Terraform / OpenTofu

Overview

Terraform/OpenTofu infrastructure: module design, state/backends, multi-environment strategy, provider config, refactoring/import. Prefer tofu over terraform — OpenTofu is the Linux Foundation fork, config-compatible, and has capabilities OSS Terraform lacks (client-side state encryption). Command mapping table is at the end.

The single highest-value section is Expert Practices below — the anti-patterns/gotchas there are where naive-but-working configs go wrong.

Module & Configuration Design

Canonical layout — shared modules/, one root module per environment, lock file committed:

terraform/
├── modules/{vpc,eks,rds}/         # each: main.tf variables.tf outputs.tf versions.tf
├── environments/{dev,staging,prod}/  # each: main.tf backend.tf terraform.tfvars .terraform.lock.hcl
└── .terraform.lock.hcl