Terraform

Official docs

Agent rules

1. Plan before apply — never suggest apply without plan output reviewed.
2. State is sacred — do not rename resources or move state without explicit migration steps.
3. Provider pins — match existing required_providers versions; do not bump major without ask.
4. Modules — prefer existing module patterns in repo over inventing new abstractions.
5. Secrets — no credentials in .tf; use env vars, TF_VAR_, or remote secret stores.