iac-review

Review a Terraform module by checking structure (single responsibility, no hardcoded values), remote state with locking, security (no secrets, least-privilege IAM), and change safety (pinned versions, plan attached to the PR). Report findings in a severity table with an approve or request-changes verdict.

An IaC review checklist should cover module composability, remote state with locking and per-environment separation, secret management via Key Vault or Secrets Manager, encryption at rest and in transit, pinned provider and module versions, prevent_destroy on stateful resources, and scheduled drift detection.

Yes, the checklist applies to Terraform, Bicep, and CloudFormation. The same principles hold: parameterized inputs, no secrets in code, least-privilege access, and change safety, though tooling differs (tfsec and checkov for Terraform, PSRule for Bicep).

Detect drift by scheduling terraform plan -detailed-exitcode daily or running Driftctl. Each detected drift should automatically create a ticket so it never stays silent, and manual console changes must be codified afterward.

Use for_each with stable keys instead of count because count on reorderable lists causes resources to be destroyed and recreated when list order changes. for_each tracks resources by key, making plans stable and predictable.