Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Comprehensive best practices for Terraform infrastructure as code from Anton Babenko's community guide
author
Anton Babenko (terraform-best-practices.com)
last_updated
2026-01-29T00:00:00.000Z
skill_level
intermediate
prerequisites
["Basic Terraform knowledge (resources, variables, outputs)","Understanding of IaC concepts","Familiarity with cloud providers (AWS/Azure/GCP)"]
when-to-use
["Designing Terraform project structure","Implementing infrastructure as code patterns","Scaling Terraform from small to large infrastructures","Choosing between Terraform and Terragrunt workflows","Establishing naming conventions and code styling","Managing Terraform state and modules"]
Terraform Best Practices Skill
Comprehensive community best practices for Terraform infrastructure as code, based on Anton Babenko's widely-adopted guide at terraform-best-practices.com.
When to Use This Skill
Activate this skill when:
Designing project structure - Choosing how to organize Terraform code for small, medium, or large infrastructure
Implementing IaC patterns - Following community best practices for modules, compositions, and state management
Scaling infrastructure - Growing from simple setups to complex multi-environment deployments
Evaluating tools - Deciding between vanilla Terraform vs Terragrunt orchestration
Establishing standards - Creating team conventions for naming, styling, and code organization
Troubleshooting common issues - Resolving frequent Terraform problems (dependency hell, state management, etc.)
# Pattern: {project}-{environment}-{resource-type}-{name}
resource "aws_s3_bucket" "main" {
bucket = "myapp-prod-data-customer-uploads"
}
# Pattern: this for single resource of type
resource "aws_security_group" "this" {
name = "${var.project}-${var.environment}-app"
}
Variable Naming
Use snake_case: instance_type, vpc_cidr_block
Boolean prefix with enable_ or create_: enable_monitoring, create_vpc
Plural for lists: subnet_ids, availability_zones
File Organization
main.tf - Primary resource definitions
variables.tf - Input variables
outputs.tf - Output values
versions.tf - Provider and Terraform version constraints
data.tf - Data sources (optional)
locals.tf - Local values (optional)
Code Styling Best Practices
Formatting
# Use terraform fmt
# Group related settings
resource "aws_instance" "web" {
ami = data.aws_ami.ubuntu.id
instance_type = var.instance_type
tags = {
Name = "${var.project}-web"
Environment = var.environment
ManagedBy = "Terraform"
}
}
# Align equals signs in blocks
variable "instance_config" {
type = object({
instance_type = string
volume_size = number
volume_type = string
})
}
# Use remote state for team collaboration
terraform {
backend "s3" {
bucket = "myapp-terraform-state"
key = "prod/vpc/terraform.tfstate"
region = "us-east-1"
encrypt = true
dynamodb_table = "terraform-state-lock"
}
}
State Best Practices
Never commit.tfstate files to version control (contains plaintext secrets)
Use remote backend (S3, Azure Storage, GCS) with locking
CRITICAL: State files contain sensitive data (passwords, keys, IPs)
Enable versioning on backend storage for rollback capability
Restrict access via IAM policies (least privilege principle)
Consider using sensitive = true for sensitive outputs
Separate state files by environment and component
Use state file encryption at rest (AES-256)
Implement state file backups and disaster recovery procedures
Use terraform_remote_state data source for cross-stack references
Terraform vs Terragrunt
When to Use Vanilla Terraform
✅ Small to medium infrastructure (< 50 resources)
✅ Single cloud provider
✅ Few environments (dev/prod)
✅ Team comfortable with DRY through modules
When to Use Terragrunt
✅ Large infrastructure (100+ resources)
✅ Many environments (dev/staging/prod/dr)
✅ Deep directory hierarchies
✅ Need for inheritance and composition
✅ Complex dependency orchestration
Terragrunt Benefits
DRY backend configuration
Dependency orchestration
Variable inheritance
Before/after hooks
Auto-init and auto-retry
Recommended Tools
Essential
terraform - Core IaC tool
terraform fmt - Code formatter (built-in)
terraform validate - Syntax validator (built-in)
Quality & Linting
tflint - Terraform linter with provider-specific rules
tfsec - Security scanner for Terraform code
checkov - Policy-as-code scanner
terraform-docs - Auto-generate documentation
Version Management
tfenv - Terraform version manager (like nvm for Node)
tgenv - Terragrunt version manager
Workflow Automation
pre-commit-terraform - Git hooks for quality gates
Atlantis - Pull request automation for Terraform
Infracost - Cost estimation in PRs
Orchestration
Terragrunt - DRY orchestration wrapper
Terramate - Stack orchestration and code generation
