Terraform Repository Standard

Separate reusable modules from live environment roots. Roots identify backend, providers, variables, and ownership. Modules expose small, typed interfaces and avoid hidden provider configuration.

Suggested structure:

modules/
  network/
  eks/
environments/
  dev/
  test/
  prod/
.github/workflows/ci.yml
README.md

State files, plans containing secrets, and local .terraform directories are never committed. Provider and module versions are constrained and lock files are reviewed.

Ownership and documentation

Every live root identifies its environment, account or subscription, region, backend, owning team, and apply workflow. The README explains prerequisites, variable sources, import procedures, and recovery expectations. Sensitive outputs are marked and are not printed into CI summaries.

Change design

Infrastructure PRs describe blast radius and replacement behavior. Changes that destroy or recreate stateful resources require explicit evidence and approval. Modules avoid reading arbitrary remote state when a narrow output or configuration interface can be used instead.