terraform-review

Run terraform plan -detailed-exitcode and triage every resource action by symbol: + create, ~ update, -/+ replace, and - destroy. Treat any destroy or replacement on stateful resources like databases and volumes as a blocker until explicitly justified.

Add lifecycle { prevent_destroy = true } to databases, stateful volumes, and DNS zones, and enable deletion_protection on RDS or CloudSQL resources. Also check plan output for -/+ replacement lines, which indicate destroy-and-recreate even without an explicit delete.

Certain attribute changes force replacement, marked with '# forces replacement' in the plan. Renaming a resource in HCL also triggers destroy-and-create; use moved {} blocks or terraform state mv to rename without recreation.

Prefer for_each with stable keys over count. Count indexes shift when list elements are reordered or removed, causing Terraform to churn or recreate unrelated resources.

Check for secrets in .tf, .tfvars, or non-sensitive outputs, security groups with 0.0.0.0/0 ingress beyond public 80/443, IAM policies with wildcard actions, and any resource with an unintended public IP or endpoint.

For single-VPS projects, a simple setup script often beats a module tree. Terraform pays off when you manage multiple environments, need remote state with locking, or provision managed cloud resources like Kubernetes clusters.