Master Terraform and OpenTofu Best Practices

This skill is a comprehensive Terraform and OpenTofu reference built on terraform-best-practices.com and enterprise experience, using progressive disclosure (essentials here, detailed guides loaded on demand). It covers the module hierarchy (Resource -> Resource Module -> Infrastructure Module -> Composition) and directory conventions separating environments/ from reusable modules/; naming conventions (descriptive resource names, "this" reserved for true singletons, contextual variable prefixes); and a testing-approach decision matrix mapping situation to tool - quick syntax checks to terraform validate/fmt, pre-commit to tflint/trivy/checkov, Terraform 1.6+ simple logic to the native terraform test framework, pre-1.6 or Go-familiar teams to Terratest, security/compliance to policy-as-code (OPA, Sentinel), and complex multi-cloud scenarios to full Terratest integration testing.

It sets strict code structure standards: resource block argument ordering (count/for_each first, tags last before depends_on/lifecycle), variable block ordering (description always first, then type, default, validation, nullable), and a decision guide for count (boolean toggles, fixed replication) versus for_each (stable addressing when items may be reordered or removed - critical because count-indexed resources shift addresses when a middle item is removed, causing unwanted recreation). It documents using locals with try() to control resource deletion order without explicit depends_on, standard module structure with examples/ and tests/, CI/CD stage sequencing (validate -> test -> plan -> apply) with cost-optimization tactics (mocking for PRs, integration tests only on main), essential security checks (trivy config ., checkov -d ., avoiding secrets in variables/default VPCs/open security groups), version-constraint strategy by component (exact for prod modules, ~> for providers and Terraform itself), and a table of modern Terraform features by version - try() (0.13+), nullable = false and moved blocks (1.1+), optional() (1.3+), native testing (1.6+), mock providers (1.7+), provider functions (1.8+), cross-variable validation (1.9+), and write-only arguments for secrets never stored in state (1.11+).

Use this skill for creating new Terraform/OpenTofu configurations or modules, setting up IaC testing infrastructure, choosing a testing approach, structuring multi-environment deployments, implementing CI/CD for infrastructure code, or reviewing/refactoring existing projects. It explicitly supports both Terraform and OpenTofu.

The source explicitly excludes: basic Terraform/OpenTofu syntax questions (assumed already known), provider-specific API reference (link to official docs instead), and cloud-platform questions unrelated to Terraform/OpenTofu itself.

Input is a Terraform/OpenTofu structuring, testing, or standards question - which testing tool fits, how to order a resource block, count vs for_each, how to pin a version constraint. Output is a concrete recommendation with a code example (HCL or Go/Terratest), often pointing to one of five detailed reference guides (Testing Frameworks, Module Patterns, CI/CD Workflows, Security & Compliance, Quick Reference) for deeper coverage.

trivy config .
checkov -d .

References terraform-best-practices.com conventions, Terratest (gruntwork-io/terratest), native terraform test/tofu test, security scanners Trivy and Checkov, policy-as-code tools OPA and Sentinel, and CI/CD platforms GitHub Actions, GitLab CI, and Atlantis (covered in the linked CI/CD Workflows guide). Licensed under Apache License 2.0, copyright Anton Babenko.

Terraform and OpenTofu practitioners - from module authors to platform teams - who want enterprise-grade conventions for structure, testing, security, and versioning rather than ad hoc configuration.