Terraform modules vs one-off cloud scripts
When reusable modules earn their keep—and when a focused stack is the honest choice
Cloud automation fails in two opposite ways: a folder of one-off scripts nobody dares to touch, or a “universal” module tree so abstract that changing a subnet takes a week of spelunking. The craft is knowing which shape fits the problem in front of you.
What a one-off script is actually for
A focused Terraform root (or a small set of roots) is not a sin. It is honest when the environment is unique, the team is small, and the blast radius of reuse is higher than the cost of duplication.
Scripts earn their keep when they encode a known path: create this VPC shape, attach this policy, wire this alarm. They fail when every environment quietly forks and nobody updates the forks.
Focused root with explicit inputs
Loading code…When modules start paying rent
Extract a module when you have repeated the same contract at least twice—and the inputs stay stable. Version the module. Document the required outputs. Refuse “optional everything” interfaces that hide half the AWS API behind a boolean maze.
Good modules encode decisions: private by default, required tags, forced encryption. They are opinionated on purpose. Thin wrappers that only rename arguments add ceremony without safety.
Opinionated network module surface
Loading code…Composition beats megamodules
Prefer composing small modules (network, data store, compute, edge) over one mega-module that stands up an entire company. Composition keeps blast radius local and review diffs readable.
Promote modules only after a second environment proves the interface. Until then, keep the code in the same repo as the root—premature packaging is how teams invent version hell before they have a product.
Guardrails that scripts usually skip
Whether you use modules or a focused root, bake in the same non-negotiables: remote state with locking, plan in CI, apply only from a controlled path, and policy checks on the plan. The module debate does not excuse missing those.
Final thoughts
Start concrete. Extract modules when repetition and risk justify them. Keep interfaces opinionated, compositions small, and CI as the place where bad plans die—before they become infrastructure.
Related Articles
Ready to build something this considered?