iac-terraform-guardianlisted

# iac-terraform-guardian Infrastructure-as-code turns a typo into a deleted database. This skill makes IaC changes boring and reversible: state is remote and locked, every apply is preceded by a *read* plan, modules have clean boundaries, and the operations that can destroy data are gated behind explicit review. Terraform/OpenTofu idiom; the principles port to Pulumi/CDK. ## Use BEFORE - Authoring new IaC for real cloud resources. - Any change to existing IaC — especially anything touching stateful resources (databases, disks, buckets). - Refactoring modules or moving resources between states. ## State is sacred - **Remote backend with locking** (S3+DynamoDB, GCS, Terraform Cloud). Never local state for shared infra — two engineers applying against local state corrupt each other's world. - **Locking on** so concurrent applies can't race. If a lock is stuck, understand why before force-unlocking — a force-unlock during an in-flight apply corrupts state. - **State contains secrets** (DB passwords, keys are stored in plaintext in state). Encrypt the backend at rest, restrict access, and never commit state or `terraform.tfstate.backup` to git. - **Never hand-edit state.** Use `terraform state mv`/`import`/`rm` for surgery; a hand-edited state file is how you get a resource Terraform thinks exists twice. - **Import, don't recreate.** Adopt existing resources with `import` rather than letting Terraform destroy-and-recreate them. ## Read the plan — every time `plan` is the singl