[comprev]

Enforcement by means of CI is a fairly simple approach for many issues. Issues should have a minimum set of requirements including suitable testing. No colleague should approve a PR unless it ticks the necessary boxes.

Our CI does a check to see if Terraform was correctly formatted prior to push and will fail before any "init" / "plan" / "apply" step is reached.

[Raidion]

I'll ask because we're struggling with this now. What do you do to reduce the risk of an auto applied TF change going sideways? Our current workflow involves a manual review/approval by devOps.

[comprev]

Our teams all control their own infrastructure so there is very low risk of two pipelines trying to alter the same resources.

Step 1 plans, and outputs the changes to a local plan file.

Step 2 prompts for a human approval after viewing the above potential changes. Declining the approval simply ends the pipeline.

Step 3 applies step 1 using the plan file.

[Raidion]

Ok, human involved in the loop, thank you!

I also think there should never be more than one source of truth for TF, but I have seen two devs fight it out in the development environment. Each add their own SNS topic with similar names, get very weirded out by how it seems to magically change as the other dev applies and deletes the first one and replaces it!

[comprev]

Yes, the code is treated no differently from any other language. A human has to confirm changes which will impact others.

The key is to act quickly when presented with a plan. It's advised to decline stale pending approvals and kick off a new pipeline for freshness.

There's no magic unfortunately :(