Day 13/90: Terraform workspaces

90 Day Security Infrastructure Challenge

I am writing this one as if a teammate opened the pull request and asked what actually matters. My answer is that keeping Terraform honest when the state file, provider behavior, and module boundaries are all capable of hiding drift. Good infrastructure content should make the operational boundary visible, not bury it behind screenshots or one happy-path command.

The Default Workspace Footgun

The practical reason to spend time on the default workspace footgun is simple: it is one of the places where infrastructure drift hides behind a clean-looking diff. Keeping terraform honest when the state file, provider behavior, and module boundaries are all capable of hiding drift.

The repo earns trust when terraform plan output, remote state configuration, provider aliases, variables, outputs, and CI checks wired into the repo tell the same story as the PR summary.…