Structuring Terraform at Scale: Modules, State & Drift Detection

The single biggest anti-pattern in Terraform adoption is the "monolithic state file". Storing VPCs, IAM roles, EKS clusters, and RDS databases in a single root module creates tight coupling, slow 20-minute plans, and massive blast radiuses.

Decoupled Hierarchy Pattern

Decompose infrastructure state across environments and functional boundaries:

infrastructure/
├── modules/
│   ├── vpc/
│   ├── eks/
│   └── rds/
└── environments/
    ├── staging/
    │   ├── 00-network/
    │   ├── 01-database/
    │   └── 02-compute/
    └── production/
        ├── 00-network/
        ├── 01-database/
        └── 02-compute/

Remote State Locking & Encryption

Always configure remote backends with DynamoDB locking and S3 bucket server-side encryption:

terraform {
  backend "s3" {
    bucket         = "prod-terraform-state-lock"
    key            = "compute/production.tfstate"
    region         = "us-east-1"
    dynamodb_table = "terraform-state-locks"
    encrypt        = true
  }
}

Continuous Drift Detection

Infrastructure drift occurs when manual console changes bypass code reviews. Schedule daily drift detection jobs using GitHub Actions with terraform plan -detailed-exitcode to trigger alerts whenever unmanaged state changes occur.