Infrastructure as Code with Terraform for AWS/Hetzner

Create infrastructure as code with Terraform for [PROJECT NAME], deployed on [AWS/HETZNER/GCP].

**Target Architecture:**
- Compute: [EC2/ECS/HETZNER CLOUD] — [NUMBER] instances
- Database: [RDS POSTGRESQL/HETZNER + DOCKER]
- Cache: [ELASTICACHE REDIS/SELF-HOSTED]
- Storage: [S3/HETZNER STORAGE BOX]
- CDN: [CLOUDFRONT/CLOUDFLARE]
- DNS: [ROUTE53/CLOUDFLARE]
- Network: VPC with public and private subnets

**1) Terraform Project Structure:**
```
terraform/
├── environments/
│   ├── staging/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   └── terraform.tfvars
│   └── production/
├── modules/
│   ├── networking/
│   ├── compute/
│   ├── database/
│   ├── cache/
│   └── monitoring/
└── global/
    ├── iam/
    └── dns/
```

**2) Reusable Modules:**
For each module, define: variables, resources, outputs, README

- **networking**: VPC, subnets (public/private), NAT Gateway, security groups
- **compute**: instances/containers, auto-scaling, load balancer, target groups
- **database**: RDS/PostgreSQL with read replica, automated backups, parameter group
- **cache**: Redis cluster with failover
- **monitoring**: CloudWatch alarms, SNS topics, dashboards

**3) State Management:**
- Remote state in S3 + DynamoDB lock (AWS) or Terraform Cloud
- State per environment (staging/production)
- Import existing resources (`terraform import`)
- Safe state manipulation (move, remove)

**4) Security:**
- IAM roles with least privilege
- Restrictive security groups
- Encryption at rest (KMS)
- Secrets in AWS Secrets Manager (not in terraform.tfvars)
- VPC endpoints for AWS services

**5) CI/CD for Terraform:**
- GitHub Action: `plan` on PR, `apply` on merge to main
- Validation: `terraform fmt`, `terraform validate`, `tflint`
- Cost estimation with Infracost
- Manual approval before apply in production

**6) Cost Estimate:**
- Monthly cost per resource
- Optimizations: Reserved Instances, Spot for workers, S3 lifecycle
- Comparison: AWS vs. Hetzner for this workload

Provide complete `.tf` files for the [PRODUCTION/STAGING] environment.