Terraform Modules for Multi-Cloud Landing Zones

A landing zone is identity, network, and logs — the boring floor every app stands on. Multi-cloud does not mean one mega-module. It means a small interface and two providers that do not leak into each other.

What to share

• Folder layout, tagging/label policy, and how state is split.
• A module contract: inputs for CIDR, environment, and owners.
• CI that plans on every PR with a role, not a laptop key.

What not to share

Do not wrap aws_vpc and google_compute_network behind one resource "cloud_network". Callers will pass a 40-field object and nobody can review the plan. Keep aws/ and gcp/ (or azure/) trees. Copy the pattern, not the resource.

State

One state per environment per stack. Workspaces are fine until someone applies prod with the wrong workspace. Separate backends are harder to mix up.

terraform {
  backend "s3" {
    bucket = "org-tfstate-prod"
    key    = "network/terraform.tfstate"
    dynamodb_table = "tf-locks"
  }
}

The AWS and Azure project pages start with the cluster landing pad. Same idea: network first, cluster second, apps never in the same state file.