IaC — Terraform GCP

Non-negotiable rules

• Remote backend in GCS — never local state. Every config starts with this block.
• terraform fmt before any commit. terraform validate before any plan.
• terraform plan output reviewed before every apply. Destructions require explicit operator confirmation.
• prevent_destroy = true on all stateful resources (BQ datasets, GCS buckets, Composer environments).
• Least-privilege IAM — never roles/owner, roles/editor, or roles/viewer on production resources.
• All resource descriptions, variable descriptions, and comments in English.

Project structure