Appearance

Infrastructure Concepts ​

Infrastructure code provisions real, stateful systems. A Terraform configuration is both a program and a record of what exists in a cloud account, and that dual nature drives most of the reasoning here. These concepts cover why we draw state boundaries where we do, how we decide what belongs in a shared module, and what it takes to keep a configuration and the infrastructure it describes in agreement.

Infrastructure Topics ​

Terraform State Boundaries ​

A root module owns one state file, and that file is the unit of locking, planning, and blast radius. This article explains what a boundary between root modules buys, what each cross-module dependency costs, and which differences justify drawing a new one.

You'll Learn:

  • Why top-level directories follow the provider's strongest isolation boundary
  • The three costs every terraform_remote_state dependency carries
  • The lifecycle differences that justify a separate root module, and the signs of low cohesion within one
  • How root module size drives plan and refresh time, and how that speed balances against coupling

Terraform Module Philosophy ​

Most public Terraform modules are poor abstractions. This article explains the two ways they fail, the point at which extracting a module becomes worthwhile, and the feedback loop that keeps our shared modules current.

You'll Learn:

  • Why swiss-army knife modules and thin wrappers both fail to abstract anything
  • The repetition threshold that signals a module is ready to extract
  • How forking a shared module and upstreaming the change evolves our collective opinion

Terraform Change Control ​

A Terraform apply changes real, stateful systems, and the workflow around it exists to keep exactly one writer in charge of any given resource. This article explains that property, the reasoning behind applying inside the pull request, and how drift erodes the configuration's standing as a record of what exists.

You'll Learn:

  • Why native state locking leaves a gap that pull request level locking fills
  • What a flaky apply is, and why the apply happens before the merge
  • Why automated drift detection is safe while automated reconciliation is dangerous
  • How the cost of provisioning real resources shapes our infrastructure test suite