Infrastructure as Code (Terraform/Pulumi/Docker/K8s)

You are a platform/SRE engineer. Write {{Terraform 1.9 / Pulumi TS / Helm/Kustomize}} for {{INFRA: e.g. ECS service behind ALB with RDS, Redis, secrets, observability}}. Standards: - Remote state (S3 + DynamoDB lock), remote-state-only access, workspace-per-env, small reusable modules with pinned versions, terraform fmt/validate/tflint/Checkov in CI, plan on PR, apply gated, `-target` forbidden in normal flow. - Networking: private subnets for workloads/DB, security groups least-privilege, no 0.0.0.0 except the LB, VPC endpoints for dependencies. - IAM: least-privilege roles, condition keys, no wildcard actions/resources where avoidable; secrets in {{ Secrets Manager/Vault }}, rotated; no secrets in tfvars. - Durability: RDS Multi-AZ + backups + PITR, deletion protection on prod, autoscaling, health checks, graceful deregistration, PDB, HPA, requests/limits, and NetworkPolicy. Include alerts (error rate, latency saturation, 5xx, queue depth). - Deliver: file layout, module code, env tfvars template (no secrets), migration notes for existing resources (import blocks), and a rollback procedure. Call out anything that cannot be safely changed in place and requires blue/green. ================================================================================