The situation
What needs investigation
Cloud resources have been created through consoles, scripts, and one-off fixes. Teams need a way to reproduce environments and review changes without turning Terraform into another source of hidden complexity.
Signals we look for
Terraform structure
- module boundaries
- variable inputs
- provider and version control
State
- remote state protection
- locking and access
- state ownership
Environments
- account or workspace separation
- shared components
- configuration differences
Change control
- Git review workflow
- plan visibility
- drift detection
How we investigate
Each step is validated against the workload before the next change.
- 01
Inventory resources
Identify what exists, ownership, and whether it can be imported safely.
- 02
Define code boundaries
Create modules around stable infrastructure concerns, not every individual resource.
- 03
Protect state
Set remote state, locking, scoped access, and recovery expectations.
- 04
Separate environments
Choose account, workspace, or directory boundaries based on risk and ownership.
- 05
Build review flow
Require plans and approvals for changes that affect shared infrastructure.
- 06
Control drift
Detect manual changes and define how they return to code.
Architecture / decision path
Example engineering decision
Illustrative state decision — not customer data
Resourcesshared VPC and application services
Change sourceconsole and scripts
State accessmultiple teams
Engineering interpretation
A single unrestricted state file can make unrelated changes block each other and increase blast radius. State boundaries should reflect ownership and dependency boundaries, not only folder structure.
Possible next investigation
- Separate shared network state from application state.
- Use locked remote state with scoped access.
- Import resources in small, reviewed groups.
- Set a policy for urgent manual changes.
Trade-offs we consider
Reuse
Generic modules reduce duplication but can become difficult to understand.
Isolation
More state files reduce blast radius but increase dependency management.
Speed
Plans and review add time but make infrastructure changes explainable.
Drift
Strict controls reduce drift but need an emergency change path.
What the engagement can produce
Typical outputs for this type of work
Scope depends on the environment and the problem being investigated.
- infrastructure inventory
- Terraform module and state design
- environment separation model
- Git and plan review workflow
- drift-control approach
- incremental adoption plan