Terraform Modules and Safe State Changes
Build reusable Terraform modules, isolate environments, and plan imports, refactors, and state migrations with explicit checks.
Before & after
Same prompt, same agent — the only difference is the skill.
Setting up AWS infrastructure with Terraform is definitely achievable. That's a good approach because it's infrastructure-as-code and repeatable. To build the right setup, I need to understand your requirements. What does your web app do, and what's the expected scale — are we talking hundreds of daily users or millions? Do you need high availability across multiple regions, or is a single region okay? For compute, are you thinking EC2 instances, containers on ECS, or serverless with Lambda? Do you need a database — managed RDS or self-hosted? What about storage — S3 for static assets? And networking — do you need a load balancer, VPN, or any special security requirements? Also, do you have existing AWS infrastructure, or is this brand new? What's your DevOps experience level — are you looking for a production-ready setup or something to learn with? Once I know these details, I can design a Terraform architecture that fits your needs.
AWS TERRAFORM ARCHITECTURE - MULTI-ENVIRONMENT SETUP
STACK OVERVIEW
Region: us-east-1 (primary) + us-west-2 (DR)
Environments: dev, staging, prod
Compute: ECS on Fargate (containerized) + ALB
Database: RDS PostgreSQL 15 (Multi-AZ for prod)
Storage: S3 for assets + CloudFront CDN
Secrets: AWS Secrets Manager
TERRAFORM STRUCTURE
├── main.tf (provider, backend)
├── vpc.tf (networking, subnets, security groups)
├── ecs.tf (task definitions, services)
├── rds.tf (database, parameter groups)
├── s3.tf (buckets, lifecycle policies)
├── alb.tf (load balancer, listeners, target groups)
├── variables.tf (env vars, instance counts)
├── terraform.tfvars (per-environment config)
├── outputs.tf (load balancer URL, DB endpoint)
└── modules/
├── networking/
├── database/
└── compute/
KEY MODULES
Module: networking
• VPC (10.0.0.0/16)
• Public subnets (3 AZs, /24 each)
• Private subnets (3 AZs, /24 each)
• NAT gateways for outbound from private
• Security groups (ALB, ECS, RDS)
Module: database
• RDS instance (db.t3.medium)
• Multi-AZ enabled (prod only)
• Backup retention: 30 days
• Parameter group (custom settings)
• Secrets Manager for password rotation
Module: compute
• ECS cluster (3 instances)
• Task definition (2 CPU, 4GB memory)
• Auto-scaling group (min 3, max 10 tasks)
• Container image from ECR
DEPLOYMENT STEPS
1. terraform init (backend: S3 + DynamoDB state lock)
2. terraform plan -var-file=environments/prod.tfvars
3. Review output (resources, counts, changes)
4. terraform apply -auto-approve
5. Run smoke tests against ALB endpoint
6. Configure DNS (Route53 or external)
COST ESTIMATE (prod, monthly)
ALB: $16 + $0.006/hour traffic = $50
ECS Fargate: 3 tasks * 2 CPU * $0.0441/h = $950
RDS: db.t3.medium Multi-AZ = $300
S3 + CloudFront: $50-100
Total: ~$1350/month
SECURITY
• Security groups: whitelist only needed ports
• RDS: encrypted at rest (AWS KMS)
• Secrets: auto-rotate every 30 days
• Terraform state: encrypted S3 backend
• IAM: least-privilege roles for servicesAbout this skill
Terraform says it will recreate a resource you only meant to rename, or an import suddenly proposes changes to production. This skill traces resource addresses, provider targets, and state ownership before producing the code and operation sequence, with explicit conditions for stopping.
What it does
- Builds reusable modules with typed inputs, validation, deliberate outputs, and provider boundaries.
- Separates environment state, credentials, and deployment scope without assuming workspaces provide security isolation.
- Maps existing cloud resources to Terraform addresses and prepares imports that avoid unintended changes.
- Uses moved blocks for address refactors and distinguishes them from cross-state transfers.
- Plans backend migrations with secure backups, a single writer, destination verification, and recovery conditions.
- Reviews plans for replacements, deletes, unknown values, drift, and tests that could create billable infrastructure.
What you get
Implementation-ready HCL or a focused patch, an ordered command sequence, and acceptance checks matched to the change. Reviews distinguish observed results from expected behavior and identify the exact address or prerequisite that blocks a safe next step.
Best for
Engineers maintaining Terraform on AWS, Azure, or GCP, especially teams adopting existing infrastructure, extracting modules, separating environments, or changing remote state backends.
SKILL.md preview
---
name: terraform-modules-and-safe-state-changes
description: Build and review Terraform modules, provider configurations, and environment workflows across AWS, Azure, and GCP. Trace resource addresses and state ownership to prepare imports, refactors, backend migrations, and plan-based verification. Use when the user says "build a reusable Terraform module", "import this existing resource", "Terraform wants to replace my database", "move our Terraform state backend", "split staging and production", "my Terraform plan keeps showing changes", or "review this Terraform plan".
---
# Terraform Modules and Safe State Changes
… (sign up to view the full skill)More development skills
View all Development skills →Chaos Experiment and Game Day Planner
Plans chaos experiments and game days: hypothesis, blast radius, abort conditions, tool manifests, rollback, and post-run review.
Claude Code Cost and Latency Routing
Configure Claude Code Router with model tiers, explicit fallbacks, compatibility checks, and a cost-aware validation plan.
CI/CD Pipeline Builder with Gated Deploys
Generates CI/CD workflows from your repo's real stack: cached fast-fail checks, pinned actions, and staging-to-prod deploys with gates.
Terraform Modules and Safe Deployments
Get reusable Terraform modules, safe state migrations, explicit provider wiring, and CI gates tied to reviewed plans.