Terraform-hardened

State Management

• Local state gets corrupted/lost — use remote backend (S3, GCS, Terraform Cloud)
• Multiple people running simultaneously — enable state locking with DynamoDB or equivalent
• Never edit state manually — use terraform state mv, rm, import
• State contains secrets in plain text — encrypt at rest, restrict access

Count vs for_each

• count uses index — removing item 0 shifts all indices, forces recreation
• for_each uses keys — stable, removing one doesn't affect others
• Can't use both on same resource — choose one
• for_each requires set or map — toset() to convert list

Lifecycle Rules

• prevent_destroy = true — blocks accidental deletion, must be removed to destroy
• create_before_destroy = true — new resource created before old destroyed, for zero downtime
• ignore_changes for external modifications — ignore_changes = [tags] ignores drift
• replace_triggered_by to force recreation — when dependency changes