Terraform is an infrastructure-as-code tool for declaratively provisioning and managing cloud infrastructure. It fits cloud-native work where resource definitions pass structured data to vendor APIs with minimal processing overhead. Use imperative configuration tools instead when the primary problem is managing procedural configuration steps. section 6.3.4
Platform teams should keep Terraform focused on their opinionated internal product rather than supporting every possible organizational use case. Narrower modules reduce unrelated testing, preserve change velocity, and make platform evolution easier. section 6.3.4
Treat Terraform code as software that needs early, layered feedback:
- Run Terraform CLI validation for syntax and fmt for canonical formatting. section 6.3.6
- Run Tflint to catch deprecations, invalid cloud-vendor parameters, naming problems, and other best-practice violations. section 6.3.6
- Run Trivy config scans to identify security problems in Terraform files, locally and in CI. section 6.3.6
A practical Terraform quality loop
Create main.tf, validate its syntax, correct errors, apply canonical formatting, resolve every Tflint warning, and fix findings from a Trivy scan. This turns static analysis into an actionable development exercise rather than a late pipeline failure. section 6.3.6
plugin "terraform" {
enabled = true
preset = "all"
}
plugin "aws" {
enabled = true
version = "0.30.0"
source = "github.com/terraform-linters/tflint-ruleset-aws"
}
A Tflint configuration enables Terraform rules and an AWS ruleset, illustrating provider-specific linting for platform infrastructure. section 6.3.6
