Provisioning AWS Infrastructure with Terraform

This is a placeholder post — replace it with your own write-up.

Provisioning cloud infrastructure by hand doesn't scale past a handful of resources. Terraform's declarative model — describe the desired state, let the tool figure out the diff — is what makes it possible to manage a real surface area (API Gateway, WAF, EventBridge, DynamoDB, Aurora, Lambda, ECS/Fargate, CloudWatch) without losing track of what's actually deployed.

State is the source of truth

Terraform state is the thing that actually matters day to day — not the .tf files themselves. Remote state (S3 + DynamoDB locking, or Terraform Cloud) with locking is non-negotiable the moment more than one person — or one CI pipeline — touches the same infrastructure.

Environments as modules, not copy-paste

Dev, UAT, and Production should be the same module invoked with different variables, not three divergent copies of the same .tf files. Divergence is where "it worked in UAT" surprises come from.

CI/CD for infrastructure changes

Running terraform plan in CI on every pull request, and gating apply behind a review of that plan's output, catches most accidental-deletion incidents before they happen — the diff is right there in the PR.

More to come as I write this up properly.