Terraform Style Guide

by hashicorpf706481af9b8No license890 starsListed Oct 8, 2026Updated Oct 8, 2026Repository updated 3 days ago

Generate Terraform HCL code following HashiCorp's official style conventions and best practices. Use when writing, reviewing, or generating Terraform configurations.

Instructions onlyDevOps & Cloud

AI-generated overview

Generates and reviews Terraform HCL code following HashiCorp's official style conventions and best practices.

What it does: Provides a structured guide for writing and reviewing Terraform configurations, covering file organization, formatting, naming conventions, variables, outputs, dynamic resource creation, version pinning, provider configuration, and version control. It includes code examples and a code review checklist. It also points to a separate security document for encryption and sensitive-data guidance.
When to use it: Use when writing, reviewing, or generating Terraform configurations and you want them to follow HashiCorp's official style conventions. Also useful for checking an existing configuration against a standard review checklist.
Requirements: No scripts or packages are required; it is instructions only. Following the validation steps it recommends assumes Terraform CLI is installed, and optionally tflint, checkov, or tfsec.

Terraform Style Guide

Generate and maintain Terraform code following HashiCorp's official style conventions and best practices.

Reference: HashiCorp Terraform Style Guide

Code Generation Strategy

When generating Terraform code:

Start with provider configuration and version constraints
Create data sources before dependent resources
Build resources in dependency order
Add outputs for key resource attributes
Use variables for all configurable values

File Organization

File	Purpose
`terraform.tf`	Terraform and provider version requirements
`providers.tf`	Provider configurations
`main.tf`	Primary resources and data sources
`variables.tf`	Input variable declarations (alphabetical)
`outputs.tf`	Output value declarations (alphabetical)
`locals.tf`	Local value declarations

Example Structure

hcl

# terraform.tfterraform {  required_version = ">= 1.14"
  required_providers {    aws = {      source  = "hashicorp/aws"      version = "~> 6.0"    }  }}
# variables.tfvariable "environment" {  description = "Target deployment environment"  type        = string
  validation {    condition     = contains(["dev", "staging", "prod"], var.environment)    error_message = "Environment must be dev, staging, or prod."  }}
# locals.tflocals {  common_tags = {    Environment = var.environment    ManagedBy   = "Terraform"  }}
# main.tfresource "aws_vpc" "main" {  cidr_block           = var.vpc_cidr  enable_dns_hostnames = true
  tags = merge(local.common_tags, {    Name = "${var.project_name}-${var.environment}-vpc"  })}
# outputs.tfoutput "vpc_id" {  description = "ID of the created VPC"  value       = aws_vpc.main.id}

# terraform.tfterraform {  required_version = ">= 1.14"
  required_providers {    aws = {      source  = "hashicorp/aws"      version = "~> 6.0"    }  }}
# variables.tfvariable "environment" {  description = "Target deployment environment"  type        = string
  validation {    condition     = contains(["dev", "staging", "prod"], var.environment)    error_message = "Environment must be dev, staging, or prod."  }}
# locals.tflocals {  common_tags = {    Environment = var.environment    ManagedBy   = "Terraform"  }}
# main.tfresource "aws_vpc" "main" {  cidr_block           = var.vpc_cidr  enable_dns_hostnames = true
  tags = merge(local.common_tags, {    Name = "${var.project_name}-${var.environment}-vpc"  })}
# outputs.tfoutput "vpc_id" {  description = "ID of the created VPC"  value       = aws_vpc.main.id}

Code Formatting

Indentation and Alignment

Use two spaces per nesting level (no tabs)
Align equals signs for consecutive arguments

hcl

resource "aws_instance" "web" {  ami           = "ami-0c55b159cbfafe1f0"  instance_type = "t2.micro"  subnet_id     = "subnet-12345678"
  tags = {    Name        = "web-server"    Environment = "production"  }}

resource "aws_instance" "web" {  ami           = "ami-0c55b159cbfafe1f0"  instance_type = "t2.micro"  subnet_id     = "subnet-12345678"
  tags = {    Name        = "web-server"    Environment = "production"  }}

Block Organization

Arguments precede blocks, with meta-arguments first:

hcl

resource "aws_instance" "example" {  # Meta-arguments  count = 3
  # Arguments  ami           = "ami-0c55b159cbfafe1f0"  instance_type = "t2.micro"
  # Blocks  root_block_device {    volume_size = 20  }
  # Lifecycle last  lifecycle {    create_before_destroy = true  }}

resource "aws_instance" "example" {  # Meta-arguments  count = 3
  # Arguments  ami           = "ami-0c55b159cbfafe1f0"  instance_type = "t2.micro"
  # Blocks  root_block_device {    volume_size = 20  }
  # Lifecycle last  lifecycle {    create_before_destroy = true  }}

Naming Conventions

Use lowercase with underscores for all names
Use descriptive nouns excluding the resource type
Be specific and meaningful
Resource names must be singular, not plural
Default to main for resources where a specific descriptive name is redundant or unavailable, provided only one instance exists

hcl

# Badresource "aws_instance" "webAPI-aws-instance" {}resource "aws_instance" "web_apis" {}variable "name" {}
# Goodresource "aws_instance" "web_api" {}resource "aws_vpc" "main" {}variable "application_name" {}

# Badresource "aws_instance" "webAPI-aws-instance" {}resource "aws_instance" "web_apis" {}variable "name" {}
# Goodresource "aws_instance" "web_api" {}resource "aws_vpc" "main" {}variable "application_name" {}

Variables

Every variable must include type and description:

hcl

variable "instance_type" {  description = "EC2 instance type for the web server"  type        = string  default     = "t2.micro"
  validation {    condition     = contains(["t2.micro", "t2.small", "t2.medium"], var.instance_type)    error_message = "Instance type must be t2.micro, t2.small, or t2.medium."  }}
variable "database_password" {  description = "Password for the database admin user"  type        = string  sensitive   = true}

variable "instance_type" {  description = "EC2 instance type for the web server"  type        = string  default     = "t2.micro"
  validation {    condition     = contains(["t2.micro", "t2.small", "t2.medium"], var.instance_type)    error_message = "Instance type must be t2.micro, t2.small, or t2.medium."  }}
variable "database_password" {  description = "Password for the database admin user"  type        = string  sensitive   = true}

Outputs

Every output must include description:

hcl

output "instance_id" {  description = "ID of the EC2 instance"  value       = aws_instance.web.id}
output "database_password" {  description = "Database administrator password"  value       = aws_db_instance.main.password  sensitive   = true}

output "instance_id" {  description = "ID of the EC2 instance"  value       = aws_instance.web.id}
output "database_password" {  description = "Database administrator password"  value       = aws_db_instance.main.password  sensitive   = true}

Dynamic Resource Creation

Prefer for_each over count

hcl

# Bad - count for multiple resourcesresource "aws_instance" "web" {  count = var.instance_count  tags  = { Name = "web-${count.index}" }}
# Good - for_each with named instancesvariable "instance_names" {  type    = set(string)  default = ["web-1", "web-2", "web-3"]}
resource "aws_instance" "web" {  for_each = var.instance_names  tags     = { Name = each.key }}

# Bad - count for multiple resourcesresource "aws_instance" "web" {  count = var.instance_count  tags  = { Name = "web-${count.index}" }}
# Good - for_each with named instancesvariable "instance_names" {  type    = set(string)  default = ["web-1", "web-2", "web-3"]}
resource "aws_instance" "web" {  for_each = var.instance_names  tags     = { Name = each.key }}

count for Conditional Creation

hcl

resource "aws_cloudwatch_metric_alarm" "cpu" {  count = var.enable_monitoring ? 1 : 0
  alarm_name = "high-cpu-usage"  threshold  = 80}

resource "aws_cloudwatch_metric_alarm" "cpu" {  count = var.enable_monitoring ? 1 : 0
  alarm_name = "high-cpu-usage"  threshold  = 80}

Security Best Practices

Refer to SECURITY.md. It includes guidance on encrypting resources, preventing sensitive data in state, and secure configurations.

Version Pinning

hcl

terraform {  required_version = ">= 1.14"
  required_providers {    aws = {      source  = "hashicorp/aws"      version = "~> 6.0"    }  }}

terraform {  required_version = ">= 1.14"
  required_providers {    aws = {      source  = "hashicorp/aws"      version = "~> 6.0"    }  }}

Use the latest major version of each provider and the latest minor version of Terraform, unless otherwise constrained by a dependency lock file or by other modules used by the configuration.

Version constraint operators:

= 1.0.0 - Exact version
>= 1.0.0 - Greater than or equal
~> 1.0 - Allow rightmost component to increment
>= 1.0, < 2.0 - Version range

Provider Configuration

hcl

provider "aws" {  region = "us-west-2"
  default_tags {    tags = {      ManagedBy = "Terraform"      Project   = var.project_name    }  }}
# Aliased provider for multi-regionprovider "aws" {  alias  = "east"  region = "us-east-1"}

provider "aws" {  region = "us-west-2"
  default_tags {    tags = {      ManagedBy = "Terraform"      Project   = var.project_name    }  }}
# Aliased provider for multi-regionprovider "aws" {  alias  = "east"  region = "us-east-1"}

Version Control

Never commit:

terraform.tfstate, terraform.tfstate.backup
.terraform/ directory
*.tfplan
.tfvars files with sensitive data

Always commit:

All .tf configuration files
.terraform.lock.hcl (dependency lock file)

Validation Tools

Run before committing:

Additional tools:

tflint - Linting and best practices
checkov / tfsec - Security scanning

Code Review Checklist

Based on: HashiCorp Terraform Style Guide

Source and attribution

Source:hashicorp/agent-skillsinplugins/terraform/skills/terraform-style-guideat commitf706481

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

More from hashicorp/agent-skills

Terraform Test

hashicorp

Guides writing and running Terraform tests with .tftest.hcl files, run blocks, assertions, mocks and CI integration.

Software Development890updated 3 days ago

Terraform Stacks

hashicorp

Guides writing and validating HashiCorp Terraform Stacks configuration files for multi-environment infrastructure.

DevOps & Cloud890updated 3 days ago

Terraform Policy

hashicorp

Writes, tests and converts Terraform Policy files (.policy.hcl, .policytest.hcl) and Sentinel policies.

Software Development890updated 3 days ago

Refactor Module

hashicorp

Guides refactoring monolithic Terraform configurations into reusable, maintainable modules with migration and tests.

Software Development890updated 3 days ago

Provider Resources

hashicorp

Implement Terraform Provider resources and data sources using the Plugin Framework: CRUD operations, schema design, plan modifiers and validators, not-found handling, waiters for eventually consistent APIs, import support, resource design principles, and required acceptance test coverage. Use when adding or changing a resource or data source, deciding whether an API concept should be a resource, wiring a resource to the provider's configured client, handling drift or resource-not-found, or reviewing a resource implementation before submission.

Awaiting classification890updated 3 days ago

Provider Framework Migration

hashicorp

Guides migrating Terraform provider resources from Plugin SDKv2 to the Plugin Framework using a muxed provider.

Software Development890updated 3 days ago

Terraform Style Guide

Terraform Style Guide

Code Generation Strategy

File Organization

Example Structure

Code Formatting

Indentation and Alignment

Block Organization

Naming Conventions

Variables

Outputs

Dynamic Resource Creation

Prefer for_each over count

count for Conditional Creation

Security Best Practices

Version Pinning

Provider Configuration

Version Control

Validation Tools

Code Review Checklist

Source and attribution

More from hashicorp/agent-skills

Terraform Test

Terraform Stacks

Terraform Policy

Refactor Module

Provider Resources

Provider Framework Migration

More in DevOps & Cloud

Playwright Devops

M5 Onboard

Yeet

Runbook

Incident Response

Deploy Checklist