Whole Terraform module with remote state locking and encrypted RDS, tfsec checks already passing

Terraform module for an AWS VPC + RDS + ECS Fargate stack, `prod` environment, with remote state, encryption at rest, and least-privilege security groups. ``` infra/ ├── modules/ │ ├── network/ # vpc, subnets, nat, routes │ ├── database/ # rds + parameter group + kms │ └── compute/ # ecs cluster + service + alb └── envs/prod/ ├── main.tf ├── backend.tf └── terraform.tfvars ``` ```hcl # envs/prod/backend.tf — remote state with locking terraform { required_version = ">= 1.7" required_providers { aws = { source = "hashicorp/aws", version = "~> 5.40" } } backend "s3" { bucket = "acme-tfstate" key = "prod/checkout.tfstate" region = "eu-central-1" dynamodb_table = "tf-locks" # state locking encrypt = true } } ``` ```hcl # modules/database/main.tf resource "aws_db_instance" "main" { identifier = "checkout-prod" engine = "postgres" engine_version = "16.3" instance_class = var.instance_class allocated_storage = 100 storage_encrypted = true kms_key_id = aws_kms_key.rds.arn backup_retention_period = 14 multi_az = true deletion_protection = true vpc_security_group_ids = [aws_security_group.db.id] } variable "instance_class" { type = string default = "db.r6g.large" validation { condition = can(regex("^db\\.", var.instance_class)) error_message = "instance_class must be a valid RDS class." } } ``` **tfsec compliance:** `storage_encrypted`, `multi_az`, and `deletion_protection` clear the high-severity RDS checks. The DB security group ingress is scoped to the ECS task SG only — no `0.0.0.0/0`. Run `terraform plan -var-file=envs/prod/terraform.tfvars` and gate `apply` behind a CI approval.