Terraform at Scale: From One Landing Zone to Twenty Teams

Terraform is easy to adopt and easy to mismanage at the same time. The gap between “works for one team” and “safe for twenty teams sharing a platform” is almost entirely about conventions, not features.

State isolation is the whole game

A shared terraform.tfstate across teams is the single biggest scaling mistake. Every team, every environment, gets its own state — backed by a remote backend with locking (S3 + DynamoDB, or GCS with native locking). Blast radius should be bounded by the blast radius of a bad apply, not by how the repo happens to be laid out.

terraform {
  backend "s3" {
    bucket         = "platform-tfstate-${var.team}-${var.env}"
    key            = "infra/terraform.tfstate"
    region         = "eu-west-2"
    dynamodb_table = "terraform-locks"
    encrypt        = true
  }
}

Landing zones are a module, not a template

A landing zone that teams copy-paste diverges the moment it’s copied. A landing zone shipped as a versioned module stays consistent — and upgrading account baseline security (SCPs, logging, IAM boundaries) becomes a version bump across every consumer, not a manual re-audit of every account.

CI/CD is the enforcement mechanism, not code review

terraform plan in a PR is a good start. It’s not enough on its own. The pipeline should:

1. Run plan and post it as a PR comment for human review.
2. Run policy checks (Sentinel, OPA, or tfsec/checkov) as a hard gate — not advisory.
3. Require a second approver for anything touching IAM, networking boundaries, or production state.
4. Apply only from the pipeline, never from a laptop — no exceptions, including “just this once.”

The unglamorous stuff wins

Consistent naming, tagging conventions enforced by policy (not a wiki page), and a module registry that’s actually documented — these are less interesting than clever for_each tricks, but they’re what determines whether a twenty-team platform is maintainable in year three or a graveyard of half-abandoned modules.

Scale doesn’t break Terraform. It breaks the absence of conventions Terraform never forced you to have in the first place.