terraform-conventionslisted

# Terraform Conventions Applies to any `*.tf` file. Primary location is the project's IaC directory (commonly `infra/terraform/` — confirm in `CLAUDE.md`). These are code conventions; for the operational discipline (state, plan/apply gates, drift, imports) see the `iac-terraform` skill, and for service-level resource detail see the active `cloud-architecture-<cloud>` pack. ## Security - Use the latest stable Terraform + provider versions; patch regularly. Pin versions and commit `.terraform.lock.hcl`. - **Secrets never in state files, variables, or version control.** Store them in the cloud's secret manager (AWS Secrets Manager / SSM, Azure Key Vault, GCP Secret Manager) and reference them via data sources or environment variables. Rotate; automate rotation where possible. - Mark any sensitive variable/output `sensitive = true`. - Least-privilege IAM/roles. Restrict network access with the cloud's native controls (security groups + NACLs, NSGs, firewall rules). - Resources in private subnets/networks by default; public only for load balancers / NAT / similar entry points. - Encryption at rest (disks, object storage, managed databases) and in transit (TLS). - Scan with `trivy`, `tfsec`, or `checkov` in CI. ## Modularity - Separate state/projects for major components — reduces blast radius, speeds up plan/apply. - Modules for groups of related resources only. Don't wrap a single resource in a module. - Avoid deep nesting and circular dependencies. - Expose in