DEV Community

Cover image for Terraform Best Practices for Production
AWS Community Builders profile image William Mukoyani
William Mukoyani for AWS Community Builders

Posted on

Terraform Best Practices for Production

#terraform #devops #aws #cicd

Published: December 11, 2025 • 6 min read

Introduction

Terraform has become the de facto standard for Infrastructure as Code (IaC) across multiple cloud providers. However, moving from simple proofs of concept to production-ready infrastructure requires following established best practices and patterns.

Business Value

Cost Optimization

  • Multi-Cloud Strategy: Avoid vendor lock-in and leverage competitive pricing across providers
  • Resource Lifecycle Management: Automatically destroy unused resources to minimize waste
  • Infrastructure Standardization: Reduce operational overhead through consistent deployment patterns
  • Cost Visibility: Track infrastructure costs through consistent tagging and resource grouping

Risk Mitigation

  • Infrastructure Drift Detection: Identify and correct configuration drift before it causes issues
  • Disaster Recovery: Rapidly rebuild infrastructure in alternate regions or providers
  • Change Management: Review and approve infrastructure changes through code review processes
  • Compliance Automation: Ensure security policies are consistently applied across all environments

Business Agility

  • Faster Market Entry: Deploy new products and features with infrastructure provisioned in minutes
  • Developer Self-Service: Enable development teams to provision their own environments safely
  • Experimentation: Quickly spin up test environments for proof-of-concepts and A/B testing
  • Global Expansion: Replicate infrastructure patterns across multiple regions and markets

Project Structure

Recommended Directory Layout 

terraform/
├── environments/
│   ├── dev/
│   ├── staging/
│   └── prod/
├── modules/
│   ├── vpc/
│   ├── ec2/
│   └── rds/
├── shared/
│   └── variables.tf
└── README.md
Enter fullscreen mode Exit fullscreen mode

Environment Separation

Keep environments completely separate:

# environments/prod/main.tf
module "vpc" {
  source = "../../modules/vpc"

  environment = "prod"
  cidr_block  = "10.0.0.0/16"

  tags = {
    Environment = "production"
    Project     = "my-app"
  }
}
Enter fullscreen mode Exit fullscreen mode

State Management

Remote State Storage

Always use remote state for production:

terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "prod/terraform.tfstate"
    region         = "us-west-2"
    encrypt        = true
    dynamodb_table = "terraform-locks"
  }
}
Enter fullscreen mode Exit fullscreen mode

State Locking

Implement state locking to prevent concurrent modifications:

resource "aws_dynamodb_table" "terraform_locks" {
  name           = "terraform-locks"
  billing_mode   = "PAY_PER_REQUEST"
  hash_key       = "LockID"

  attribute {
    name = "LockID"
    type = "S"
  }
}
Enter fullscreen mode Exit fullscreen mode

Module Design

Input Variables

Define clear, well-documented variables:

variable "instance_type" {
  description = "EC2 instance type"
  type        = string
  default     = "t3.micro"

  validation {
    condition = contains([
      "t3.micro", "t3.small", "t3.medium"
    ], var.instance_type)
    error_message = "Instance type must be t3.micro, t3.small, or t3.medium."
  }
}
Enter fullscreen mode Exit fullscreen mode

Output Values

Expose necessary information:

output "vpc_id" {
  description = "ID of the VPC"
  value       = aws_vpc.main.id
}

output "private_subnet_ids" {
  description = "IDs of private subnets"
  value       = aws_subnet.private[*].id
}
Enter fullscreen mode Exit fullscreen mode

Security Best Practices

Sensitive Data Management

Never hardcode secrets:

# ❌ Bad
resource "aws_db_instance" "main" {
  password = "hardcoded-password"
}

# ✅ Good
resource "aws_db_instance" "main" {
  manage_master_user_password = true
}
Enter fullscreen mode Exit fullscreen mode

IAM Policies

Follow the least privilege principle:

data "aws_iam_policy_document" "app_policy" {
  statement {
    effect = "Allow"
    actions = [
      "s3:GetObject",
      "s3:PutObject"
    ]
    resources = [
      "${aws_s3_bucket.app_bucket.arn}/*"
    ]
  }
}
Enter fullscreen mode Exit fullscreen mode

Resource Naming and Tagging

Consistent Naming 

locals {
  name_prefix = "${var.project}-${var.environment}"

  common_tags = {
    Project     = var.project
    Environment = var.environment
    ManagedBy   = "terraform"
  }
}

resource "aws_vpc" "main" {
  cidr_block = var.cidr_block

  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-vpc"
  })
}
Enter fullscreen mode Exit fullscreen mode

Version Management

Provider Versions

Pin provider versions:

terraform {
  required_version = ">= 1.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Module Versions

Use semantic versioning for modules:

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 5.0"

  # module configuration
}
Enter fullscreen mode Exit fullscreen mode

Testing and Validation

Pre-commit Hooks 

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/antonbabenko/pre-commit-terraform
    rev: v1.83.5
    hooks:
      - id: terraform_fmt
      - id: terraform_validate
      - id: terraform_docs
Enter fullscreen mode Exit fullscreen mode

Automated Testing 

# test/vpc_test.go
func TestVPCModule(t *testing.T) {
    terraformOptions := &terraform.Options{
        TerraformDir: "../modules/vpc",
        Vars: map[string]interface{}{
            "cidr_block": "10.0.0.0/16",
        },
    }

    defer terraform.Destroy(t, terraformOptions)
    terraform.InitAndApply(t, terraformOptions)

    vpcId := terraform.Output(t, terraformOptions, "vpc_id")
    assert.NotEmpty(t, vpcId)
}
Enter fullscreen mode Exit fullscreen mode

CI/CD Integration

GitHub Actions Workflow 

name: Terraform
on:
  push:
    branches: [main]
  pull_request:

jobs:
  terraform:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.6.0

      - name: Terraform Init
        run: terraform init

      - name: Terraform Plan
        run: terraform plan -no-color

      - name: Terraform Apply
        if: github.ref == 'refs/heads/main'
        run: terraform apply -auto-approve
Enter fullscreen mode Exit fullscreen mode

Monitoring and Observability

Resource Tagging for Cost Tracking 

locals {
  cost_tags = {
    CostCenter = var.cost_center
    Owner      = var.owner
    Purpose    = var.purpose
  }
}
Enter fullscreen mode Exit fullscreen mode

CloudWatch Integration 

resource "aws_cloudwatch_log_group" "app_logs" {
  name              = "/aws/lambda/${local.name_prefix}"
  retention_in_days = var.log_retention_days

  tags = local.common_tags
}
Enter fullscreen mode Exit fullscreen mode

Performance Optimization

Parallel Execution 

resource "aws_instance" "web" {
  count = var.instance_count

  ami           = data.aws_ami.ubuntu.id
  instance_type = var.instance_type

  tags = merge(local.common_tags, {
    Name = "${local.name_prefix}-web-${count.index + 1}"
  })
}
Enter fullscreen mode Exit fullscreen mode

Resource Dependencies 

resource "aws_security_group" "web" {
  name_prefix = "${local.name_prefix}-web"
  vpc_id      = aws_vpc.main.id
}

resource "aws_instance" "web" {
  depends_on = [aws_internet_gateway.main]

  ami                    = data.aws_ami.ubuntu.id
  instance_type          = var.instance_type
  vpc_security_group_ids = [aws_security_group.web.id]
}
Enter fullscreen mode Exit fullscreen mode

Common Pitfalls to Avoid

  1. Hardcoding Values: Use variables and data sources
  2. Large State Files: Break into smaller, focused modules
  3. No State Locking: Always implement state locking
  4. Ignoring Drift: Regularly run terraform plan to detect drift
  5. Poor Documentation: Document modules and complex configurations

Parting Thoughts

Following these best practices will help you build maintainable, secure, and scalable Terraform infrastructure. Remember that Infrastructure as Code is not just about automation, it's about bringing software engineering practices to infrastructure management.

Start implementing these practices incrementally in your existing projects, and make them standard for all new infrastructure deployments.

References

  1. Terraform Documentation - Terraform Docs
  2. Terraform Best Practices Guide - Terraform Best Practices
  3. HashiCorp Learn Terraform - Learn Hashicorp Terraform
  4. Terraform AWS Provider Documentation - AWS Provider Doc
  5. Terraform: Up & Running - Yevgeniy Brikman, O'Reilly Media
  6. Terratest: Automated Testing for Infrastructure - Terratest Gruntwork IO
  7. Terraform Registry - Terraform Registry
  8. Terraform Cloud Documentation - Terraform Cloud Doc
  9. Pre-commit Terraform Hooks - Terraform Hooks
  10. Checkov: Static Analysis for Terraform - CheckOv

Want to learn more about cloud infrastructure? Check out my articles on AWS CloudFormation and CI/CD best practices.

Top comments (0)