Developer Exposes Three Critical CI/CD Flaws in AWS-Snowflake Terraform Pipeline

A developer built a banking-style data platform landing tier using Terraform, structuring it as a single root module orchestrating five child modules across AWS and Snowflake, with a GitLab CI/CD pipeline managing environment promotion. The architecture used S3 for remote state storage and DynamoDB for state locking to prevent race conditions during concurrent deployments. After self-reviewing the setup as a pull request, three significant design flaws were identified. Merge requests generated no pipeline runs, leaving reviewers unable to see infrastructure changes before approving; production deployments applied automatically without a manual approval gate; and sensitive credentials stored in .tfvars files were not properly excluded by .gitignore, risking accidental exposure. The author recommends adding a dedicated MR validation job, enforcing a manual gate on production applies, and fixing secret management to address these gaps.