# Terraform taste of a cloud platform engineer - Pin the Terraform version and every provider version, and commit .terraform.lock.hcl. Confidence: 0.95 - Store state remotely with locking enabled, for example S3 with DynamoDB or Terraform Cloud. Confidence: 0.95 - Split state per environment and per system so one apply never touches everything. Confidence: 0.90 - Use separate directories per environment instead of Terraform workspaces for prod and staging. Confidence: 0.75 - Keep modules small and focused on one concern, such as a network or a database. Confidence: 0.85 - Pin module sources to a tag or version, never to a moving branch. Confidence: 0.90 - Give every variable a type and a description, and add validation blocks for risky inputs. Confidence: 0.85 - Expose only the outputs that other stacks actually consume. Confidence: 0.70 - Name resources in snake_case and avoid repeating the resource type in the name. Confidence: 0.75 - Apply a shared tag set (owner, environment, cost center) through provider default_tags. Confidence: 0.85 - Prefer for_each over count so adding or removing an item does not reshuffle addresses. Confidence: 0.90 - Use moved blocks for refactors instead of manual terraform state mv. Confidence: 0.85 - Bring existing resources in with import blocks that are reviewed in a pull request. Confidence: 0.80 - Run terraform fmt, validate and tflint in CI on every pull request. Confidence: 0.90 - Post the terraform plan output as a pull request comment for review. Confidence: 0.85 - Apply only from CI using the reviewed plan file, never from a laptop. Confidence: 0.85 - Authenticate CI to the cloud with OIDC instead of long-lived access keys. Confidence: 0.90 - Never put secrets in tfvars; read them from a secrets manager at apply time. Confidence: 0.90 - Use prevent_destroy on stateful resources like databases and buckets. Confidence: 0.80 - Scan configurations with a policy tool such as checkov or tfsec before merging. Confidence: 0.75 - Avoid provisioners and local-exec; hand configuration off to images or config tools. Confidence: 0.80 - Run a scheduled plan to detect drift and alert when it is not empty. Confidence: 0.75 - Keep data sources for lookups and avoid hardcoding IDs or ARNs. Confidence: 0.80
Reviews terraform plan and show -json output before apply. Flags destroys and replacements of databases, buckets and other data stores, removed deletion protection, skipped final snapshots, force_destroy, new 0.0.0.0/0 ingress, public databases and buckets, IAM widening (wildcards, admin policies, PassRole on *, open trust policies) and count index shifts, and writes a risk summary with a verdict. Includes a stdlib Python checker with --self-test.
Rightsizes Kubernetes CPU and memory requests and limits from real usage (p50, p95 and max per container). Recommends requests at p95 plus headroom, memory limits above the peak and no CPU limits, and estimates the cores, GiB and money freed. Flags OOM kills, memory above the request, CPU throttling, missing requests or memory limits, overprovisioning and short data windows. Includes a stdlib Python rightsizer with --self-test.
Plans and checks IPv4 subnet layouts for AWS, Azure, GCP or on-prem networks. Sizes each subnet from host counts plus growth and the provider's reserved addresses, allocates aligned CIDR blocks largest-first, and flags overlapping subnets, VPC ranges that clash with peered VPCs, VPNs or the docker0 bridge, public ranges, size limits, low headroom and single-zone layouts. Includes a stdlib Python planner with --self-test.
Reviews nginx.conf and site configs for security problems such as TLS 1.0/1.1, weak ciphers, missing HSTS and security headers, the add_header inheritance trap, alias off-by-slash path traversal, autoindex, unlimited body size, $uri in redirects, HTTP without an HTTPS redirect, open admin paths and logins without rate limits. Gives a fixed config. Includes a stdlib Python checker with --self-test.
