iac

Define typed variables with validation, organize resources into reusable modules, and use provider-specific data sources instead of hardcoded values. Follow each provider's conventions such as AWS tagging, Azure resource groups, and GCP service accounts with minimal permissions.

Use workspaces or separate state keys per environment with a remote backend like S3, and compose modules with explicit inputs and outputs. Pass environment-specific values through variables and wire dependencies between modules using depends_on.

ignore_changes masks configuration drift so Terraform shows no changes while actual infrastructure differs from code. It hides root causes like external modification or misconfiguration, so alternatives like data sources, create_before_destroy, or resource imports should be used instead.

Yes, terraform import brings existing brownfield infrastructure under Terraform management by mapping real resources to configuration blocks. This is preferred over ignoring drift when resources are managed by multiple systems.

Enable encryption at rest and in transit, apply least-privilege IAM permissions, never hardcode secrets, and configure network controls like security groups and firewalls. Enable audit logging and validate plans for open access before applying.