iac-terraformlisted

# Terraform Discipline The operational discipline for Terraform as the active IaC tool — cloud-independent. Service-level resource detail comes from the active `cloud-architecture-<cloud>` pack; project file layout and backend config come from `CLAUDE.md`. For repo-specific style (naming, ordering, security defaults) see the `terraform-conventions` skill if present. ## Core stance - **Infrastructure is software.** If it only works once, it doesn't work. "Just apply it again" is not a strategy — understand *why* it failed first. - **Plan is the contract.** Never `apply` without reading the `plan`. The plan is the what-if; treat a surprising plan as a bug to investigate, not a step to skip. - **Pin everything.** Required Terraform version + provider versions in a lockfile (`.terraform.lock.hcl`, committed). Unpinned providers are how "it worked yesterday" happens. ## State - **Remote state with locking, always.** Local state is a single point of failure and blocks collaboration. Use a backend with locking (e.g. S3 + DynamoDB lock table, GCS, azurerm with blob lease, or Terraform Cloud). Never commit state — it contains secrets. - **Separate state per major component / environment** — smaller blast radius, faster plan/apply, and a failure in one doesn't lock the others. Check the project's `backend.tf` / backend config before touching anything stateful. - **State surgery** when reality and state diverge: - `terraform state list` — see what's tracked. - `