What are the most common Terraform mistakes in production?

Terraform failures usually come from operational shortcuts rather than HCL syntax. The same handful of patterns appear in incidents: state is not shared, versions float, changes bypass review, or one configuration owns too much.

• Committing terraform.tfstate or keeping it only on a laptop
• Running CI without a remote backend or locking
• Using latest provider versions and skipping the lock file
• Editing cloud resources by hand and never reconciling drift
• Using count for named collections and causing index churn
• Putting every environment and service in one root module
• Applying an unreviewed plan with -auto-approve
• Storing secrets in variables that end up in state

terraform {
  backend "s3" {
    bucket       = "acme-tfstate"
    key          = "prod/app/terraform.tfstate"
    region       = "us-east-1"
    encrypt      = true
    use_lockfile = true
  }
}

Prevention is mostly process: a pull request template that asks for the plan, CI that runs fmt, validate, policy and plan, protected environments for production, and a clear state ownership model. Reviewers should look for replacements, IAM changes and resource deletions, not just whether the pipeline is green.