Infrastructure as Code and Automation Questions

Decision framework
I first determine whether Terraform should own the object. A resource should be imported only if the team wants Terraform to manage its lifecycle and we can make the current cloud object match code with low risk. If ownership is unclear or another team runs it, I leave it alone and document the boundary.

How I decide

• Import when the resource already exists, is needed long term, and its current settings are close enough to model in code.
• Recreate when the live object is too drifted, unsafe, or impossible to express cleanly, and downtime or cutover is acceptable.
• Leave alone when it is intentionally outside this stack, or the business risk of taking ownership is higher than the benefit.

Concrete example
Say an existing prod-logs bucket was created manually. If the app depends on it and the bucket policy, versioning, and encryption are acceptable, I would import it, then update the module so the code matches the real settings. If the bucket has years of data and a clean import is possible, import is safest. If the bucket name, policy, or region is wrong and fixing it in place would be risky, I would create a new bucket, migrate traffic or data, then delete the old one after validation.

What I check first
I compare state, config, and live attributes, then run a plan to see whether the desired change is truly just drift or a bigger ownership problem.

A plan that suddenly wants to recreate live resources usually means the state and reality are out of sync, or CI is looking at a different state than the workstation did. State is Terraform’s map of managed objects, so if it is stale or mismatched, Terraform may think a resource disappeared and needs to be rebuilt.

What I would check first

• Same backend, workspace, account, and region in CI and locally
• Whether the colleague applied to the same state file
• Whether resource addresses changed because of count, for_each, or renamed modules
• Whether the provider is now seeing drift in an immutable field

Debug path
I would run a refresh-only plan, inspect the current state, and compare it with the real cloud resources before touching production. If the issue is just an address change, I would prefer a moved block or state mv over deleting anything.

Example
If CI wants to recreate aws_instance.app[0] after a workstation apply, that may mean the list order changed or CI is pointing at old state. I would stop, find the mismatch, then fix state or code first.

I would put both human review and automation around the plan. A Terraform plan is a preview of create, update, destroy, and replace actions. Replace is especially risky because Terraform deletes and recreates a resource.

Guardrails

• Run terraform fmt -check and terraform validate in CI
• Save the plan as an artifact and require approval before apply
• Fail the pipeline if the plan includes unexpected destroys or replacements on critical resources
• Use policy checks for things like public exposure, open security groups, or deletion of databases
• Add prevent_destroy to the few resources that should almost never be removed

Example
If the plan shows aws_db_instance.main will be replaced because of an engine change, I would force manual review from an engineer and, ideally, a service owner. If the plan only adds an autoscaling instance, that can follow the normal path.

This catches surprises before users feel them, which is the real goal.

I would split the solution by responsibility, not by environment. A module should do one job well.

Module layout

• network: VPC, subnets, routes, NAT, and network tags
• compute: app instances, ECS or ASG, load balancer, security groups
• database: managed DB, subnet group, parameter group, DB security group
• root stack: wires the outputs together

Why this works
The network changes slowly, compute changes often, and the database has its own lifecycle and risk. Keeping them separate reduces blast radius and makes reviews easier.

Safe interface
I would expose only what callers need:

• From network: vpc_id, private_subnet_ids, public_subnet_ids
• From compute: alb_dns_name, app_sg_id
• From database: endpoint, port, and maybe a secret reference, not a password

Example
The root module can pass private_subnet_ids = ["subnet-101", "subnet-202"] into compute and database, while dev and prod use different sizes through variables. That keeps composition flexible without letting one team edit module internals.

I would separate shared logic from environment-specific entrypoints. Right now one large root module is forcing unrelated changes into the same file set, which creates merge conflicts and increases blast radius.

New structure

• modules/network
• modules/app
• modules/database
• envs/dev
• envs/staging
• envs/prod

Each environment folder has its own backend and only calls the modules it needs. Shared values like tags or account IDs can live in small local files or a common variable file.

Why this helps

• Two engineers can edit dev and prod in parallel with less conflict
• A change to app compute does not force a network review unless inputs change
• Cross-environment mistakes are harder because each root has its own state

Example
Dev can use t3.small and prod can use m6i.large, but both call the same modules/app. That gives consistency without a monolith. I would also keep module outputs explicit so one environment cannot accidentally consume another environment’s state.