Terraform Code Conventions

terraform/
├── main.tf              # Module composition and orchestration
├── variables.tf         # Map-based variables (per environment)
├── config.auto.tfvars   # Actual value configuration
├── outputs.tf           # Output variables
├── backend.tf           # S3 + DynamoDB remote state
├── moved.tf             # State migration
└── modules/
    ├── shared/          # Created once (VPC, ALB, IAM, SG)
    ├── environment/     # Per environment (EC2, RDS, Redis, S3, DNS)
    ├── message/         # Push notifications (SQS, SNS, Lambda)
    ├── pdf_processing/  # PDF processing (Step Functions, Lambda)
    └── batch_processing/ # Batch processing (SQS, Lambda)

# CORRECT: Map for per-environment settings
variable "instance_types" {
  type = map(string)
  default = {
    "production"  = "t4g.medium"
    "staging"     = "t4g.small"
    "development" = "t4g.small"
  }
}

# WRONG: Separate variables per environment
variable "production_instance_type" { ... }
variable "staging_instance_type" { ... }

# CORRECT: Safe access with lookup
deeplink_subdomain = lookup(var.deeplink_config, "production", null) != null ? var.deeplink_config["production"]["subdomain"] : ""

# WRONG: Direct access (errors if key is missing)
deeplink_subdomain = var.deeplink_config["production"]["subdomain"]

# Environment activation
locals {
  is_production_enabled  = var.enable_production_server
  is_staging_enabled     = var.enable_staging_server
  is_development_enabled = var.enable_development_server
}

# Module count condition
module "production_env" {
  count = local.is_production_enabled ? 1 : 0
  # ...
}

# Service + environment combination condition
module "message_production" {
  count = var.enable_push_notifications && local.is_production_enabled ? 1 : 0
  # ...
}

# CORRECT: Production has no prefix, others have suffix
name = local.is_production ? "console" : "console-${local.env_short_suffix}"

# env_short_suffix: "stg" or "dev"

# Reference Lambda ZIP within module
locals {
  lambda_base_path = "${path.module}/../../../lambda/python"
  router_zip_path  = "${local.lambda_base_path}/pdf_router/build/pdf-router.zip"
}

# CORRECT: Guard with fileexists()
locals {
  zip_exists = fileexists(local.zip_path)
}

resource "aws_lambda_function" "example" {
  count            = local.zip_exists ? 1 : 0
  source_code_hash = local.zip_exists ? filebase64sha256(local.zip_path) : null
}

# WRONG: Direct call without guard (plan fails if file missing)
resource "aws_lambda_function" "example" {
  source_code_hash = filebase64sha256(local.zip_path)
}

backend "s3" {
  bucket         = "kobic-tfstate-bucket"
  key            = "terraform.tfstate"
  region         = "ap-northeast-2"
  dynamodb_table = "kobic-tfstate-lock"
  encrypt        = true
}

# List workspaces
terraform workspace list

# Switch workspace
terraform workspace select production

tags = {
  Project     = var.project_name
  Environment = var.environment
  ManagedBy   = "terraform"
}