Initial commit

skills/assets/templates/MODULE_TEMPLATE.md

@@ -0,0 +1,386 @@
+# Terraform Module Template
+
+This directory contains templates for creating well-structured Terraform modules.
+
+## Module Structure
+
+```
+module-name/
+├── main.tf           # Primary resource definitions
+├── variables.tf      # Input variables
+├── outputs.tf        # Output values
+├── versions.tf       # Version constraints
+├── README.md         # Module documentation
+└── examples/         # Usage examples
+    └── complete/
+        ├── main.tf
+        ├── variables.tf
+        └── outputs.tf
+```
+
+## Template Files
+
+### main.tf
+```hcl
+# Main resource definitions
+terraform {
+  # No backend configuration in modules
+}
+
+# Example: VPC Module
+resource "aws_vpc" "main" {
+  cidr_block           = var.vpc_cidr
+  enable_dns_hostnames = var.enable_dns_hostnames
+  enable_dns_support   = var.enable_dns_support
+  
+  tags = merge(
+    var.tags,
+    {
+      Name = var.name
+    }
+  )
+}
+
+# Use locals for computed values
+locals {
+  availability_zones = slice(data.aws_availability_zones.available.names, 0, var.az_count)
+}
+```
+
+### variables.tf
+```hcl
+variable "name" {
+  description = "Name to be used on all resources as prefix"
+  type        = string
+}
+
+variable "vpc_cidr" {
+  description = "CIDR block for VPC"
+  type        = string
+  
+  validation {
+    condition     = can(cidrhost(var.vpc_cidr, 0))
+    error_message = "Must be a valid IPv4 CIDR block."
+  }
+}
+
+variable "enable_dns_hostnames" {
+  description = "Enable DNS hostnames in the VPC"
+  type        = bool
+  default     = true
+}
+
+variable "tags" {
+  description = "A map of tags to add to all resources"
+  type        = map(string)
+  default     = {}
+}
+
+# For sensitive values
+variable "database_password" {
+  description = "Master password for the database"
+  type        = string
+  sensitive   = true
+}
+
+# With validation
+variable "environment" {
+  description = "Environment name"
+  type        = string
+  
+  validation {
+    condition     = contains(["dev", "staging", "prod"], var.environment)
+    error_message = "Environment must be one of: dev, staging, prod."
+  }
+}
+
+# Complex types
+variable "subnets" {
+  description = "Map of subnet configurations"
+  type = map(object({
+    cidr_block        = string
+    availability_zone = string
+    public            = bool
+  }))
+  default = {}
+}
+```
+
+### outputs.tf
+```hcl
+output "vpc_id" {
+  description = "The ID of the VPC"
+  value       = aws_vpc.main.id
+}
+
+output "vpc_cidr" {
+  description = "The CIDR block of the VPC"
+  value       = aws_vpc.main.cidr_block
+}
+
+output "private_subnet_ids" {
+  description = "List of IDs of private subnets"
+  value       = aws_subnet.private[*].id
+}
+
+# Sensitive outputs
+output "database_endpoint" {
+  description = "Database connection endpoint"
+  value       = aws_db_instance.main.endpoint
+  sensitive   = true
+}
+
+# Complex outputs
+output "subnet_details" {
+  description = "Detailed information about all subnets"
+  value = {
+    for subnet in aws_subnet.main :
+    subnet.id => {
+      cidr_block        = subnet.cidr_block
+      availability_zone = subnet.availability_zone
+      public            = subnet.map_public_ip_on_launch
+    }
+  }
+}
+```
+
+### versions.tf
+```hcl
+terraform {
+  required_version = ">= 1.3.0"
+  
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 5.0.0"
+    }
+  }
+}
+```
+
+### README.md Template
+```markdown
+# Module Name
+
+Brief description of what this module does.
+
+## Usage
+
+\`\`\`hcl
+module "example" {
+  source = "./modules/module-name"
+  
+  name             = "my-resource"
+  vpc_cidr         = "10.0.0.0/16"
+  environment      = "prod"
+  
+  tags = {
+    Environment = "prod"
+    Project     = "example"
+  }
+}
+\`\`\`
+
+## Examples
+
+- [Complete](./examples/complete) - Full example with all options
+
+## Requirements
+
+| Name | Version |
+|------|---------|
+| terraform | >= 1.3.0 |
+| aws | >= 5.0.0 |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| name | Resource name | `string` | n/a | yes |
+| vpc_cidr | VPC CIDR block | `string` | n/a | yes |
+| environment | Environment name | `string` | n/a | yes |
+| tags | Common tags | `map(string)` | `{}` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| vpc_id | VPC identifier |
+| private_subnet_ids | List of private subnet IDs |
+
+## Authors
+
+Module is maintained by [Your Team].
+
+## License
+
+Apache 2 Licensed. See LICENSE for full details.
+\`\`\`
+
+## Example: Complete Usage Example
+
+### examples/complete/main.tf
+```hcl
+module "vpc" {
+  source = "../../"
+  
+  name                 = "example-vpc"
+  vpc_cidr            = "10.0.0.0/16"
+  environment         = "dev"
+  enable_dns_hostnames = true
+  
+  tags = {
+    Environment = "dev"
+    Project     = "example"
+    ManagedBy   = "Terraform"
+  }
+}
+```
+
+### examples/complete/outputs.tf
+```hcl
+output "vpc_id" {
+  description = "The ID of the VPC"
+  value       = module.vpc.vpc_id
+}
+```
+
+### examples/complete/variables.tf
+```hcl
+variable "region" {
+  description = "AWS region"
+  type        = string
+  default     = "us-east-1"
+}
+```
+
+## Terragrunt Configuration Template
+
+### terragrunt.hcl (root)
+```hcl
+# Root terragrunt.hcl
+locals {
+  # Load account-level variables
+  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
+  
+  # Load region-level variables  
+  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))
+  
+  # Load environment variables
+  environment_vars = read_terragrunt_config(find_in_parent_folders("env.hcl"))
+  
+  # Extract commonly used variables
+  account_name = local.account_vars.locals.account_name
+  account_id   = local.account_vars.locals.account_id
+  aws_region   = local.region_vars.locals.aws_region
+  environment  = local.environment_vars.locals.environment
+}
+
+# Generate provider configuration
+generate "provider" {
+  path      = "provider.tf"
+  if_exists = "overwrite_terragrunt"
+  contents  = <<EOF
+provider "aws" {
+  region = "${local.aws_region}"
+  
+  assume_role {
+    role_arn = "arn:aws:iam::${local.account_id}:role/TerraformRole"
+  }
+  
+  default_tags {
+    tags = {
+      Environment = "${local.environment}"
+      ManagedBy   = "Terragrunt"
+      Account     = "${local.account_name}"
+    }
+  }
+}
+EOF
+}
+
+# Configure S3 backend
+remote_state {
+  backend = "s3"
+  
+  generate = {
+    path      = "backend.tf"
+    if_exists = "overwrite_terragrunt"
+  }
+  
+  config = {
+    bucket         = "${local.account_name}-terraform-state"
+    key            = "${path_relative_to_include()}/terraform.tfstate"
+    region         = local.aws_region
+    encrypt        = true
+    dynamodb_table = "${local.account_name}-terraform-lock"
+    
+    s3_bucket_tags = {
+      Name        = "Terraform State"
+      Environment = local.environment
+    }
+    
+    dynamodb_table_tags = {
+      Name        = "Terraform Lock"
+      Environment = local.environment
+    }
+  }
+}
+
+# Global inputs for all modules
+inputs = {
+  account_name = local.account_name
+  account_id   = local.account_id
+  aws_region   = local.aws_region
+  environment  = local.environment
+}
+```
+
+### terragrunt.hcl (module level)
+```hcl
+# Include root configuration
+include "root" {
+  path = find_in_parent_folders()
+}
+
+# Define terraform source
+terraform {
+  source = "git::https://github.com/company/terraform-modules.git//vpc?ref=v1.0.0"
+}
+
+# Dependencies on other modules
+dependency "iam" {
+  config_path = "../iam"
+  
+  mock_outputs = {
+    role_arn = "arn:aws:iam::123456789012:role/mock"
+  }
+  mock_outputs_allowed_terraform_commands = ["validate", "plan"]
+}
+
+# Module-specific inputs
+inputs = {
+  name     = "my-vpc"
+  vpc_cidr = "10.0.0.0/16"
+  
+  # Use dependency outputs
+  iam_role_arn = dependency.iam.outputs.role_arn
+  
+  # Module-specific tags
+  tags = {
+    Component = "networking"
+    Module    = "vpc"
+  }
+}
+```
+
+## Best Practices
+
+1. **Always include descriptions** for variables and outputs
+2. **Use validation blocks** for important variables
+3. **Mark sensitive values** as sensitive
+4. **Provide sensible defaults** where appropriate
+5. **Document everything** in README
+6. **Include usage examples** in examples/ directory
+7. **Version your modules** using Git tags
+8. **Test modules** before tagging new versions

skills/assets/workflows/github-actions-terraform.yml

@@ -0,0 +1,224 @@
+name: Terraform CI/CD
+
+on:
+  pull_request:
+    branches: [main, master]
+    paths:
+      - '**.tf'
+      - '**.tfvars'
+      - '.github/workflows/terraform.yml'
+  push:
+    branches: [main, master]
+    paths:
+      - '**.tf'
+      - '**.tfvars'
+  workflow_dispatch:
+
+env:
+  TF_VERSION: '1.5.0'
+  TF_WORKING_DIR: '.'  # Change to your terraform directory
+
+permissions:
+  contents: read
+  pull-requests: write
+  id-token: write  # Required for OIDC
+
+jobs:
+  validate:
+    name: Validate
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: ${{ env.TF_VERSION }}
+
+      - name: Terraform Format Check
+        id: fmt
+        run: terraform fmt -check -recursive
+        working-directory: ${{ env.TF_WORKING_DIR }}
+        continue-on-error: true
+
+      - name: Terraform Init
+        id: init
+        run: terraform init -backend=false
+        working-directory: ${{ env.TF_WORKING_DIR }}
+
+      - name: Terraform Validate
+        id: validate
+        run: terraform validate -no-color
+        working-directory: ${{ env.TF_WORKING_DIR }}
+
+      - name: Comment PR - Validation Results
+        if: github.event_name == 'pull_request'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const output = `#### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\`
+            #### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`
+            #### Terraform Validation 🤖\`${{ steps.validate.outcome }}\`
+
+            *Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`, Working Directory: \`${{ env.TF_WORKING_DIR }}\`, Workflow: \`${{ github.workflow }}\`*`;
+
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: output
+            })
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup TFLint
+        uses: terraform-linters/setup-tflint@v4
+
+      - name: Init TFLint
+        run: tflint --init
+
+      - name: Run TFLint
+        run: tflint -f compact
+        working-directory: ${{ env.TF_WORKING_DIR }}
+
+  security:
+    name: Security Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run Checkov
+        uses: bridgecrewio/checkov-action@master
+        with:
+          directory: ${{ env.TF_WORKING_DIR }}
+          framework: terraform
+          output_format: sarif
+          output_file_path: reports/checkov.sarif
+          soft_fail: true  # Don't fail the build, just report
+
+      - name: Upload Checkov Results
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: reports/checkov.sarif
+
+  plan:
+    name: Plan
+    runs-on: ubuntu-latest
+    needs: [validate, lint]
+    if: github.event_name == 'pull_request'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure AWS Credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          aws-region: us-east-1
+
+      # Alternative: Use access keys (not recommended)
+      # - name: Configure AWS Credentials
+      #   uses: aws-actions/configure-aws-credentials@v4
+      #   with:
+      #     aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      #     aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      #     aws-region: us-east-1
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: ${{ env.TF_VERSION }}
+
+      - name: Terraform Init
+        run: terraform init
+        working-directory: ${{ env.TF_WORKING_DIR }}
+
+      - name: Terraform Plan
+        id: plan
+        run: |
+          terraform plan -no-color -out=tfplan
+          terraform show -no-color tfplan > plan_output.txt
+        working-directory: ${{ env.TF_WORKING_DIR }}
+
+      - name: Comment PR - Plan
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const plan = fs.readFileSync('${{ env.TF_WORKING_DIR }}/plan_output.txt', 'utf8');
+            const maxLength = 65000;
+            const truncatedPlan = plan.length > maxLength ? plan.substring(0, maxLength) + '\n... (truncated)' : plan;
+
+            const output = `#### Terraform Plan 📖
+            <details><summary>Show Plan</summary>
+
+            \`\`\`terraform
+            ${truncatedPlan}
+            \`\`\`
+
+            </details>
+
+            *Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`, Working Directory: \`${{ env.TF_WORKING_DIR }}\`*`;
+
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: output
+            })
+
+      - name: Upload Plan
+        uses: actions/upload-artifact@v4
+        with:
+          name: tfplan
+          path: ${{ env.TF_WORKING_DIR }}/tfplan
+          retention-days: 5
+
+  apply:
+    name: Apply
+    runs-on: ubuntu-latest
+    needs: [validate, lint, security]
+    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')
+    environment: production  # Requires approval in GitHub settings
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure AWS Credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          aws-region: us-east-1
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: ${{ env.TF_VERSION }}
+
+      - name: Terraform Init
+        run: terraform init
+        working-directory: ${{ env.TF_WORKING_DIR }}
+
+      - name: Terraform Apply
+        run: terraform apply -auto-approve
+        working-directory: ${{ env.TF_WORKING_DIR }}
+
+      - name: Notify Success
+        if: success()
+        run: |
+          echo "✅ Terraform apply completed successfully"
+          # Add notification logic here (Slack, email, etc.)
+
+      - name: Notify Failure
+        if: failure()
+        run: |
+          echo "❌ Terraform apply failed"
+          # Add notification logic here (Slack, email, etc.)

skills/assets/workflows/github-actions-terragrunt.yml

@@ -0,0 +1,236 @@
+name: Terragrunt CI/CD
+
+on:
+  pull_request:
+    branches: [main, master]
+    paths:
+      - '**.tf'
+      - '**.hcl'
+      - '**.tfvars'
+  push:
+    branches: [main, master]
+    paths:
+      - '**.tf'
+      - '**.hcl'
+      - '**.tfvars'
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: 'Environment to deploy'
+        required: true
+        type: choice
+        options:
+          - dev
+          - staging
+          - prod
+      action:
+        description: 'Action to perform'
+        required: true
+        type: choice
+        options:
+          - plan
+          - apply
+          - destroy
+
+env:
+  TF_VERSION: '1.5.0'
+  TG_VERSION: '0.55.0'
+  WORKING_DIR: 'environments'  # Base directory for environments
+
+permissions:
+  contents: read
+  pull-requests: write
+  id-token: write
+
+jobs:
+  detect-changes:
+    name: Detect Changed Modules
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+      has-changes: ${{ steps.set-matrix.outputs.has-changes }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Get Changed Files
+        id: changed-files
+        uses: tj-actions/changed-files@v42
+        with:
+          files: |
+            **/*.tf
+            **/*.hcl
+            **/*.tfvars
+
+      - name: Set Matrix
+        id: set-matrix
+        run: |
+          # Find all directories with terragrunt.hcl that have changes
+          changed_dirs=$(echo "${{ steps.changed-files.outputs.all_changed_files }}" | tr ' ' '\n' | xargs -I {} dirname {} | grep -E "environments/(dev|staging|prod)" | sort -u | jq -R -s -c 'split("\n")[:-1]')
+
+          if [ "$changed_dirs" = "[]" ]; then
+            echo "has-changes=false" >> $GITHUB_OUTPUT
+          else
+            echo "has-changes=true" >> $GITHUB_OUTPUT
+            echo "matrix={\"directory\":$changed_dirs}" >> $GITHUB_OUTPUT
+          fi
+
+  validate:
+    name: Validate
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: ${{ env.TF_VERSION }}
+          terraform_wrapper: false
+
+      - name: Setup Terragrunt
+        run: |
+          wget -q https://github.com/gruntwork-io/terragrunt/releases/download/v${{ env.TG_VERSION }}/terragrunt_linux_amd64
+          chmod +x terragrunt_linux_amd64
+          sudo mv terragrunt_linux_amd64 /usr/local/bin/terragrunt
+          terragrunt --version
+
+      - name: Terragrunt Format Check
+        run: terragrunt hclfmt --terragrunt-check
+        working-directory: ${{ env.WORKING_DIR }}
+        continue-on-error: true
+
+      - name: Terragrunt Validate All
+        run: terragrunt run-all validate --terragrunt-non-interactive
+        working-directory: ${{ env.WORKING_DIR }}
+
+  plan:
+    name: Plan - ${{ matrix.directory }}
+    runs-on: ubuntu-latest
+    needs: [detect-changes, validate]
+    if: needs.detect-changes.outputs.has-changes == 'true'
+    strategy:
+      matrix: ${{ fromJson(needs.detect-changes.outputs.matrix) }}
+      fail-fast: false
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: ${{ env.TF_VERSION }}
+          terraform_wrapper: false
+
+      - name: Setup Terragrunt
+        run: |
+          wget -q https://github.com/gruntwork-io/terragrunt/releases/download/v${{ env.TG_VERSION }}/terragrunt_linux_amd64
+          chmod +x terragrunt_linux_amd64
+          sudo mv terragrunt_linux_amd64 /usr/local/bin/terragrunt
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          aws-region: us-east-1
+
+      - name: Terragrunt Plan
+        id: plan
+        run: |
+          terragrunt run-all plan --terragrunt-non-interactive -out=tfplan 2>&1 | tee plan_output.txt
+        working-directory: ${{ matrix.directory }}
+        continue-on-error: true
+
+      - name: Upload Plan Output
+        uses: actions/upload-artifact@v4
+        with:
+          name: plan-${{ hashFiles(matrix.directory) }}
+          path: ${{ matrix.directory }}/plan_output.txt
+          retention-days: 5
+
+      - name: Comment PR
+        if: github.event_name == 'pull_request'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const planPath = '${{ matrix.directory }}/plan_output.txt';
+            let plan = 'Plan output not available';
+
+            try {
+              plan = fs.readFileSync(planPath, 'utf8');
+              const maxLength = 65000;
+              plan = plan.length > maxLength ? plan.substring(0, maxLength) + '\n... (truncated)' : plan;
+            } catch (error) {
+              plan = 'Error reading plan output: ' + error.message;
+            }
+
+            const output = `#### Terragrunt Plan for \`${{ matrix.directory }}\`
+            <details><summary>Show Plan</summary>
+
+            \`\`\`terraform
+            ${plan}
+            \`\`\`
+
+            </details>
+
+            *Workflow: ${{ github.workflow }}, Actor: @${{ github.actor }}*`;
+
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: output
+            });
+
+  apply:
+    name: Apply - ${{ matrix.directory }}
+    runs-on: ubuntu-latest
+    needs: [detect-changes]
+    if: |
+      (github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')) ||
+      (github.event_name == 'workflow_dispatch' && github.event.inputs.action == 'apply')
+    strategy:
+      matrix:
+        directory: ${{ github.event_name == 'workflow_dispatch' && fromJson(format('["environments/{0}"]', github.event.inputs.environment)) || fromJson(needs.detect-changes.outputs.matrix).directory }}
+      fail-fast: false
+      max-parallel: 1  # Apply one at a time
+    environment:
+      name: production  # Configure approval in GitHub settings
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: ${{ env.TF_VERSION }}
+          terraform_wrapper: false
+
+      - name: Setup Terragrunt
+        run: |
+          wget -q https://github.com/gruntwork-io/terragrunt/releases/download/v${{ env.TG_VERSION }}/terragrunt_linux_amd64
+          chmod +x terragrunt_linux_amd64
+          sudo mv terragrunt_linux_amd64 /usr/local/bin/terragrunt
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          aws-region: us-east-1
+
+      - name: Terragrunt Apply
+        run: |
+          terragrunt run-all apply --terragrunt-non-interactive -auto-approve
+        working-directory: ${{ matrix.directory }}
+
+      - name: Notify Success
+        if: success()
+        run: echo "✅ Terragrunt apply completed for ${{ matrix.directory }}"
+
+      - name: Notify Failure
+        if: failure()
+        run: echo "❌ Terragrunt apply failed for ${{ matrix.directory }}"

skills/assets/workflows/gitlab-ci-terraform.yml

@@ -0,0 +1,184 @@
+# GitLab CI/CD Pipeline for Terraform
+
+variables:
+  TF_VERSION: "1.5.0"
+  TF_ROOT: ${CI_PROJECT_DIR}  # Change to your terraform directory
+  TF_STATE_NAME: default
+
+image:
+  name: hashicorp/terraform:$TF_VERSION
+  entrypoint: [""]
+
+cache:
+  key: "$CI_COMMIT_REF_SLUG"
+  paths:
+    - ${TF_ROOT}/.terraform
+
+before_script:
+  - cd ${TF_ROOT}
+  - terraform --version
+
+stages:
+  - validate
+  - lint
+  - security
+  - plan
+  - apply
+
+# Validate Terraform configuration
+validate:
+  stage: validate
+  script:
+    - terraform fmt -check -recursive
+    - terraform init -backend=false
+    - terraform validate
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+
+# Lint with tflint
+tflint:
+  stage: lint
+  image:
+    name: ghcr.io/terraform-linters/tflint:latest
+    entrypoint: [""]
+  script:
+    - cd ${TF_ROOT}
+    - tflint --init
+    - tflint -f compact
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+
+# Security scan with Checkov
+checkov:
+  stage: security
+  image:
+    name: bridgecrew/checkov:latest
+    entrypoint: [""]
+  script:
+    - checkov -d ${TF_ROOT} --framework terraform --output cli --soft-fail
+  allow_failure: true
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+
+# Plan Terraform changes
+plan:
+  stage: plan
+  script:
+    - terraform init
+    - terraform plan -out=tfplan
+    - terraform show -no-color tfplan > plan_output.txt
+  artifacts:
+    name: plan
+    paths:
+      - ${TF_ROOT}/tfplan
+      - ${TF_ROOT}/plan_output.txt
+    reports:
+      terraform: ${TF_ROOT}/tfplan
+    expire_in: 7 days
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+      when: manual
+
+# Apply Terraform changes (manual trigger for production)
+apply:
+  stage: apply
+  script:
+    - terraform init
+    - terraform apply -auto-approve
+  dependencies:
+    - plan
+  rules:
+    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+      when: manual
+  environment:
+    name: production
+    action: start
+
+# Destroy infrastructure (manual trigger, protected)
+destroy:
+  stage: apply
+  script:
+    - terraform init
+    - terraform destroy -auto-approve
+  rules:
+    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+      when: manual
+  environment:
+    name: production
+    action: stop
+
+# ========================================
+# Multi-Environment Example
+# ========================================
+# Uncomment and customize for multiple environments
+
+# .plan_template: &plan_template
+#   stage: plan
+#   script:
+#     - terraform init
+#     - terraform workspace select ${TF_WORKSPACE} || terraform workspace new ${TF_WORKSPACE}
+#     - terraform plan -out=tfplan -var-file=environments/${TF_WORKSPACE}.tfvars
+#   artifacts:
+#     paths:
+#       - ${TF_ROOT}/tfplan
+#     expire_in: 7 days
+
+# .apply_template: &apply_template
+#   stage: apply
+#   script:
+#     - terraform init
+#     - terraform workspace select ${TF_WORKSPACE}
+#     - terraform apply -auto-approve tfplan
+#   when: manual
+
+# plan:dev:
+#   <<: *plan_template
+#   variables:
+#     TF_WORKSPACE: dev
+#   rules:
+#     - if: '$CI_COMMIT_BRANCH == "develop"'
+
+# apply:dev:
+#   <<: *apply_template
+#   variables:
+#     TF_WORKSPACE: dev
+#   rules:
+#     - if: '$CI_COMMIT_BRANCH == "develop"'
+#   environment:
+#     name: dev
+
+# plan:staging:
+#   <<: *plan_template
+#   variables:
+#     TF_WORKSPACE: staging
+#   rules:
+#     - if: '$CI_COMMIT_BRANCH == "staging"'
+
+# apply:staging:
+#   <<: *apply_template
+#   variables:
+#     TF_WORKSPACE: staging
+#   rules:
+#     - if: '$CI_COMMIT_BRANCH == "staging"'
+#   environment:
+#     name: staging
+
+# plan:prod:
+#   <<: *plan_template
+#   variables:
+#     TF_WORKSPACE: prod
+#   rules:
+#     - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+
+# apply:prod:
+#   <<: *apply_template
+#   variables:
+#     TF_WORKSPACE: prod
+#   rules:
+#     - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+#   environment:
+#     name: production