Terraform
Role in the Platform
Terraform manages selected observability configuration as code. The documented uses include InfoSec Keeper policies/AppRoles/backends, Splunk alerts, and supporting automation configuration. Shared environments run through Terraform Enterprise (TFE), which owns remote state and the reviewed plan/apply workflow.
Change Flow
sequenceDiagram
participant Dev as Engineer
participant Git as Terraform Repository
participant TFE as Terraform Enterprise
participant Target as Keeper / Splunk / Platform API
Dev->>Git: Open pull request
Git->>TFE: Queue speculative plan
TFE-->>Git: Plan result
Dev->>Git: Merge approved change
Git->>TFE: Queue managed run
TFE->>Target: Apply reviewed changes
Target-->>TFE: Return resource state
Repository Pattern
Keeper automation uses a reusable Vault module with environment-specific WxCDI and WxCCE entry points. Splunk alert repositories use YAML alert definitions and reusable Terraform modules. Keep reusable logic in modules and environment-specific values at the composition layer.
repository/
├── modules/
│ └── <reusable-module>/
├── wxcdi/
├── wxcce/
├── providers.tf
├── versions.tf
└── README.md
The owning repository is authoritative; this layout is illustrative.
Development Workflow
Run safe local validation before opening a pull request:
terraform fmt -check -recursive
terraform init -backend=false
terraform validate
Use a TFE speculative plan to evaluate shared-environment changes. Review:
- resources created, changed, replaced, or destroyed;
- provider and module version changes;
- output values marked sensitive where necessary;
- workspace, namespace, and region selection;
- policy checks and reviewer approvals;
- the rollback or forward-fix plan.
Do not run a local terraform apply against shared infrastructure or create an independent local state for resources owned by TFE.
State and Secrets
TFE remote state is operationally sensitive even when values are marked sensitive in the UI. Do not place state files in Git, attach plans containing secrets to tickets, or expose token/AppRole values as non-sensitive outputs. Prefer short-lived credentials and approved Keeper/TFE variable integration.
Troubleshooting
| Symptom | Check |
|---|---|
| Authentication error | Workspace credential age, namespace, and provider address |
| Resource not found | Workspace/environment selection and backend path |
| Plan wants unexpected replacement | Provider/module change, immutable field, and imported state |
| State lock | Active or abandoned TFE run; do not force-unlock without owner review |
| Downstream service still uses old value | Apply result, output handoff, consumer refresh/restart |
| Drift reappears | Manual changes outside Terraform or another workspace managing the same resource |