Home › Terraform › Terraform Copilot instructions

Terraform Copilot instructions

Copilot instructions for Terraform 1.x / OpenTofu infrastructure: modules, state safety, variables, and plan review.

GitHub CopilotTerraform

Copy copilot-instructions.md

How to use

Save this as .github/copilot-instructions.md in your repository root, commit it, and your agent will pick it up automatically. Edit the commands to match your project.

# Terraform / OpenTofu instructions

## Commands
- `terraform fmt -recursive` · `terraform init -backend=false && terraform validate` · `tflint` · `checkov -d .` or `trivy config .` if configured.
- Only run `terraform plan` when credentials are present. Never run `apply`, `destroy`, `state rm`, `import` or `taint` unless the user explicitly asks.

## Layout
- `modules/<name>/` with `main.tf`, `variables.tf`, `outputs.tf`, `versions.tf`, `README.md`.
- `envs/<env>/` root modules call shared modules; no copy-pasted resources across envs.
- Pin `required_version` and provider versions with `~>` in `versions.tf`; commit `.terraform.lock.hcl`.

## Code rules
- Every variable has `type` and `description`; add `validation` blocks for constrained values. Mark secrets `sensitive = true`.
- Use `for_each` with maps over `count` for collections that can change, so resources aren't recreated on reorder.
- Name resources by role (`aws_s3_bucket.uploads`), not `this`/`main`, except in single-resource modules.
- Tag everything via provider `default_tags` (or the cloud's equivalent).
- Data sources instead of hard-coded IDs/ARNs.
- Encryption, private access and least-privilege IAM by default; no `0.0.0.0/0` ingress or `*` actions without a comment explaining why.
- Renaming a resource requires a `moved {}` block so state isn't destroyed.

## In PRs
Summarize the plan: resources added, changed, and especially destroyed or replaced.