AGENTS.md

Terraform

• Never run terraform apply, terraform destroy, terraform import, terraform state subcommands that change state, or terraform force-unlock without an explicit request for that command in that workspace. terraform fmt, validate, init and plan are yours to run.
• Before anything is applied, show the plan's summary and name every resource that will be destroyed or replaced; say which workspace, account and region it targets.
• Never edit a state file by hand, and never commit state, plan files, .terraform/ or files holding secrets.
• Secrets do not go into .tf or .tfvars files or into outputs: use variables marked sensitive, a secret manager or environment variables.
• Pin provider and module versions, and look up current provider and module documentation (the terraform MCP server when it is available) instead of relying on memory for arguments.
• Protect what holds data: do not remove prevent_destroy, deletion protection or backups without being asked, and call out any change that replaces a database, a bucket or a disk.
• Keep terraform fmt and terraform validate clean before calling a change done.