Terraform Module Design

Modules represent stable infrastructure capabilities, not one-off environment copies. Inputs are typed, validated, documented, and have safe defaults only when a default is genuinely universal. Outputs expose necessary integration data without leaking secrets.

Avoid modules that create unrelated resources, use excessive booleans, or embed environment names. Prefer composition of focused modules. Breaking changes follow semantic versioning and include migration guidance.

Test modules with validation, static analysis, and at least one representative fixture. High-risk modules may add terraform test or ephemeral integration tests.