What's Included

This chapter covers the core features and capabilities of the Terraform Module Registry.

What's Included

Terraform Modules (6)

Each module includes:

• main.tf — Resource definitions with production-ready defaults
• variables.tf — Input variables with type constraints and validation blocks
• outputs.tf — Output values for cross-module wiring
• versions.tf — Terraform and provider version constraints
• README.md — Usage examples and input/output reference tables

Registry Tool (1 script)

The registry tool is Python 3.10+ stdlib-only — no external dependencies, no terraform binary required.

Documentation (3)

Examples (1)

Quick Start

1. Explore Available Modules

# Scan all modules and see a summary
python3 scripts/registry.py --scan

# Build the registry index
python3 scripts/registry.py --scan --index

# Generate full Markdown documentation
python3 scripts/registry.py --scan --docs

2. Try the Example Environment

cd examples/dev-environment

# Set the database password
export TF_VAR_db_password="your-secure-password"

# Initialize Terraform
terraform init

# Preview the infrastructure
terraform plan

# Deploy (when ready)
terraform apply

3. Use a Module in Your Project

module "vpc" {
  source = "./modules/vpc-network"

  name_prefix = "myapp-prod"
  vpc_cidr    = "10.0.0.0/16"

  tags = {
    Environment = "production"
  }
}

Module Selection Guide

Architecture Overview

This chapter explains the architecture and design philosophy of the Terraform Module Registry.

Architecture Overview

┌───────────────────────────────────────────────────────────────┐
│                    Terraform Module Registry                   │
│                                                               │
│  ┌──────────────────────────────────────────────────────────┐ │
│  │                    Registry Tool (Python)                 │ │
│  │                                                          │ │
│  │  registry.py  ──►  Scan ──► Parse ──► Index/Docs         │ │
│  │                                                          │ │
│  │  Input: modules/*.tf files                               │ │
│  │  Output: registry.json, Markdown tables                  │ │
│  └──────────────────────────────────────────────────────────┘ │
│                                                               │
│  ┌──────────────────────────────────────────────────────────┐ │
│  │                    Module Collection                      │ │
│  │                                                          │ │
│  │  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐      │ │
│  │  │ vpc-network  │  │  s3-bucket  │  │  iam-role   │      │ │
│  │  │             │  │             │  │             │      │ │
│  │  │ VPC+Subnets │  │ Encrypted  │  │ Trust+Pol. │      │ │
│  │  │ IGW+NAT    │  │ Versioned  │  │ Inst.Prof. │      │ │
│  │  │ Flow Logs  │  │ Lifecycle  │  │ Boundaries │      │ │
│  │  └─────────────┘  └─────────────┘  └─────────────┘      │ │
│  │                                                          │ │
│  │  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐      │ │
│  │  │security-grp │  │ ecs-service │  │rds-instance │      │ │
│  │  │             │  │             │  │             │      │ │
│  │  │ Ingress/Eg. │  │ Fargate    │  │ Multi-AZ   │      │ │
│  │  │ CIDR+SG ref │  │ AutoScale  │  │ Encryption │      │ │
│  │  │ Lifecycle  │  │ CircuitBrk │  │ Monitoring │      │ │
│  │  └─────────────┘  └─────────────┘  └─────────────┘      │ │
│  └──────────────────────────────────────────────────────────┘ │
│                                                               │
│  ┌──────────────────────────────────────────────────────────┐ │
│  │                    Example Compositions                   │ │
│  │                                                          │ │
│  │  dev-environment/main.tf                                 │ │
│  │  Wires: vpc-network + security-group + rds-instance      │ │
│  └──────────────────────────────────────────────────────────┘ │
└───────────────────────────────────────────────────────────────┘

File Structure

terraform-module-registry/
├── README.md                              # Product overview and quick start
├── LICENSE                                # MIT License
│
├── modules/                               # Terraform module collection
│   ├── vpc-network/                       # VPC with subnets, IGW, NAT
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   ├── outputs.tf
│   │   ├── versions.tf
│   │   └── README.md
│   ├── s3-bucket/                         # Hardened S3 bucket
│   │   └── (same structure)
│   ├── iam-role/                          # IAM role with policies
│   │   └── (same structure)
│   ├── security-group/                    # VPC security group
│   │   └── (same structure)
│   ├── ecs-service/                       # ECS Fargate service
│   │   └── (same structure)
│   └── rds-instance/                      # Managed RDS database
│       └── (same structure)
│
├── scripts/                               # Registry tooling
│   └── registry.py                        # Module scanner, indexer, docs generator
│
├── examples/                              # Example compositions
│   └── dev-environment/
│       ├── main.tf                        # Root module wiring 3 modules
│       └── terraform.tfvars               # Example variable values
│
├── docs/                                  # Deep-dive documentation
│   ├── architecture.md                    # Registry design and composition patterns
│   ├── usage-guide.md                     # How to consume modules
│   └── versioning.md                      # Version and constraint policy
│
└── guide/                                 # Product guide chapters
    ├── 01_what-s-included.md
    ├── 02_architecture-overview.md
    ├── 03_cost-estimates.md
    └── 04_license.md

Design Principles

1. Module Isolation

Each module is fully self-contained. It declares its own provider requirements,

validates its own inputs, and exposes a clean output interface. Modules never

reference each other internally — all composition happens in the consuming root

module.

2. Production Defaults

Variables ship with secure, cost-effective defaults:

• Encryption is always on (AES-256 for S3, storage encryption for RDS)
• Public access is blocked by default (S3 public access block, RDS not publicly accessible)
• Deletion protection defaults vary by environment intent (off for dev modules, configurable for prod)
• Tags are propagated to all taggable resources

3. Validation at Plan Time

Every module uses Terraform's validation blocks to catch invalid inputs before

any API calls are made:

variable "vpc_cidr" {
  type    = string
  default = "10.0.0.0/16"

  validation {
    condition     = can(cidrhost(var.vpc_cidr, 0))
    error_message = "vpc_cidr must be a valid CIDR block."
  }
}

4. Offline-First Tooling

The registry.py script parses .tf files as plain text using regex and

brace-counting. It requires:

• Python 3.10+ (stdlib only)
• No terraform binary
• No internet connectivity
• No external Python packages

Requirements

• Terraform >= 1.5.0 for module deployment
• AWS CLI v2 with configured credentials
• AWS Provider >= 5.0, < 6.0 (hashicorp/aws)
• Python 3.10+ for the registry tool (stdlib only)