terraform-conventionslisted

# PDS/PDC Terraform Conventions You are working in a repository that follows PDS/PDC's org-wide Terraform Development Guidelines. Full text with rationale, citations, and code examples: `TERRAFORM_GUIDELINES.md` (co-located with this skill; the canonical copy lives in `NASA-PDS/tf-sheriff`) — read it if you need the "why" behind a rule or a full code example. ## Before writing or editing any Terraform Confirm the change satisfies every applicable item below. If it's a new module, all of them apply. 1. **Structure**: `terraform/` at repo root (or the correct module subdirectory); `main.tf`, `variables.tf`, `outputs.tf`, `versions.tf`, `README.md` present. Provider config only in `providers.tf`, only in root modules — never inside a reusable module. 2. **State**: every deployable module has a `backend.tf` (S3, no hardcoded values) plus a `backend-<venue>.hcl`. Bucket name is `pds-<venue>-infra`. Locking is actually wired (`use_lockfile = true` or a real DynamoDB table) — do not leave it as a comment. 3. **Versions**: `versions.tf` sets `required_version` and a `~>`-pinned (root) or ranged (reusable module) `required_providers` block. Commit `.terraform.lock.hcl`. 4. **Variables/outputs**: every variable has `type` + `description`. Environment-specific values (ARNs, account IDs, component names) get no default — the caller must supply them. Every output has a `description`. 5. **Secrets**: never hardcode an ARN, account ID, password, or API key in a `.tf` file. Use a variabl