Skip to content
Infrastructure

Terraform modules vs one-off cloud scripts

When reusable modules earn their keep—and when a focused stack is the honest choice

June 10, 2025
By Manweba

Cloud automation fails in two opposite ways: a folder of one-off scripts nobody dares to touch, or a “universal” module tree so abstract that changing a subnet takes a week of spelunking. The craft is knowing which shape fits the problem in front of you.

What a one-off script is actually for

A focused Terraform root (or a small set of roots) is not a sin. It is honest when the environment is unique, the team is small, and the blast radius of reuse is higher than the cost of duplication.

Scripts earn their keep when they encode a known path: create this VPC shape, attach this policy, wire this alarm. They fail when every environment quietly forks and nobody updates the forks.

Focused root with explicit inputs

hcl
Loading code…

When modules start paying rent

Extract a module when you have repeated the same contract at least twice—and the inputs stay stable. Version the module. Document the required outputs. Refuse “optional everything” interfaces that hide half the AWS API behind a boolean maze.

Good modules encode decisions: private by default, required tags, forced encryption. They are opinionated on purpose. Thin wrappers that only rename arguments add ceremony without safety.

Opinionated network module surface

hcl
Loading code…

Composition beats megamodules

Prefer composing small modules (network, data store, compute, edge) over one mega-module that stands up an entire company. Composition keeps blast radius local and review diffs readable.

Promote modules only after a second environment proves the interface. Until then, keep the code in the same repo as the root—premature packaging is how teams invent version hell before they have a product.

Guardrails that scripts usually skip

Whether you use modules or a focused root, bake in the same non-negotiables: remote state with locking, plan in CI, apply only from a controlled path, and policy checks on the plan. The module debate does not excuse missing those.

Final thoughts

Start concrete. Extract modules when repetition and risk justify them. Keep interfaces opinionated, compositions small, and CI as the place where bad plans die—before they become infrastructure.

Ready to build something this considered?