terraform

Use a layered approach: run terraform validate, tflint, and Checkov for static analysis, then terraform test with .tftest.hcl files and mock providers for contract testing. Reserve Terratest for real-deploy integration tests of high-blast-radius modules.

OpenTofu 1.12 has diverged from Terraform with native client-side state encryption, provider for_each, and dynamic prevent_destroy. Migration from Terraform is straightforward, but rolling back after using OpenTofu-only features is not, so evaluate lock-in risk first.

Use moved blocks (Terraform 1.1+) to rename or relocate resources declaratively instead of running terraform state mv or rm. Keep moved blocks in configuration for at least one release cycle after the migration.

Unsupported condition keys fail closed without errors, and terraform validate or plan will not catch them. Verify actions, resources, and condition keys against the AWS Service Authorization Reference, noting that valid keys differ per action.

Yes, always commit .terraform.lock.hcl to version control. It is the only supply-chain lock for providers and ensures reproducible builds; note that modules are not covered, so pin exact versions for critical modules.

Use -target sparingly and prefer full plans, since targeted applies can miss dependencies and produce inconsistent state. Always review the full plan output and destroy counts before applying changes.