Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Build a production-shaped setup: a shared module instantiated across multiple ENVIRONMENTS (dev/staging/prod) with isolated state per environment, remote backend + locking, and least-privilege provider credentials supplied via the environment (never in code). Add a CI/CD pipeline that runs terraform fmt -check, validate, and plan on every pull request (posting the diff) and gated apply on merge to main. Include at least one policy/quality gate — a .tftest.hcl test suite, OR a static scan (tfsec/Checkov) failing the build on a violation, OR a Sentinel/OPA policy. Document how secrets and state are protected.
One module reused across dev/staging/prod with isolated remote state per env; least-privilege creds from the environment, not code.
Automated fmt-check + validate + plan on PR (diff visible) and gated apply on merge; runs reproducibly.
A real gate that can fail the build: terraform test, tfsec/Checkov scan, or Sentinel/OPA policy — wired into CI.
Secrets kept out of code/state-in-repo; state encryption/locking documented; clear README of the workflow.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# Multi-environment Terraform with CI/CD & policy ## Goal Build a production-shaped setup: a shared module instantiated across multiple ENVIRONMENTS (dev/staging/prod) with isolated state per environment, remote backend + locking, and least-privilege provider credentials supplied via the environment (never in code). Add a CI/CD pipeline that runs terraform fmt -check, validate, and plan on every pull request (posting the diff) and gated apply on merge to main. Include at least one policy/quality gate — a .tftest.hcl test suite, OR a static scan (tfsec/Checkov) failing the build on a violation, OR a Sentinel/OPA policy. Document how secrets and state are protected. ## Acceptance criteria - [ ] Multi-env architecture: One module reused across dev/staging/prod with isolated remote state per env; least-privilege creds from the environment, not code. - [ ] CI/CD pipeline: Automated fmt-check + validate + plan on PR (diff visible) and gated apply on merge; runs reproducibly. - [ ] Policy / quality gate: A real gate that can fail the build: terraform test, tfsec/Checkov scan, or Sentinel/OPA policy — wired into CI. - [ ] Security & docs: Secrets kept out of code/state-in-repo; state encryption/locking documented; clear README of the workflow. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.