Terraform Style Guide

Generate and maintain Terraform code following HashiCorp's official style conventions and best practices.

Reference: HashiCorp Terraform Style Guide

Code Generation Strategy

When generating Terraform module code:

1. Start with version constraints and provider requirements in versions.tf
2. Create data sources before dependent resources
3. Build resources in dependency order with conditional creation (count or for_each)
4. Add outputs for key resource attributes, using try() for conditional resources
5. Use variables for all configurable values with secure defaults
6. Use this as the primary resource name for single instances
7. Prefer for_each over count for resource iteration (stable addresses)
8. Provider configuration belongs in examples/, NOT the root module

File Organization

Example Structure

hcl
1# versions.tf
2terraform {
3  required_version = ">= 1.7"
4
5  required_providers {
6    aws = {
7      source  = "hashicorp/aws"
8      version = ">= 5.0"
9    }
10  }
11}
12
13# variables.tf
14variable "environment" {
15  description = "Target deployment environment"
16  type        = string
17
18  validation {
19    condition     = contains(["dev", "staging", "prod"], var.environment)
20    error_message = "Environment must be dev, staging, or prod."
21  }
22}
23
24# locals.tf
25locals {
26  common_tags = {
27    Environment = var.environment
28    ManagedBy   = "Terraform"
29  }
30}
31
32# main.tf
33resource "aws_vpc" "main" {
34  cidr_block           = var.vpc_cidr
35  enable_dns_hostnames = true
36
37  tags = merge(local.common_tags, {
38    Name = "${var.project_name}-${var.environment}-vpc"
39  })
40}
41
42# outputs.tf
43output "vpc_id" {
44  description = "ID of the created VPC"
45  value       = aws_vpc.main.id
46}

Code Formatting

Block Organization

Arguments precede blocks, with meta-arguments first:

hcl
1resource "aws_instance" "example" {
2  # Meta-arguments
3  count = 3
4
5  # Arguments
6  ami           = "ami-0c55b159cbfafe1f0"
7  instance_type = "t2.micro"
8
9  # Blocks
10  root_block_device {
11    volume_size = 20
12  }
13
14  # Lifecycle last
15  lifecycle {
16    create_before_destroy = true
17  }
18}

Every variable must include type and description:

hcl
1variable "instance_type" {
2  description = "EC2 instance type for the web server"
3  type        = string
4  default     = "t2.micro"
5
6  validation {
7    condition     = contains(["t2.micro", "t2.small", "t2.medium"], var.instance_type)
8    error_message = "Instance type must be t2.micro, t2.small, or t2.medium."
9  }
10}
11
12variable "database_password" {
13  description = "Password for the database admin user"
14  type        = string
15  sensitive   = true
16}

Outputs

Every output must include description:

hcl
1output "instance_id" {
2  description = "ID of the EC2 instance"
3  value       = aws_instance.web.id
4}
5
6output "database_password" {
7  description = "Database administrator password"
8  value       = aws_db_instance.main.password
9  sensitive   = true
10}

Dynamic Resource Creation

Prefer for_each over count

hcl
1# Bad - count for multiple resources
2resource "aws_instance" "web" {
3  count = var.instance_count
4  tags  = { Name = "web-${count.index}" }
5}
6
7# Good - for_each with named instances
8variable "instance_names" {
9  type    = set(string)
10  default = ["web-1", "web-2", "web-3"]
11}
12
13resource "aws_instance" "web" {
14  for_each = var.instance_names
15  tags     = { Name = each.key }
16}

count for Conditional Creation

hcl
1resource "aws_cloudwatch_metric_alarm" "cpu" {
2  count = var.enable_monitoring ? 1 : 0
3
4  alarm_name = "high-cpu-usage"
5  threshold  = 80
6}

Security Best Practices

Apply secure defaults per tf-security-baselines skill.

Version Pinning

hcl
1terraform {
2  required_version = ">= 1.7"
3
4  required_providers {
5    aws = {
6      source  = "hashicorp/aws"
7    }
8  }
9}

Code Review Checklist

• Code formatted with terraform fmt
• Configuration validated with terraform validate
• Files organized according to standard structure
• All variables have type and description
• All outputs have descriptions
• Resource names use descriptive nouns with underscores
• Version constraints pinned explicitly
• Sensitive values marked with sensitive = true
• No hardcoded credentials or secrets
• Security best practices applied

Based on: HashiCorp Terraform Style Guide