Terraform 0.12 Standards

 Overview

The aim of this document is to provide a standard using best practices which all Terraform 0.12 code will follow. This should then created a more consolidated and standardised code base promoting greater familiarity to all squads code.

 

Variables and outputs should have descriptions:  

All variables and outputs should have one or two sentence descriptions that explain their purpose. This is used for documentation.

 

Nested Modules (submodules) :

If the root module includes calls to nested modules, they should use relative paths like ./modules/consul-cluster so that Terraform will consider them to be part of the same repository or package, rather than downloading them again separately.

 

resource/datasource tagging:

follow AWS best practices - https://aws.amazon.com/answers/account-management/aws-tagging-strategies/

for example, apart from the documentation side, it allows us to easily search for resources and setup budget reports per team if required at some point.

 

Possibly consider using open policy agent to enfore tagging at tf plan stage -  https://github.com/instrumenta/conftest

 

Handling Sensitive Values in State

Implement the sensitive property to "true".

This will prevent the field's values from showing up in CLI output and in Terraform Cloud. It will not encrypt or obscure the value in the state, however.

 

service modules:

All service modules should not have data terraform remote state references "terraform_remote_state." in data.tf, every specific data ref they use should be provided by the "front end services" except for anything "global", ie IAM.

 

AMIs/DR

To support DR, we should change references to AMIs from hard coded IDS to AWS filtered queries. This would allow 3rd party AMIs to work in a DR situation. But what to do about our AMIs (have snapshotted and re-encrypted to new region previously, may already be in place). Correct use of terraform/AWS tagging/labelling would help here.