Terraform
Project Structure
infrastructure/
├── modules/
│ ├── vpc/
│ │ ├── main.tf
│ │ ├── variables.tf
│ │ └── outputs.tf
│ └── ecs-service/
├── environments/
│ ├── dev/
│ │ ├── main.tf
│ │ ├── variables.tf
│ │ └── terraform.tfvars
│ └── prod/
├── backend.tf
└── versions.tf
Provider and Backend
# versions.tf
terraform {
required_version = ">= 1.5"
required_providers {
aws = { source = "hashicorp/aws", version = "~> 5.0" }
}
}
# backend.tf
terraform {
backend "s3" {
bucket = "my-terraform-state"
key = "prod/terraform.tfstate"
region = "us-east-1"
dynamodb_table = "terraform-locks"
encrypt = true
}
}
provider "aws" {
region = var.aws_region
default_tags { tags = { Environment = var.environment, ManagedBy = "terraform" } }
}
Resource Definition
# VPC module
resource "aws_vpc" "main" {
cidr_block = var.vpc_cidr
enable_dns_hostnames = true
tags = { Name = "${var.project}-vpc" }
}
resource "aws_subnet" "private" {
count = length(var.availability_zones)
vpc_id = aws_vpc.main.id
cidr_block = cidrsubnet(var.vpc_cidr, 4, count.index)
availability_zone = var.availability_zones[count.index]
tags = { Name = "${var.project}-private-${count.index}" }
}
output "vpc_id" { value = aws_vpc.main.id }
output "private_subnet_ids" { value = aws_subnet.private[*].id }
Module Usage
module "vpc" {
source = "../../modules/vpc"
project = "my-app"
vpc_cidr = "10.0.0.0/16"
availability_zones = ["us-east-1a", "us-east-1b"]
}
module "api" {
source = "../../modules/ecs-service"
cluster_id = aws_ecs_cluster.main.id
subnet_ids = module.vpc.private_subnet_ids
image = "${var.ecr_repo}:${var.image_tag}"
environment = var.environment
}
Variables and Outputs
# variables.tf
variable "environment" {
type = string
description = "Deployment environment"
validation {
condition = contains(["dev", "staging", "prod"], var.environment)
error_message = "Must be dev, staging, or prod."
}
}
variable "instance_type" {
type = string
default = "t3.micro"
}
# terraform.tfvars
environment = "prod"
instance_type = "t3.medium"
Key Commands
terraform init # Initialize providers and backend
terraform plan # Preview changes
terraform apply # Apply changes
terraform destroy # Destroy all resources
terraform fmt # Format HCL files
terraform validate # Validate configuration
terraform state list # List resources in state
Anti-Patterns
| Anti-Pattern | Fix |
|---|
| Local state file | Use remote backend (S3 + DynamoDB) |
| No state locking | Enable DynamoDB locking table |
| Hardcoded values | Use variables with tfvars per environment |
| Monolithic config | Split into modules |
terraform apply without plan | Always review plan first, use -out=plan.tfplan |
| No version constraints | Pin provider and Terraform versions |
Production Checklist
- Remote state backend with encryption and locking
- Provider and Terraform version pinned
- Modules for reusable infrastructure
- Separate tfvars per environment
- CI/CD pipeline: plan on PR, apply on merge
- State imports for existing resources
prevent_destroy on critical resources
