Beyond the basics
Most tutorials teach you how to write an aws_instance block. In real production, that's the easy part. The hard questions are:
- How do you lay out a repository so 20 engineers can work in it without blocking each other?
- How do you split state so a mistake in compute can't touch the database or the network?
- How do you restructure code without destroying and re-creating resources?
- How do you keep secrets out of Git and out of state?
- How does a team deliver every module the same way, from design to production?
This track comes from building and running multi-account AWS platforms in telecom, tolling, and healthcare.
The track has two parts. Part 1 teaches the production techniques one at a time. Part 2 puts them together as one delivery process: how a team designs, builds, tests, records, reviews, and promotes every module the same way. It follows a real codebase standard for an AWS Glue and S3 data platform, with every name removed. Every module ends with a short recap of the key terms and a five-question pop quiz; score 4 out of 5 to pass.
- Building or changing one module in a codebase that already exists? Start at Module 07 and follow Part 2 in order. Your environments and their state layers stay as they are.
- Starting a platform from scratch? Begin with Module 01 and Module 02 to split state into layers and bootstrap the backend. Then build each layer's code through the Part 2 process.
- Already running Terraform in production? Go straight to Module 11 for the whole process on one page, then back to whichever step you're missing.
Production techniques
The patterns every enterprise Terraform codebase needs, each on its own: structure, state, validation, secrets, refactoring, and CI/CD.
-
01
Start module →
Enterprise Repository & Module Layout
Reusable child modules kept apart from the root deployments that use them, state split into layers, and exact version pins.
-
02
Read module →
State Isolation, Remote Locking & Blast Radius Control
A secure S3 backend with native locking, state split into layers, and SSM parameters instead of remote_state.
-
03
Read module →
Modern HCL (Types, Validations & Preconditions
Modules that reject bad inputs at plan time, preconditions and postconditions, and why for_each beats count.
-
04
Read module →
Zero-Plaintext Secret Architecture
Why sensitive = true doesn't protect state, letting AWS manage database passwords, and OIDC roles instead of access keys.
-
05
Read module →
Zero-Downtime Refactoring with Moved & Import Blocks
Rename, restructure, adopt, and let go of resources with moved, import, and removed blocks, without re-creating anything.
-
06
Read module →
CI/CD Guardrails) TFLint, Checkov & Plan Automation
Fast lint checks, Checkov security scanning, a plan posted on every pull request, and a nightly drift check.
How a module is delivered: design to production
One process for a team codebase, in the order the work happens. Each module is one step, and the last puts every step on one page.
-
07
Start Part 2 →
Base, Composition & Environment: A Three-Layer Module Standard
Base modules build one component, compositions join them with IAM and networking, and every environment keeps the same shape.
-
08
Read module →
Naming, Tagging & Provider Versions Across a Module Tree
One naming pattern, tags split between provider default_tags and module inputs, and provider versions that agree all the way down.
-
09
Read module →
The Change Workflow & Module Testing
Apply only the saved plan you reviewed, change code bottom-up, and test modules with terraform test and Terratest.
-
10
Read module →
ADRs & Changelogs: Recording Why the Infrastructure Looks This Way
Decision records with real rejected options, the changes that must leave one behind, and a changelog per environment.
-
11
Read module →
The Module Promotion Gate: Scan Before You Wire
Scan each module alone, justify every finding, get a second approval, then scan again once wired in. Plus the whole process end to end.