# Increase parallelism for faster operations (default is 10)
terraform apply -parallelism=50

# Decrease for rate-limited APIs or resource constraints
terraform apply -parallelism=5

# Set permanently in environment
export TF_CLI_ARGS_apply="-parallelism=20"
export TF_CLI_ARGS_plan="-parallelism=20"

# Apply changes to specific modules only
terraform apply -target="module.networking"
terraform apply -target="module.database"

# Use with refresh to update specific resources
terraform apply -target="aws_instance.web" -refresh-only

# Plan specific resource types
terraform plan -target="aws_security_group.web"

# Remove unused resources from state
terraform state list | grep "old_resource" | xargs terraform state rm

# Split large state files
terraform state mv aws_instance.web module.web.aws_instance.server

# Use state replacement for problematic resources
terraform apply -replace="aws_instance.problematic"

# Layer dependencies using remote state
data "terraform_remote_state" "foundation" {
  backend = "s3"
  config = {
    bucket = "company-terraform-state"
    key    = "01-foundation/terraform.tfstate"
    region = "us-west-2"
  }
}

data "terraform_remote_state" "security" {
  backend = "s3"
  config = {
    bucket = "company-terraform-state"
    key    = "02-security/terraform.tfstate"
    region = "us-west-2"
  }
}

# Use outputs from other layers
resource "aws_instance" "app" {
  subnet_id              = data.terraform_remote_state.foundation.outputs.private_subnet_ids[0]
  vpc_security_group_ids = [data.terraform_remote_state.security.outputs.app_security_group_id]
  
  # other configuration...
}

# Configure multiple providers
provider "aws" {
  region = "us-west-2"
  alias  = "primary"
}

provider "aws" {
  region = "eu-west-1"
  alias  = "europe"
}

provider "google" {
  project = "my-project"
  region  = "us-central1"
}

provider "azurerm" {
  features {}
}

# Use providers in resources
resource "aws_instance" "primary" {
  provider = aws.primary
  
  ami           = "ami-12345678"
  instance_type = "t3.micro"
}

resource "aws_instance" "europe" {
  provider = aws.europe
  
  ami           = "ami-87654321"
  instance_type = "t3.micro"
}

resource "google_compute_instance" "gcp" {
  name         = "gcp-instance"
  machine_type = "e2-micro"
  zone         = "us-central1-a"
  
  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-11"
    }
  }
}

# AWS VPC
resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
  
  tags = {
    Name = "aws-vpc"
  }
}

# Google VPC
resource "google_compute_network" "main" {
  name                    = "gcp-vpc"
  auto_create_subnetworks = false
}

# VPN connection between clouds
resource "aws_vpn_gateway" "main" {
  vpc_id = aws_vpc.main.id
  
  tags = {
    Name = "aws-vpn-gateway"
  }
}

resource "google_compute_vpn_gateway" "main" {
  name    = "gcp-vpn-gateway"
  network = google_compute_network.main.id
}

# VPN tunnel configuration
resource "aws_vpn_connection" "main" {
  vpn_gateway_id      = aws_vpn_gateway.main.id
  customer_gateway_id = aws_customer_gateway.main.id
  type               = "ipsec.1"
  static_routes_only = true
}

# sentinel.hcl
policy "require-tags" {
  source = "./policies/require-tags.sentinel"
  enforcement_level = "hard-mandatory"
}

policy "restrict-instance-types" {
  source = "./policies/restrict-instance-types.sentinel"
  enforcement_level = "soft-mandatory"
}

policy "cost-estimation" {
  source = "./policies/cost-estimation.sentinel"
  enforcement_level = "advisory"
}

# policies/require-tags.sentinel
import "tfplan/v2" as tfplan

required_tags = ["Environment", "Owner", "Project", "CostCenter"]

main = rule {
  all tfplan.resource_changes as _, resource_changes {
    all resource_changes as _, rc {
      rc.type is "aws_instance" implies
        all required_tags as tag {
          rc.change.after.tags contains tag
        }
    }
  }
}

# Cost allocation tags
locals {
  cost_tags = {
    CostCenter  = var.cost_center
    Project     = var.project_name
    Environment = var.environment
    Team        = var.team_name
  }
}

# Apply cost tags to all resources
resource "aws_instance" "web" {
  ami           = "ami-12345678"
  instance_type = var.instance_type
  
  tags = merge(local.cost_tags, {
    Name = "web-server"
    Role = "webserver"
  })
}

# Budget alerts
resource "aws_budgets_budget" "team_budget" {
  name         = "${var.team_name}-monthly-budget"
  budget_type  = "COST"
  limit_amount = var.monthly_budget_limit
  limit_unit   = "USD"
  time_unit    = "MONTHLY"
  
  cost_filters = {
    Tag = ["Team:${var.team_name}"]
  }
  
  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                 = 80
    threshold_type            = "PERCENTAGE"
    notification_type         = "ACTUAL"
    subscriber_email_addresses = [var.team_email]
  }
}

#!/bin/bash
# Script to migrate resources between state files

# Export resources from source state
terraform state pull > source-state.json

# Remove resources from source
terraform state rm aws_instance.web
terraform state rm aws_security_group.web

# Import into destination state
cd ../destination-config
terraform import aws_instance.web i-1234567890abcdef0
terraform import aws_security_group.web sg-12345678

# Verify migration
terraform plan  # Should show no changes

resource "aws_s3_bucket_replication_configuration" "state_replication" {
  role   = aws_iam_role.replication.arn
  bucket = aws_s3_bucket.terraform_state.id
  
  rule {
    id     = "replicate_all"
    status = "Enabled"
    
    destination {
      bucket        = "arn:aws:s3:::terraform-state-replica"
      storage_class = "STANDARD_IA"
      
      encryption_configuration {
        replica_kms_key_id = aws_kms_key.replica.arn
      }
    }
  }
}

name: Infrastructure Testing
on:
  pull_request:
    paths: ['infrastructure/**']

jobs:
  test-matrix:
    strategy:
      matrix:
        environment: [development, staging]
        layer: [foundation, security, compute, applications]
    
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.6.0
      
      - name: Test Layer
        run: |
          cd infrastructure/${{ matrix.environment }}/${{ matrix.layer }}
          terraform init -backend=false
          terraform validate
          terraform plan -out=tfplan
          
      - name: Cost Estimation
        uses: infracost/infracost-gh-action@master
        with:
          path: infrastructure/${{ matrix.environment }}/${{ matrix.layer }}

#!/usr/bin/env python3
# Script to discover and import existing AWS resources

import boto3
import subprocess
import json

def discover_ec2_instances():
    ec2 = boto3.client('ec2')
    instances = ec2.describe_instances()
    
    for reservation in instances['Reservations']:
        for instance in reservation['Instances']:
            instance_id = instance['InstanceId']
            name_tag = next((tag['Value'] for tag in instance.get('Tags', []) 
                           if tag['Key'] == 'Name'), instance_id)
            
            # Generate Terraform import command
            resource_name = f"aws_instance.{name_tag.replace('-', '_')}"
            import_cmd = f"terraform import {resource_name} {instance_id}"
            
            print(f"# Import {name_tag}")
            print(import_cmd)
            print()

if __name__ == "__main__":
    discover_ec2_instances()

# Monitor Terraform runs and state changes
resource "datadog_monitor" "terraform_failures" {
  name    = "Terraform Apply Failures"
  type    = "query alert"
  message = "Terraform apply has failed multiple times"
  
  query = "sum(last_5m):sum:terraform.run.status{status:errored} by {workspace} > 2"
  
  monitor_thresholds {
    critical = 2
    warning  = 1
  }
  
  tags = ["team:platform", "service:terraform"]
}

#!/bin/bash
# Automated drift detection script

ENVIRONMENTS=("production" "staging" "development")
LAYERS=("foundation" "security" "compute" "applications")

for env in "${ENVIRONMENTS[@]}"; do
  for layer in "${LAYERS[@]}"; do
    echo "Checking drift in $env/$layer"
    
    cd "infrastructure/$env/$layer"
    
    # Run plan and check for changes
    terraform plan -detailed-exitcode -out=drift.tfplan
    exit_code=$?
    
    if [ $exit_code -eq 2 ]; then
      echo "DRIFT DETECTED in $env/$layer"
      terraform show drift.tfplan
      
      # Send alert
      curl -X POST "$SLACK_WEBHOOK" \
        -H 'Content-type: application/json' \
        --data "{\"text\":\"Terraform drift detected in $env/$layer\"}"
    fi
    
    cd - > /dev/null
  done
done

#!/bin/bash
# Terraform performance benchmarking

echo "Benchmarking Terraform operations..."

# Measure plan time
start_time=$(date +%s)
terraform plan -out=benchmark.tfplan > /dev/null 2>&1
plan_time=$(($(date +%s) - start_time))

# Measure apply time (dry run)
start_time=$(date +%s)
terraform show benchmark.tfplan > /dev/null 2>&1
show_time=$(($(date +%s) - start_time))

# Count resources
resource_count=$(terraform state list | wc -l)

echo "Performance Metrics:"
echo "  Resources: $resource_count"
echo "  Plan time: ${plan_time}s"
echo "  Show time: ${show_time}s"
echo "  Resources per second (plan): $((resource_count / plan_time))"

# Log to monitoring system
curl -X POST "$METRICS_ENDPOINT" \
  -H 'Content-Type: application/json' \
  -d "{
    \"metric\": \"terraform.performance\",
    \"value\": $plan_time,
    \"tags\": {
      \"operation\": \"plan\",
      \"resource_count\": $resource_count
    }
  }"