21 Terraform Best Practices to Improve your TF workflow
· via Spacelift
Why this matters now: Terraform gives you multiple options and freedom, and this list collects the habits that keep repositories workable as teams grow. Spacelift keeps the article current, so it now runs from remote state basics through testing, policy as code and project structure to using AI assistants on Terraform code without handing them your secrets. Most of these habits only stick once a pipeline enforces them, whether that is Terraform in GitHub Actions or a fuller automation setup around plan and apply.
Three takeaways:
- Remote state with locking is the minimum setup. Put state in a versioned backend, treat it as immutable, never edit it by hand, and keep secrets in an external manager like Vault or AWS Secrets Manager instead of version control. Mark sensitive variables as sensitive and catch bad inputs early with validation blocks.
- Structure decisions compound. Small, reusable modules with pinned versions age better than one repository that does everything, and community modules from the registry beat hand-rolling your own for infrastructure that hundreds of teams have already built. Pin your providers and Terraform version too, so upgrades are deliberate.
- Enforcement beats convention. Run fmt, validate, tflint and static analysis like Checkov automatically in CI or pre-commit hooks, then add OPA policies on top so the rules hold without a reviewer catching every miss. Bring in Terratest once modules stabilize and plan output stops being enough.
What I’d add today: Since this blog was written, OpenTofu is out and gaining a lot of traction. There are many commonalities, but the two solutions have started to converge already. If I would start today, I would go for OpenTofu.
Who should read it: anyone writing Terraform beyond a sandbox, teams inheriting an estate that grew without rules, and reviewers who want a shared reference to point at instead of arguing style in every pull request. Once the list settles the style debates, the next question is which tool enforces it, and the Atlantis comparison is a fair place to start.