# AWS Terraform command checklist (July 2026)

Companion to the public cheat sheet. Run in order for production applies.

## Pre-apply

- [ ] `terraform fmt -check -recursive`
- [ ] `terraform init -upgrade=false` (or pin provider upgrades in a separate PR)
- [ ] `terraform validate`
- [ ] `terraform plan -out=tfplan` (never bare apply on shared state)
- [ ] Review plan for **destroy** / **replace** on stateful AWS resources (RDS, S3, KMS)

## State / lock

- [ ] S3 backend with encryption + `use_lockfile = true` (Terraform 1.10+) **or** documented DynamoDB lock migration path
- [ ] No local state for shared environments
- [ ] `terraform providers lock` committed for CI platforms you actually run

## Prefer over deprecated

| Avoid                                      | Use                                         |
| ------------------------------------------ | ------------------------------------------- |
| `terraform taint`                          | `terraform apply -replace="…"`              |
| CLI-only `terraform import` for fleet work | `import {}` blocks + `-generate-config-out` |
| Blind `terraform destroy` in prod          | `terraform apply -destroy` with saved plan  |

## After apply

- [ ] Tag / cost allocation still match `default_tags`
- [ ] Drift check scheduled (`-refresh-only` or pipeline equivalent)
- [ ] Plan artifact archived with PR / change ticket