2500 run tasks\n  \u251c\u2500 policy\n  \u2514\u2500 approvals\n            \u2193\nCloud\n            \u2193\nVerification + observability + drift\/health\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                                      This is intentionally boring. Boring infrastructure delivery is good: deterministic, reviewable, repeatable, auditable, and difficult to bypass accidentally.<\/p>\n\n\n\n
                                                                                                      \n\n\n\n
                                                                                                      Source and currency notes<\/h1>\n\n\n\n
                                                                                                      This handbook was checked against current vendor\/project documentation available on 5 September 2026<\/strong>, including:<\/p>\n\n\n\n
                                                                                                        \n
                                                                                                      • HashiCorp Terraform CLI, testing, state, backend, policy, MCP Server, HCP Terraform, and Terraform Enterprise documentation.<\/li>\n\n\n\n
                                                                                                      • HashiCorp Terraform VS Code extension and\u00a0terraform-ls<\/code>.<\/li>\n\n\n\n
                                                                                                      • tofuutils\u00a0tenv<\/code>.<\/li>\n\n\n\n
                                                                                                      • terraform-linters TFLint and AWS ruleset.<\/li>\n\n\n\n
                                                                                                      • Aqua Security Trivy.<\/li>\n\n\n\n
                                                                                                      • Checkov.<\/li>\n\n\n\n
                                                                                                      • terraform-docs.<\/li>\n\n\n\n
                                                                                                      • Infracost.<\/li>\n\n\n\n
                                                                                                      • antonbabenko\/pre-commit-terraform.<\/li>\n\n\n\n
                                                                                                      • Gruntwork Terragrunt and Terratest.<\/li>\n\n\n\n
                                                                                                      • Atlantis.<\/li>\n\n\n\n
                                                                                                      • Open Policy Agent and Conftest.<\/li>\n\n\n\n
                                                                                                      • Renovate.<\/li>\n\n\n\n
                                                                                                      • tfupdate<\/code>.<\/li>\n\n\n\n
                                                                                                      • GitHub Actions \/ AWS OIDC and GitLab OIDC documentation.<\/li>\n<\/ul>\n\n\n\n
                                                                                                        Selected official\/reference URLs:<\/p>\n\n\n
                                                                                                        https:\/\/developer.hashicorp.com\/terraform\/<\/span>\nhttps:\/\/developer.hashicorp.com\/terraform\/mcp-server<\/span>\nhttps:\/\/developer.hashicorp.com\/terraform\/cloud-docs<\/span>\nhttps:\/\/developer.hashicorp.com\/terraform\/enterprise<\/span>\nhttps:\/\/marketplace.visualstudio.com\/items?itemName=HashiCorp.terraform<\/span>\nhttps:\/\/github.com\/hashicorp\/terraform-ls<\/span>\nhttps:\/\/github.com\/tofuutils\/tenv<\/span>\nhttps:\/\/github.com\/terraform-linters\/tflint<\/span>\nhttps:\/\/trivy.dev\/<\/span>\nhttps:\/\/www.checkov.io\/<\/span>\nhttps:\/\/terraform-docs.io\/<\/span>\nhttps:\/\/www.infracost.io\/docs\/<\/span>\nhttps:\/\/github.com\/antonbabenko\/pre-commit-terraform<\/span>\nhttps:\/\/terragrunt.gruntwork.io\/<\/span>\nhttps:\/\/terratest.gruntwork.io\/<\/span>\nhttps:\/\/www.runatlantis.io\/<\/span>\nhttps:\/\/www.openpolicyagent.org\/<\/span>\nhttps:\/\/www.conftest.dev\/<\/span>\nhttps:\/\/docs.renovatebot.com\/<\/span>\nhttps:\/\/github.com\/minamijoyo\/tfupdate<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                                        Final operating principle<\/h2>\n\n\n\n
                                                                                                        Terraform quality is not produced by Terraform alone.<\/strong><\/p>\n\n\n\n
                                                                                                        A production Terraform system combines:<\/p>\n\n\n
                                                                                                        Correct code\n+ reproducible versions\n+ secure identities\n+ protected<\/span> state\n+ automated lint\/security\/test gates\n+ visible cost\n+ reviewable plan\n+ policy where it adds real value\n+ controlled execution\n+ post-deployment verification\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                                                                                                        That combination turns Terraform from a command-line tool into an engineering platform.<\/p>\n","protected":false},"excerpt":{"rendered":"
                                                                                                        Tools, Workflow, Security, Testing, CI\/CD, Automation, AI Assistance, Governance, and Production Best Practices Verified baseline: 5 September 2026Audience: Terraform developers, DevOps\/SRE, platform\/cloud engineers, module authors, DevSecOps teams, and engineering… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[11138],"tags":[],"class_list":["post-78465","post","type-post","status-publish","format-standard","hentry","category-best-tools"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/78465","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=78465"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/78465\/revisions"}],"predecessor-version":[{"id":78466,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/78465\/revisions\/78466"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=78465"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=78465"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=78465"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}