File & Environment #

# environments/dev.tfvars
environment    = "dev"
instance_type  = "t3.micro"
instance_count = 1

database_config = {
  instance_class    = "db.t3.micro"
  allocated_storage = 20
  multi_az          = false
  backup_retention  = 1
}

tags = {
  Environment = "dev"
  CostCenter  = "engineering"
  ManagedBy   = "terraform"
}

# environments/production.tfvars
environment    = "production"
instance_type  = "t3.medium"
instance_count = 3

database_config = {
  instance_class    = "db.r5.large"
  allocated_storage = 500
  multi_az          = true
  backup_retention  = 30
}

tags = {
  Environment = "production"
  CostCenter  = "engineering"
  ManagedBy   = "terraform"
}

# Gunakan saat apply
terraform apply -var-file="environments/dev.tfvars"
terraform apply -var-file="environments/production.tfvars"

# terraform.tfvars — nilai default, di-commit ke Git
# (jangan simpan secret di sini)

region   = "ap-southeast-1"
owner    = "platform-team"

common_tags = {
  Project   = "my-app"
  ManagedBy = "terraform"
  Repository = "github.com/org/infrastructure"
}

# Nilai yang sama di semua environment
enable_monitoring  = true
log_retention_days = 30

# Terraform membaca TF_VAR_<nama_variable> otomatis
# Nama variable harus EXACT MATCH (case-sensitive)

export TF_VAR_environment="production"
export TF_VAR_instance_type="t3.medium"

# Untuk variable dengan tipe kompleks, gunakan format HCL/JSON
export TF_VAR_database_config='{"instance_class":"db.r5.large","allocated_storage":500,"multi_az":true}'

terraform apply
# Terraform membaca TF_VAR_* dan menggunakannya sebagai nilai variable

# Contoh penggunaan di GitHub Actions CI/CD
name: Terraform Apply Production

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production

    steps:
      - uses: actions/checkout@v4

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3

      - name: Terraform Init
        run: terraform init

      - name: Terraform Apply
        env:
          # Nilai non-sensitif dari tfvars file
          TF_VAR_environment: "production"
          # Secret dari GitHub Secrets — tidak pernah masuk ke kode
          TF_VAR_db_password: ${{ secrets.DB_PASSWORD }}
          TF_VAR_api_key: ${{ secrets.API_KEY }}
          # AWS credentials
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        run: terraform apply -auto-approve -var-file="environments/production.tfvars"

# PENDEKATAN 1: Baca secret dari AWS Secrets Manager via data source
# Secret dikelola di luar Terraform, Terraform hanya membacanya

data "aws_secretsmanager_secret_version" "db_credentials" {
  secret_id = "production/database/credentials"
}

locals {
  db_credentials = jsondecode(
    data.aws_secretsmanager_secret_version.db_credentials.secret_string
  )
}

resource "aws_db_instance" "main" {
  username = local.db_credentials.username
  password = local.db_credentials.password
  # ... atribut lainnya
}

# PENDEKATAN 2: Variable sensitive diisi via TF_VAR_* environment variable
# Secret dikelola di secrets manager CI/CD (GitHub Secrets, HashiCorp Vault)
# dan dioper ke Terraform sebagai environment variable

variable "db_password" {
  type      = string
  sensitive = true
  # Tidak ada default — Terraform akan error jika TF_VAR_db_password tidak di-set
}

resource "aws_db_instance" "main" {
  password = var.db_password
}

# ANTI-PATTERN 1: Secret di file .tfvars yang di-commit ke Git
# production.tfvars
db_password = "super-secret-password"  # ✗ Bocor ke semua yang akses repo
api_key     = "sk-prod-abc123def456"   # ✗ Tersimpan di Git history selamanya

# ANTI-PATTERN 2: Satu file tfvars untuk semua environment
# all-environments.tfvars
dev_instance_type  = "t3.micro"        # ✗ File jadi besar dan membingungkan
prod_instance_type = "t3.medium"
dev_db_class       = "db.t3.micro"
prod_db_class      = "db.r5.large"
# Lebih baik: file terpisah per environment

# ANTI-PATTERN 3: Nilai hardcode di konfigurasi padahal seharusnya variable
resource "aws_instance" "web" {
  instance_type = "t3.micro"   # ✗ Hardcode — tidak bisa berbeda per environment
}
# Lebih baik: instance_type = var.instance_type

// terraform.tfvars.json
{
  "environment": "production",
  "instance_type": "t3.medium",
  "instance_count": 3,
  "tags": {
    "Project": "MyApp",
    "ManagedBy": "Terraform"
  }
}

# terraform.tfvars.json otomatis dibaca, sama seperti terraform.tfvars
terraform plan

# Urutan loading untuk JSON sama dengan HCL:
# 1. terraform.tfvars.json (jika ada, bersama terraform.tfvars)
# 2. *.auto.tfvars.json (alphabetical)
# 3. -var-file flag

# Pola umum: satu file tfvars per environment
# environments/
#   ├── dev.tfvars
#   ├── staging.tfvars
#   └── production.tfvars

terraform plan -var-file="environments/production.tfvars"
terraform apply -var-file="environments/staging.tfvars"

# Di CI/CD, pilih file berdasarkan branch atau parameter
if [ "$ENVIRONMENT" == "production" ]; then
  terraform apply -var-file="environments/production.tfvars" -auto-approve
elif [ "$ENVIRONMENT" == "staging" ]; then
  terraform apply -var-file="environments/staging.tfvars" -auto-approve
fi

VARIABLE PRIORITY (dari rendah ke tinggi):

1. Default value di deklarasi variable
   variable "x" { default = "low" }

2. terraform.tfvars (dan terraform.tfvars.json)
   x = "medium-low"

3. *.auto.tfvars (dan *.auto.tfvars.json) — alphabetical
   config.auto.tfvars: x = "medium"

4. -var-file flag
   terraform plan -var-file="custom.tfvars"
   x = "medium-high"

5. -var flag dan TF_VAR_ environment variable
   terraform plan -var="x=high"
   TF_VAR_x="high" terraform plan

6. Input di prompt (jika tidak ada default)
   Terraform akan minta input interaktif

# Contoh: override dalam CI/CD
# Default: terraform.tfvars → environment = "dev"
# CI/CD override:
terraform plan -var="environment=staging"
# Ini meng-override nilai di terraform.tfvars

# Environment variable override:
export TF_VAR_instance_type="t3.large"
terraform plan
# TF_VAR_instance_type meng-override semua sumber lain


---

## tfvars Security

```bash
# JANGAN commit tfvars yang berisi secret ke Git!

# .gitignore:
*.tfvars
*.tfvars.json
!terraform.tfvars.example

# Untuk shared values (non-sensitive):
# Commit terraform.tfvars.example dengan placeholder

# terraform.tfvars.example (commit ini)
# environment = "dev"
# instance_type = "t3.micro"
# db_password = "CHANGE_ME"

# terraform.tfvars (JANGAN commit)
environment  = "production"
instance_type = "m5.large"
db_password   = "actually-secret-password"

# Alternatif: gunakan environment variables untuk secret
# export TF_VAR_db_password="secret"
# Terraform akan baca dari TF_VAR_ prefix

TERRAFORM VARIABLE LOADING ORDER:

1. Environment variables (TF_VAR_*)
   └── Loaded automatically from shell

2. terraform.tfvars
   └── Auto-loaded jika ada di working directory

3. *.auto.tfvars
   └── Auto-loaded, alphabetical order

4. -var-file=explicit.tfvars
   └── Explicit, bisa specify multiple

5. -var="key=value"
   └── Command line, highest priority

NAMING CONVENTION:
common.tfvars       → Shared values across all envs
dev.tfvars          → Dev-specific values
staging.tfvars      → Staging-specific values
production.tfvars   → Production-specific values
secrets.tfvars      → NEVER commit (in .gitignore)

# Combine multiple var files
terraform apply   -var-file="common.tfvars"   -var-file="environments/dev.tfvars"   -var-file="regions/ap-southeast-1.tfvars"