platform-infrastructure-as-code

Review a Terraform plan by checking which resources are created, updated, replaced, or destroyed, and highlighting destructive changes explicitly. Run terraform validate in CI on every PR and treat the plan diff as part of code review.

Drift is the difference between declared IaC state and live cloud resources, usually from manual console changes. Detect it with scheduled plan runs comparing state to live infrastructure, then reconcile by importing changes or reverting them.

Use small, purposeful modules with clear inputs and outputs once resource ownership and variation are understood. Avoid creating generic shared modules early, since broad modules make small changes dangerous across teams.

No, secrets should never be stored in variables files, state, plan logs, or repository files. Reference external secret stores instead, and use policy-as-code tools like Checkov or OPA to block secrets-in-state.

Require human approval for destructive changes, broad cross-cutting modifications, IAM and network changes, and anything affecting production availability. Small diffs can still be high-risk when they touch permissions or data-bearing resources.