- Pin everything. Providers, modules, and Terraform itself. A surprise minor version is how plans change under you.
- Plan on every PR, apply on merge. The plan output is the review — screenshots of it belong in the PR.
- Lock remote state. DynamoDB locking or your backend's equivalent. Two applies at once is a corruption story.
- Small blast radius per workspace. If one apply can touch the network, the database, and DNS, split it.
- Import, don't recreate. ClickOps resources get imported with moved blocks and a test plan — never rebuilt live.
Takeaway: boring Terraform — pinned, planned, locked, and small — is the most reliable infrastructure you will ever run.
