Terraform-Azure

# Azure Terraform Best Practices

Integration and Self-Containment

This instruction set extends the universal DevOps Core Principles and Taming Copilot directives for Azure/Terraform scenarios. It assumes those foundational rules are loaded but includes summaries here for self-containment. If the general rules are not present, these summaries serve as defaults to maintain behavioral consistency.

Incorporated DevOps Core Principles (CALMS Framework)

- **Culture**: Foster collaborative, blameless culture with shared responsibility and continuous learning.

- **Automation**: Automate everything possible across the software delivery lifecycle to reduce manual effort and errors.

- **Lean**: Eliminate waste, maximize flow, and deliver value continuously by reducing batch sizes and bottlenecks.

- **Measurement**: Measure everything relevant (e.g., DORA metrics: Deployment Frequency, Lead Time for Changes, Change Failure Rate, Mean Time to Recovery) to drive improvement.

- **Sharing**: Promote knowledge sharing, collaboration, and transparency across teams.

Incorporated Taming Copilot Directives (Behavioral Hierarchy)

- **Primacy of User Directives**: Direct user commands take highest priority.

- **Factual Verification**: Prioritize tools for current, factual answers over internal knowledge.

- **Adherence to Philosophy**: Follow minimalist, surgical approaches—code on request only, minimal necessary changes, direct and concise responses.

- **Tool Usage**: Use tools purposefully; declare intent before action; prefer parallel calls when possible.

These summaries ensure the mode functions independently while aligning with the broader chat mode context. For full details, reference the original DevOps Core Principles and Taming Copilot instructions.

Chat Mode Integration

When operating in chat mode with these instructions loaded:

- Treat this as a self-contained extension that incorporates summarized general rules for independent operation.

- Prioritize user directives over automated actions, especially for terraform commands beyond validate.

- Use implicit dependencies where possible and confirm before any terraform plan or apply operations.

- Maintain minimalist responses and surgical code changes, aligning with the incorporated Taming philosophy.

- **Planning Files Awareness**: Always check for planning files in the `.terraform-planning-files/` folder (if present). Read and incorporate relevant details from these files into responses, especially for migration or implementation plans. If speckit or similar planning files exist in user-specified folders, prompt the user to confirm inclusion or read them explicitly.

1. Overview

These instructions provide Azure-specific guidance for solutions created Terraform, including how to incorporate and use Azure Verified Modules.

For general Terraform conventions, see [terraform.instructions.md](terraform.instructions.md).

For development of modules, especially Azure Verified Modules, see [azure-verified-modules-terraform.instructions.md](azure-verified-modules-terraform.instructions.md).

2. Anti-Patterns to Avoid

**Configuration:**

- MUST NOT hardcode values that should be parameterized

- SHOULD NOT use `terraform import` as a regular workflow pattern

- SHOULD avoid complex conditional logic that makes code hard to understand

- MUST NOT use `local-exec` provisioners unless absolutely necessary

**Security:**

- MUST NEVER store secrets in Terraform files or state

- MUST avoid overly permissive IAM roles or network rules

- MUST NOT disable security features for convenience

- MUST NOT use default passwords or keys

**Operational:**

- MUST NOT apply Terraform changes directly to production without testing

- MUST avoid making manual changes to Terraform-managed resources

- MUST NOT ignore Terraform state file corruption or inconsistencies

- MUST NOT run Terraform from local machines for production

- MUST only use a Terraform state file (`**/*.tfstate`) for read only