Terraform & OpenTofu Cursor Rules (.mdc) | Cloud Infrastructure as Code

# Dangerous: Hardcoded secret, no version lock, unmanaged state
resource "aws_db_instance" "bad_db" {
  engine   = "postgres"
  password = "plaintextpassword123" # Leaked credentials in git!
}

terraform {
  required_version = ">= 1.7.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.40"
    }
  }
  backend "s3" {
    bucket         = "corp-tf-state-prod"
    key            = "vpc/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "terraform-locks"
    encrypt        = true
  }
}

resource "aws_db_instance" "primary" {
  identifier          = "app-db-prod"
  allocated_storage   = 50
  engine              = "postgres"
  instance_class      = "db.r6g.large"
  password            = var.db_password
  skip_final_snapshot = false
  
  lifecycle {
    prevent_destroy = true
  }
}