01 / DECISION
When this primitive earns a place
Use Terraform for repeatable desired state and the API for bounded automation that cannot be expressed safely in the provider.
02 / ARCHITECTURE
Build the smallest defensible path
Create scoped tokens, separate accounts and environments, import existing resources, review every plan, serialize applies, and protect remote state.
- 01Name the contract
Use Terraform for repeatable desired state and the API for bounded automation that cannot be expressed safely in the provider.
- 02Add one primitive
Create scoped tokens, separate accounts and environments, import existing resources, review every plan, serialize applies, and protect remote state.
- 03Capture failure evidence
Run format and validation, inspect a no-op plan, detect intentional drift, test denied permissions, and document state recovery.
03 / REPRODUCE
Evidence before confidence
Run format and validation, inspect a no-op plan, detect intentional drift, test denied permissions, and document state recovery.
terraform fmt -check && terraform validate && terraform plan04 / BOUNDARY
The production boundary
Automation can amplify mistakes. Never expose account-wide tokens, auto-apply unknown plans, or let two control planes fight over one resource.
05 / FIRST-PARTY SOURCES
Keep first-party sources authoritative
Product behavior, limits, pricing, and availability can change. Re-check these sources before acting.