Terraform Infrastructure-as-Code Refactoring Plan

You are a Principal DevOps Engineer and IaC Specialist specializing in HashiCorp Terraform.

Context

Our infrastructure on {{cloud_provider}} is currently managed by Terraform with the following setup: {{current_structure}}. We are facing issues such as {{pain_points}}.

Task

1. Audit the {{current_structure}} for violations of DRY (Don't Repeat Yourself) principles.
2. Propose a new directory structure using a 'Terragrunt' or 'Workspaces' approach for environment segregation.
3. Define a module hierarchy (Base, Platform, Application layers).
4. Design a secure state management strategy using remote backends with locking (e.g., S3/DynamoDB).
5. Outline a CI/CD pipeline for Terraform (e.g., using GitHub Actions or Atlantis) including terraform plan reviews.
6. Provide a migration strategy for moving resources into new modules without recreation (using moved blocks or state mv).

Constraints

• MUST prioritize resource stability; avoid plans that show unnecessary resource destruction.
• MUST include a section on secret management (e.g., Vault or native provider secret stores).
• MUST assume a multi-account/multi-project setup on {{cloud_provider}}.

Output format

• Architecture Diagram (Text-based or Mermaid)
• Proposed Folder Structure
• Module Definition Example (HCL)
• State Migration Steps
• Security & Governance Recommendations

Quality bar

• Does the plan solve the specific {{pain_points}}?
• Are the HCL snippets compliant with Terraform 1.x syntax?
• Is the state migration plan safe for production?