Skip to content

Terraform

Role in the Platform

Terraform manages selected observability configuration as code. The documented uses include InfoSec Keeper policies/AppRoles/backends, Splunk alerts, and supporting automation configuration. Shared environments run through Terraform Enterprise (TFE), which owns remote state and the reviewed plan/apply workflow.

Change Flow

sequenceDiagram
    participant Dev as Engineer
    participant Git as Terraform Repository
    participant TFE as Terraform Enterprise
    participant Target as Keeper / Splunk / Platform API

    Dev->>Git: Open pull request
    Git->>TFE: Queue speculative plan
    TFE-->>Git: Plan result
    Dev->>Git: Merge approved change
    Git->>TFE: Queue managed run
    TFE->>Target: Apply reviewed changes
    Target-->>TFE: Return resource state

Repository Pattern

Keeper automation uses a reusable Vault module with environment-specific WxCDI and WxCCE entry points. Splunk alert repositories use YAML alert definitions and reusable Terraform modules. Keep reusable logic in modules and environment-specific values at the composition layer.

repository/
├── modules/
│   └── <reusable-module>/
├── wxcdi/
├── wxcce/
├── providers.tf
├── versions.tf
└── README.md

The owning repository is authoritative; this layout is illustrative.

Development Workflow

Run safe local validation before opening a pull request:

terraform fmt -check -recursive
terraform init -backend=false
terraform validate

Use a TFE speculative plan to evaluate shared-environment changes. Review:

  • resources created, changed, replaced, or destroyed;
  • provider and module version changes;
  • output values marked sensitive where necessary;
  • workspace, namespace, and region selection;
  • policy checks and reviewer approvals;
  • the rollback or forward-fix plan.

Do not run a local terraform apply against shared infrastructure or create an independent local state for resources owned by TFE.

State and Secrets

TFE remote state is operationally sensitive even when values are marked sensitive in the UI. Do not place state files in Git, attach plans containing secrets to tickets, or expose token/AppRole values as non-sensitive outputs. Prefer short-lived credentials and approved Keeper/TFE variable integration.

Troubleshooting

Symptom Check
Authentication error Workspace credential age, namespace, and provider address
Resource not found Workspace/environment selection and backend path
Plan wants unexpected replacement Provider/module change, immutable field, and imported state
State lock Active or abandoned TFE run; do not force-unlock without owner review
Downstream service still uses old value Apply result, output handoff, consumer refresh/restart
Drift reappears Manual changes outside Terraform or another workspace managing the same resource

Internal References