How do I reduce config drift across Terraform modules?

To reduce config drift across Terraform modules, focus on standardization, reuse, and validation.

Practical approaches

1. Use a shared module library

   • Put common patterns into versioned reusable modules.
   • Avoid copy-pasting resource blocks across teams or environments.

2. Pin versions

   • Pin Terraform, provider, and module versions.
   • Use exact or constrained versions so changes are intentional.

3. Centralize defaults

   • Define common variables, tags, naming conventions, and provider settings in one place.
   • Pass them into modules rather than re-declaring them in each module.

4. Keep modules small and purpose-driven

   • Smaller modules are easier to keep consistent.
   • Compose them into higher-level stacks instead of duplicating logic.

5. Use locals for shared calculations

   • Put derived values in locals to avoid repeated logic across multiple resources.

6. Enforce standards with validation

   • Add validation rules for variables.
   • Use precondition / postcondition where helpful.
   • Run terraform validate in CI.

7. Automate formatting and linting

   • Use terraform fmt, tflint, and checkov/tfsec as appropriate.
   • Enforce in CI to prevent inconsistent patterns.

8. Document module contracts clearly

   • Specify required inputs, outputs, and assumptions.
   • Good module docs reduce ad hoc edits that create divergence.

9. Use a single source of truth for environment-specific values

   • Prefer generated or centralized config files for things like tags, account IDs, regions, and naming.
   • Avoid manually maintaining the same values in multiple places.

10. Review changes with drift in mind

• In code review, ask: “Is this duplicated elsewhere?”
• If yes, refactor into the shared module or common locals.

A useful pattern

• Base module: creates core infrastructure
• Wrapper module: adds environment-specific defaults
• Environment config: contains only differences

This keeps the module code stable while allowing controlled variation.

If you mean drift in deployed infrastructure

Terraform config drift also happens when someone changes infra outside Terraform. To reduce that:

• Restrict manual changes in cloud consoles
• Run periodic terraform plan against live state
• Use policy-as-code and audit trails
• Import unmanaged resources into Terraform when appropriate

If you want, I can show you a recommended Terraform repo structure for minimizing drift across modules.