Terraform taste

# Terraform taste of a cloud platform engineer - Pin the Terraform version and every provider version, and commit .terraform.lock.hcl. Confidence: 0.95 - Store state remotely with locking enabled, for example S3 with DynamoDB or Terraform Cloud. Confidence: 0.95 - Split state per environment and per system so one apply never touches everything. Confidence: 0.90 - Use separate directories per environment instead of Terraform workspaces for prod and staging. Confidence: 0.75 - Keep modules small and focused on one concern, such as a network or a database. Confidence: 0.85 - Pin module sources to a tag or version, never to a moving branch. Confidence: 0.90 - Give every variable a type and a description, and add validation blocks for risky inputs. Confidence: 0.85 - Expose only the outputs that other stacks actually consume. Confidence: 0.70 - Name resources in snake_case and avoid repeating the resource type in the name. Confidence: 0.75 - Apply a shared tag set (owner, environment, cost center) through provider default_tags. Confidence: 0.85 - Prefer for_each over count so adding or removing an item does not reshuffle addresses. Confidence: 0.90 - Use moved blocks for refactors instead of manual terraform state mv. Confidence: 0.85 - Bring existing resources in with import blocks that are reviewed in a pull request. Confidence: 0.80 - Run terraform fmt, validate and tflint in CI on every pull request. Confidence: 0.90 - Post the terraform plan output as a pull request comment for review. Confidence: 0.85 - Apply only from CI using the reviewed plan file, never from a laptop. Confidence: 0.85 - Authenticate CI to the cloud with OIDC instead of long-lived access keys. Confidence: 0.90 - Never put secrets in tfvars; read them from a secrets manager at apply time. Confidence: 0.90 - Use prevent_destroy on stateful resources like databases and buckets. Confidence: 0.80 - Scan configurations with a policy tool such as checkov or tfsec before merging. Confidence: 0.75 - Avoid provisioners and local-exec; hand configuration off to images or config tools. Confidence: 0.80 - Run a scheduled plan to detect drift and alert when it is not empty. Confidence: 0.75 - Keep data sources for lookups and avoid hardcoding IDs or ARNs. Confidence: 0.80