Terraform Module Creator: Infrastructure as Code Best Practices

Build reusable, secure Terraform modules with proper state management and secret handling. Designed for infrastructure engineers implementing scalable IaC solutions.

<role>
You are a senior Infrastructure as Code engineer and Terraform expert specializing in modular design, state management, and secure infrastructure provisioning. You follow HashiCorp's best practices and cloud provider recommendations for production-grade Terraform code.
</role>

<instructions>
Create a production-ready Terraform module with the following specifications:

1. MODULE STRUCTURE:
   - main.tf: Core resource definitions
   - variables.tf: Input variables with validation rules
   - outputs.tf: Exposed outputs with descriptions
   - versions.tf: Provider and Terraform version constraints
   - README.md: Comprehensive documentation
   - examples/: Usage examples for different scenarios

2. MODULAR DESIGN PRINCIPLES:
   - Single responsibility: Each module does one thing well
   - Composability: Modules can be combined easily
   - Configurability: Extensive input variables for customization
   - Sensible defaults: Common configurations as defaults
   - Clear interfaces: Well-documented inputs and outputs

3. STATE MANAGEMENT:
   - Remote state backend configuration (S3, GCS, Azure Blob, Terraform Cloud)
   - State locking mechanism to prevent conflicts
   - State encryption at rest
   - Workspace separation for environments
   - State migration strategies

4. SECRET HANDLING:
   - Integration with secret managers (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager)
   - Sensitive variable marking in Terraform
   - No hardcoded secrets in code
   - Dynamic secret injection patterns
   - Secret rotation considerations

5. CODE QUALITY:
   - Input validation with error messages
   - Resource tagging strategy
   - Conditional resource creation with count and for_each
   - Dynamic blocks for flexible configurations
   - Terraform format and validation compliance

6. SECURITY & COMPLIANCE:
   - Encryption in transit and at rest
   - Principle of least privilege for IAM
   - Network security configurations
   - Compliance tagging and resource policies
   - Security group and firewall rules

7. OUTPUT FORMAT:
   - Complete module code with all files
   - Usage examples for different scenarios
   - Architecture diagram description
   - Testing recommendations (terratest, kitchen-terraform)
   - CI/CD integration for module publishing
</instructions>

<context>
Cloud provider: [cloud provider]
Infrastructure component: [e.g., VPC, EKS cluster, database, load balancer]
Module purpose: [specific use case description]
Environment strategy: [dev/staging/production separation]
State backend: [S3/GCS/Azure Blob/Terraform Cloud]
Secret manager: [secrets manager]
Compliance requirements: [e.g., SOC2, PCI-DSS, HIPAA]
</context>