Skip to main content

Terraform Workspace Strategy

Design a Terraform workspace or Terragrunt configuration strategy for managing multiple environments with DRY configurations.

Fill in the placeholders

Edit the values, then copy your finished prompt.

Your Prompt
prompt.txt
Design a multi-environment infrastructure management strategy using Terragrunt (or native Terraform if simpler) for a web application with VPC, ECS, RDS, ElastiCache, and S3 on AWS. Environments: dev, staging, production, dr (disaster recovery) with dev: single AZ, small instances, no HA; staging: mirrors prod topology at smaller scale; prod: multi-AZ, large instances, full HA; dr: cross-region replica. Plan: 1) Compare approaches: Terraform workspaces, Terragrunt, directory-per-environment, and Terraform Cloud/Enterprise workspaces. Recommend the best fit based on 3 infrastructure engineers team, medium (15 Terraform modules, 4 environments, 2 regions) complexity, and prefer open-source, avoid Terraform Cloud Enterprise tier. 2) For the recommended approach, design the directory structure showing exactly where provider configs, backend configs, module calls, variable values live, how environment-specific values are injected, and how shared modules are referenced. 3) DRY configuration: eliminate duplication across environments using Terragrunt includes for common configs, or tfvars files per environment — show before (duplicated) and after (DRY) examples for ECS service definition that is identical except for instance count and image tag. 4) Environment promotion workflow: how does a change flow from dev to production? Define automated tests in dev, manual QA approval for staging, change advisory board for production at each stage. 5) Environment-specific resource sizing using environment-specific tfvars or Terragrunt inputs — RDS: t3.micro (dev) → r6g.large (prod), ECS: 1 task (dev) → 3 tasks (prod) differ across environments without duplicating module code. 6) Handle environment-specific resources that only exist in certain environments: WAF only in production, VPN only in production, Cloudflare only in production and staging. 7) Secrets per environment: AWS Secrets Manager with per-environment IAM policies with isolated access so dev credentials cannot access production resources. 8) Provide a complete working example with all files for a RDS PostgreSQL instance resource across all environments.

What this prompt does

This prompt makes the AI reason through a multi-environment Terraform strategy as a deliberate engineering decision rather than defaulting to whatever it saw most online. You provide [tool_choice] and [project_description], list your [environments] and their [environment_differences], and give it the constraints that actually drive the call: [team_size], [complexity_level], and [budget_constraints]. It then compares Terraform workspaces, Terragrunt, directory-per-environment, and Terraform Cloud, and recommends one for your situation.

The structure works because the right answer depends entirely on context. A three-person team with a tight budget should not be told to buy Enterprise. By forcing the model to lay out the directory structure showing where [config_elements] live, apply a [dry_strategy] with before/after examples for [duplication_example], design a promotion workflow from [first_env] to [last_env] with [promotion_gates], and handle [env_specific_resources] plus [secret_management], you get an opinionated, complete blueprint instead of a feature comparison you still have to decide from. The [project_description] anchors all of this to a real stack, so the module references and backend layout match what you actually deploy.

When to use it

  • You are starting a new IaC repo and have not committed to workspaces vs Terragrunt yet
  • You are drowning in copy-pasted config across dev, staging, and production
  • You need a defensible recommendation to show a team before standardizing
  • You want a promotion workflow that defines [promotion_gates] at each stage
  • You have resources like WAF or VPN that exist only in some environments
  • You need per-environment secret isolation so [first_env] credentials cannot reach [last_env]
  • You want environment-specific sizing without forking module code

Example output

Expect a comparison section weighing the four approaches against your [team_size] and [complexity_level], a single recommendation with rationale, and an annotated directory tree showing exactly where [config_elements] go. You then get before/after code snippets demonstrating the [dry_strategy] on [duplication_example], a promotion flow diagram, a [variable_strategy] for sizing differences like [sizing_examples], and a complete working file set for a [example_resource] across every environment. The output also explains how [env_specific_resources] such as WAF or VPN are conditionally created only where they belong, so you are not littering production-only resources across dev.

Pro tips

  • Be honest about [budget_constraints] — saying you want to avoid the Enterprise tier steers it toward open-source Terragrunt patterns instead of paid features
  • Make [environment_differences] specific; "dev: single AZ, prod: multi-AZ full HA" produces a far better sizing strategy than "they differ"
  • Use [duplication_example] to point at your worst real duplication so the DRY refactor is relevant
  • Set [promotion_gates] to your actual approval reality, whether that is a CAB for production or just a team-lead review
  • Pin [example_resource] to something you genuinely run so the complete file set is copy-ready
  • Keep [variable_strategy] consistent across environments so a new engineer can predict where any value is set
  • If the recommendation surprises you, ask it to defend the rejected options — that pressure-tests the call before you commit a repo to it

Frequently Asked Questions

Will it always recommend Terragrunt?
No. The recommendation depends on `[team_size]`, `[complexity_level]`, and `[budget_constraints]`. For small, simple setups it may favor native Terraform workspaces or directory-per-environment, since Terragrunt adds a dependency that small teams may not need.
Does it cover disaster-recovery or cross-region environments?
Yes, if you include them in `[environments]` and `[environment_differences]`. The default example lists a dr environment as a cross-region replica, and the strategy handles environment-specific resources and regional differences through the variable strategy.
How does it keep secrets isolated between environments?
Through `[secret_management]`, typically AWS Secrets Manager with per-environment IAM policies. The design ensures `[first_env]` credentials cannot access `[last_env]` resources by scoping access at the policy level rather than sharing one secret store.
Can it generate working code or just describe the approach?
It provides a complete working example with all files for the `[example_resource]` across environments. Treat that as a verified starting template, then validate with `terraform plan` against your real backends before applying anything.
Engr Mejba Ahmed

Need this built for real?

Engr Mejba Ahmed

AI Developer · Software Engineer

I'm Mejba — I design and ship production AI systems, automations, and full-stack apps. If you want this turned into a working solution for your team, let's talk.

More in Terraform & Infrastructure as Code Prompts

Engr Mejba Ahmed

Engr Mejba Ahmed

AI assistant · trained on my work

👋

Hey there!

Quick Actions

WhatsApp Direct line to me

Chat on WhatsApp

+880 1723 741224 · Replies within the hour on working days

Popular Questions

Engr Mejba Ahmed is connected
Engr Mejba Ahmed is typing...
Engr Mejba Ahmed avatar

✉ Want me to follow up? Drop your email

Engr Mejba Ahmed avatar

📞 Connect Directly

Choose how you'd like to reach me

WhatsApp

+880 1723 741224

Email

mejba.13@gmail.com

✓ Details sent! I'll get back to you shortly.

Powered by OpenAI

335+

Blog Posts

25

AI Courses

63

Projects

Services & Expertise

Pricing & Process

Learning & Resources

Connect & Support