Q: How would you implement Infrastructure as Code at scale using Terraform? Discuss module design, state management, remote backends, state locking, environment separation, secrets, drift detection, and safe changes across hundreds of resources.

Layered, reusable building blocks with strict semantic versioning:

• Three-Tier Layering: Foundation Layer (VPC, Transit Gateway, Route 53) → Platform Layer (EKS clusters, IAM, KMS) → Application Layer (RDS, S3 buckets, SQS queues).
• Semantic Versioning: Modules live in dedicated repositories and are versioned with Git tags (e.g. source = 'git::.../terraform-aws-eks.git?ref=v3.2.0'). Environments pin exact module versions to prevent unexpected breaking changes.

Zero local state files; enterprise concurrency controls:

• S3 Remote Backend with Versioning: S3 stores state with bucket versioning enabled (enabling instant point-in-time recovery of corrupted state files) and KMS encryption at rest.
• DynamoDB State Locking: Primary key LockID prevents concurrent apply operations, eliminating race conditions.
• State File Decomposition (Blast Radius Control): Never maintain one monolithic state file. Separate state files per environment and per architectural layer (e.g. networking/prod.tfstate vs compute/prod.tfstate).

Account isolation and zero plaintext credentials:

• Multi-Account AWS Strategy: Dedicated AWS Accounts under AWS Organizations: Dev Account, Staging Account, Prod Account. The CI runner in Dev has 0 IAM permissions in Prod.
• Directory-Based Separation: Distinct directories for environments/dev/, environments/staging/, and environments/prod/ (avoid workspaces for multi-account prod infrastructure).
• Zero Secrets in Code: Never store database passwords or tokens in .tf or .tfvars. Fetch dynamically from AWS Secrets Manager / Vault using data sources, or inject via masked CI environment variables.

Safe execution and continuous compliance:

• Atlantis / Terraform Cloud: Developers open a PR; Atlantis automatically runs terraform plan and comments the diff on the PR. Applies are executed only after peer review approvals.
• Pre-Apply Policy as Code: Enforce Open Policy Agent (OPA / Conftest) or AWS Sentinel rules to block costly or unencrypted resources (e.g. unencrypted S3 buckets or open 0.0.0.0/0 security groups).
• Automated Drift Detection: Daily scheduled CI pipeline runs terraform plan -detailed-exitcode at 2 AM. If exit code is 2 (drift detected), alerts are dispatched to PagerDuty/Slack.