Terraform Modules

A module is a promise: call it with these inputs and it gives you these outputs, and you never need to read its internals to trust it. That promise only holds if the interface is deliberately designed, not just whatever variables happened to exist when the code was extracted from a working root module.

The failure mode isn't usually too few modules — it's modules built too early, from a single use case, whose interface is a guess dressed up as an abstraction.

A module's job is to hide detail behind an interface, not to hide detail behind a maze.

1. Wait for the third repetition before you extract

The first time you write a VPC config, it's a root module. The second time, resist the urge — you don't yet know which parts vary and which are load-bearing constants. By the third real call site, the variance is visible: you know what actually needs to be a parameter versus what was just an artifact of one environment's choices.