Terraform Best Practices

Terraform is an Infrastructure as Code (IaC) tool that defines and provisions infrastructure through declarative configuration files. Files.com uses Terraform to manage infrastructure consistently and predictably, and this guide covers the practices that keep those deployments reliable.

Maintain Terraform as the Single Source of Truth

Terraform works best when it is the only tool managing a given resource. Complete knowledge of current state is what lets Terraform plan and apply changes accurately.

Mixing Terraform with other provisioning tools on the same resources causes drift. For example, using Terraform to manage user accounts while also running SCIM against the same accounts produces discrepancies — Terraform does not see changes made outside its state, so a later apply may overwrite or delete them.

Designate Terraform as the sole manager of any resource it touches. To bring an existing resource under management, use terraform import to add it to the state file.

Preserve Current State Before Making Changes

Capture the current state before any change. This gives you a known-good configuration to roll back to.

Use terraform state pull to export the state and store it securely. The exported state is the reference point for troubleshooting and rollback.

Use Child Sites for Development and Testing

Run development and testing in environments that mirror production, not in production itself. Files.com child sites are built for this. Apply changes to a child site first and validate the effects before touching the production site.

Apply Incremental Changes and Test Each One

Make changes in small steps. Modify the exported state or configuration files for the next change, apply to the child site, and verify the behavior. Repeat until the full change set is validated.

Incremental application makes problems easy to isolate. A large multi-resource change that fails leaves you guessing which piece broke; a sequence of single-purpose changes points directly at the cause.

Apply Changes to Production

Once validated in the child site, the change is ready for production. Before applying:

• Commit all changes to version control.
• Update the production environment's state.
• Review the plan with terraform plan.

Additional Best Practices

Version Control and Collaboration

Store Terraform configurations in a version control system like Git. Version control supports change tracking, rollback, and code review. Reviewed changes catch problems before apply and spread knowledge of the configuration across the team.

Use Remote State Storage

Configure remote state storage so the state file is shared, locked during apply, and versioned. Remote backends like AWS S3, Azure Blob Storage, and Terraform Cloud provide state locking and versioning, which prevents concurrent-apply conflicts and lost state.

Modularize Your Configuration

Break configurations into reusable modules with clear input variables and outputs. Modules promote reuse, simplify maintenance, and keep individual files readable.

Secure Sensitive Data

Never hardcode API keys, passwords, or other secrets in Terraform files. Inject sensitive values at runtime through environment variables or a secret manager like HashiCorp Vault.

Validate and Format Code

Run terraform validate to check syntax and internal consistency. Run terraform fmt to apply standard formatting, which keeps diffs small and configurations readable.

More Information

For more information on using Terraform with Files.com, refer to our Terraform documentation.