• Creating new Terraform or OpenTofu configurations or modules
• Setting up testing infrastructure for IaC code
• Deciding between testing approaches (validate, plan, frameworks)
• Structuring multi-environment deployments
• Implementing CI/CD for infrastructure-as-code
• Reviewing or refactoring existing Terraform/OpenTofu projects
• Choosing between module patterns or state management approaches

• Basic Terraform/OpenTofu syntax questions (Claude knows this)
• Provider-specific API reference (link to docs instead)
• Cloud platform questions unrelated to Terraform/OpenTofu

environments/        # Environment-specific configurations
├── prod/
├── staging/
└── dev/

modules/            # Reusable modules
├── networking/
├── compute/
└── data/

examples/           # Module usage examples (also serve as tests)
├── complete/
└── minimal/

• Separate environments (prod, staging) from modules (reusable components)
• Use examples/ as both documentation and integration test fixtures
• Keep modules small and focused (single responsibility)

1. Validate schemas with Terraform MCP:

   Search provider docs → Get resource schema → Identify block types

2. Choose correct command mode:

   • command = plan

     - Fast, for input validation

   • command = apply

     - Required for computed values and set-type blocks
3. Handle set-type blocks correctly:
   • Cannot index with

     [0]

   • Use

     for

     expressions to iterate
   • Or use

     command = apply

     to materialize

• S3 encryption rules: set (use for expressions)
• Lifecycle transitions: set (use for expressions)
• IAM policy statements: set (use for expressions)

• Testing Frameworks Guide - Deep dive into static analysis, native tests, and Terratest
• Quick Reference - Decision flowchart and command cheat sheet

1. count

   or

   for_each

   FIRST (blank line after)
2. Other arguments

3. tags

   as last real argument

4. depends_on

   after tags (if needed)

5. lifecycle

   at the very end (if needed)

undefined

1. description

   (ALWAYS required)

2. type

3. default

4. validation

5. nullable

   (when setting to false)

variable "environment" {
  description = "Environment name for resource tagging"
  type        = string
  default     = "dev"

  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Environment must be one of: dev, staging, prod."
  }

  nullable = false
}

...

**Stable addressing with for_each:**
```hcl

...

...

**For migration guides and detailed examples, see:** Code Patterns: Count vs For_Each

References secondary CIDR first, falling back to VPC

Forces Terraform to delete subnets before CIDR association

**Why this matters:**
- Prevents deletion errors when destroying infrastructure
- Ensures correct dependency order without explicit `depends_on`
- Particularly useful for VPC configurations with secondary CIDR blocks

**For detailed examples, see:** Code Patterns: Locals for Dependency Management

• ✅ Always include

  description

• ✅ Use explicit

  type

  constraints
• ✅ Provide sensible

  default

  values where appropriate
• ✅ Add

  validation

  blocks for complex constraints
• ✅ Use

  sensitive = true

  for secrets

• ✅ Always include

  description

• ✅ Mark sensitive outputs with

  sensitive = true

• ✅ Consider returning objects for related values
• ✅ Document what consumers should do with each output

• Module Patterns Guide - Variable best practices, output design, ✅ DO vs ❌ DON'T patterns
• Quick Reference - Resource naming, variable naming, file organization

1. Validate - Format check + syntax validation + linting
2. Test - Run automated tests (native or Terratest)
3. Plan - Generate and review execution plan
4. Apply - Execute changes (with approvals for production)

1. Use mocking for PR validation (free)
2. Run integration tests only on main branch (controlled cost)
3. Implement auto-cleanup (prevent orphaned resources)
4. Tag all test resources (track spending)

• CI/CD Workflows Guide - GitHub Actions, GitLab CI, Atlantis integration, cost optimization
• Quick Reference - Common CI/CD issues and solutions

• Store secrets in variables
• Use default VPC
• Skip encryption
• Open security groups to 0.0.0.0/0

• Use AWS Secrets Manager / Parameter Store
• Create dedicated VPCs
• Enable encryption at rest
• Use least-privilege security groups

• Security & Compliance Guide - Trivy/Checkov integration, secrets management, state file security, compliance testing

• Use Terratest for testing
• No native testing framework available
• Focus on static analysis and plan validation

• New: Native

  terraform test

  /

  tofu test

  command
• Consider migrating from external frameworks for simple tests
• Keep Terratest only for complex integration tests

• New: Mock providers for unit testing
• Reduce cost by mocking external dependencies
• Use real integration tests for final validation

• Testing Frameworks - In-depth guide to static analysis, native tests, and Terratest
• Module Patterns - Module structure, variable/output best practices, ✅ DO vs ❌ DON'T patterns
• CI/CD Workflows - GitHub Actions, GitLab CI templates, cost optimization, automated cleanup
• Security & Compliance - Trivy/Checkov integration, secrets management, compliance testing
• Quick Reference - Command cheat sheets, decision flowcharts, troubleshooting guide