From b13128bc2695496504bd1277259ddbbeb82546a6 Mon Sep 17 00:00:00 2001
From: juandiegocv27 <juandiegocarballo2701@gmail.com>
Date: Wed, 19 Nov 2025 02:28:13 -0600
Subject: [PATCH 1/2] feat: add providers.tf and finalize S3+DynamoDB backend
 setup

---
 envs/dev/!!         |  9 +++++++++
 envs/dev/1!         | 18 ++++++++++++++++++
 envs/dev/backend.tf |  2 +-
 3 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 envs/dev/!!
 create mode 100644 envs/dev/1!

diff --git a/envs/dev/!! b/envs/dev/!!
new file mode 100644
index 0000000..1bb6a6e
--- /dev/null
+++ b/envs/dev/!!
@@ -0,0 +1,9 @@
+terraform {
+  backend "s3" {
+    bucket         = "shopstack-dev-tfstate"
+    key            = "envs/dev/terraform.tfstate"
+    region         = "us-east-1"
+    encrypt        = true
+    dynamodb_table = "shopstack-dev-locks"
+  }
+}
diff --git a/envs/dev/1! b/envs/dev/1!
new file mode 100644
index 0000000..82d2a40
--- /dev/null
+++ b/envs/dev/1!
@@ -0,0 +1,18 @@
+locals {
+  project = "shopstack"
+  env     = "dev"
+}
+
+module "network" {
+  source = "../../vpc"
+
+  project              = local.project
+  env                  = local.env
+  region               = "us-east-1"
+  vpc_cidr             = "10.0.0.0/16"
+  azs                  = ["us-east-1a", "us-east-1b"]
+  public_subnet_cidrs  = ["10.0.0.0/24", "10.0.1.0/24"]
+  private_subnet_cidrs = ["10.0.10.0/24", "10.0.11.0/24"]
+}
+
+
diff --git a/envs/dev/backend.tf b/envs/dev/backend.tf
index 921e352..4bc9183 100644
--- a/envs/dev/backend.tf
+++ b/envs/dev/backend.tf
@@ -3,7 +3,7 @@ terraform {
     bucket         = "shopstack-dev-tfstate"
     key            = "envs/dev/terraform.tfstate"
     region         = "us-east-1"
-    dynamodb_table = "shopstack-dev-tflock"
     encrypt        = true
+    dynamodb_table = "terraform-locks"
   }
 }

From 1b05f79e0d6bdd6ffd3db621438fcdd24c8feed5 Mon Sep 17 00:00:00 2001
From: juandiegocv27 <juandiegocarballo2701@gmail.com>
Date: Mon, 1 Dec 2025 18:04:58 -0600
Subject: [PATCH 2/2] chore: add terraform pre-commit hooks (fmt, validate,
 tflint, trivy, docs)

---
 .pre-commit-config.yaml | 24 ++++++++++++++++++++++
 core/backend/README.md  | 42 +++++++++++++++++++++++++++++++++++++++
 core/vpc/README.md      | 44 +++++++++++++++++++++++++++++++++++++++++
 core/vpc/main.tf        | 14 ++++++-------
 core/vpc/variables.tf   |  5 +++--
 envs/dev/README.md      | 32 ++++++++++++++++++++++++++++++
 providers.tf            | 15 ++++++++++++++
 vpc/README.md           | 44 +++++++++++++++++++++++++++++++++++++++++
 8 files changed, 211 insertions(+), 9 deletions(-)
 create mode 100644 .pre-commit-config.yaml
 create mode 100644 core/backend/README.md
 create mode 100644 core/vpc/README.md
 create mode 100644 envs/dev/README.md
 create mode 100644 providers.tf
 create mode 100644 vpc/README.md

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..ae99059
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,24 @@
+default_stages: [pre-commit]
+
+repos:
+  - repo: https://github.com/antonbabenko/pre-commit-terraform
+    rev: v1.96.3
+    hooks:
+      - id: terraform_fmt
+        args:
+          - --args=-recursive
+
+      - id: terraform_validate
+
+      - id: terraform_tflint
+
+      - id: terraform_trivy
+        args:
+          - --hook-config=--parallelism-limit=1
+          - "--args=--severity=CRITICAL"
+          - "--args=--skip-dirs=**/.terraform"
+
+      - id: terraform_docs
+        args:
+          - --hook-config=--create-file-if-not-exist=true
+          - "--args=--lockfile=false"
diff --git a/core/backend/README.md b/core/backend/README.md
new file mode 100644
index 0000000..98d46b1
--- /dev/null
+++ b/core/backend/README.md
@@ -0,0 +1,42 @@
+# backend
+
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.6.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 5.60 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | ~> 5.60 |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_dynamodb_table.lock](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dynamodb_table) | resource |
+| [aws_s3_bucket.state](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
+| [aws_s3_bucket_lifecycle_configuration.state](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
+| [aws_s3_bucket_public_access_block.state](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
+| [aws_s3_bucket_server_side_encryption_configuration.state](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
+| [aws_s3_bucket_versioning.state](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |
+
+## Inputs
+
+No inputs.
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_tflock_table"></a> [tflock\_table](#output\_tflock\_table) | n/a |
+| <a name="output_tfstate_bucket"></a> [tfstate\_bucket](#output\_tfstate\_bucket) | n/a |
+<!-- END_TF_DOCS -->
diff --git a/core/vpc/README.md b/core/vpc/README.md
new file mode 100644
index 0000000..748ef41
--- /dev/null
+++ b/core/vpc/README.md
@@ -0,0 +1,44 @@
+# vpc
+
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.6.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 5.60 |
+
+## Providers
+
+No providers.
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 5.8.1 |
+
+## Resources
+
+No resources.
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_azs"></a> [azs](#input\_azs) | n/a | `list(string)` | <pre>[<br/>  "us-east-1a",<br/>  "us-east-1b"<br/>]</pre> | no |
+| <a name="input_env"></a> [env](#input\_env) | n/a | `string` | `"dev"` | no |
+| <a name="input_private_subnet_cidrs"></a> [private\_subnet\_cidrs](#input\_private\_subnet\_cidrs) | n/a | `list(string)` | <pre>[<br/>  "10.0.10.0/24",<br/>  "10.0.11.0/24"<br/>]</pre> | no |
+| <a name="input_project"></a> [project](#input\_project) | n/a | `string` | `"shopstack"` | no |
+| <a name="input_public_subnet_cidrs"></a> [public\_subnet\_cidrs](#input\_public\_subnet\_cidrs) | n/a | `list(string)` | <pre>[<br/>  "10.0.0.0/24",<br/>  "10.0.1.0/24"<br/>]</pre> | no |
+| <a name="input_region"></a> [region](#input\_region) | AWS region (currently unused in this module) | `string` | n/a | yes |
+| <a name="input_vpc_cidr"></a> [vpc\_cidr](#input\_vpc\_cidr) | n/a | `string` | `"10.0.0.0/16"` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_private_subnet_ids"></a> [private\_subnet\_ids](#output\_private\_subnet\_ids) | n/a |
+| <a name="output_public_subnet_ids"></a> [public\_subnet\_ids](#output\_public\_subnet\_ids) | n/a |
+| <a name="output_vpc_id"></a> [vpc\_id](#output\_vpc\_id) | Output VPC and subnet identifiers |
+<!-- END_TF_DOCS -->
diff --git a/core/vpc/main.tf b/core/vpc/main.tf
index 977b7de..2fe0f66 100644
--- a/core/vpc/main.tf
+++ b/core/vpc/main.tf
@@ -4,23 +4,23 @@ module "vpc" {
   version = "5.8.1"
 
   # Define VPC name based on project and environment
-  name            = "${var.project}-${var.env}"
+  name = "${var.project}-${var.env}"
 
   # Set the CIDR block for the VPC
-  cidr            = var.vpc_cidr
+  cidr = var.vpc_cidr
 
   # Define the Availability Zones to use
-  azs             = var.azs
+  azs = var.azs
 
   # Define CIDR blocks for public and private subnets
   public_subnets  = var.public_subnet_cidrs
   private_subnets = var.private_subnet_cidrs
 
   # Enable NAT Gateway for outbound traffic from private subnets
-  enable_nat_gateway   = false
+  enable_nat_gateway = false
 
   # Create one NAT Gateway per AZ for high availability
-  single_nat_gateway   = false   
+  single_nat_gateway     = false
   one_nat_gateway_per_az = false
 
   # Enable DNS hostnames and DNS resolution support within the VPC
@@ -36,6 +36,6 @@ module "vpc" {
 }
 
 # Output VPC and subnet identifiers
-output "vpc_id"             { value = module.vpc.vpc_id }
-output "public_subnet_ids"  { value = module.vpc.public_subnets }
+output "vpc_id" { value = module.vpc.vpc_id }
+output "public_subnet_ids" { value = module.vpc.public_subnets }
 output "private_subnet_ids" { value = module.vpc.private_subnets }
diff --git a/core/vpc/variables.tf b/core/vpc/variables.tf
index a0e7769..5d48ce2 100644
--- a/core/vpc/variables.tf
+++ b/core/vpc/variables.tf
@@ -8,9 +8,10 @@ variable "env" {
   default = "dev"
 }
 
+# tflint-ignore: terraform_unused_declarations
 variable "region" {
-  type    = string
-  default = "us-east-1"
+  type        = string
+  description = "AWS region (currently unused in this module)"
 }
 
 variable "vpc_cidr" {
diff --git a/envs/dev/README.md b/envs/dev/README.md
new file mode 100644
index 0000000..76fd619
--- /dev/null
+++ b/envs/dev/README.md
@@ -0,0 +1,32 @@
+# dev
+
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.6.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 5.60 |
+
+## Providers
+
+No providers.
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_network"></a> [network](#module\_network) | ../../vpc | n/a |
+
+## Resources
+
+No resources.
+
+## Inputs
+
+No inputs.
+
+## Outputs
+
+No outputs.
+<!-- END_TF_DOCS -->
diff --git a/providers.tf b/providers.tf
new file mode 100644
index 0000000..3d4114b
--- /dev/null
+++ b/providers.tf
@@ -0,0 +1,15 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
+
+provider "aws" {
+  region  = "us-east-1"
+  profile = "terraform-shopstack"
+}
diff --git a/vpc/README.md b/vpc/README.md
new file mode 100644
index 0000000..cdc9a8f
--- /dev/null
+++ b/vpc/README.md
@@ -0,0 +1,44 @@
+# vpc
+
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.0 |
+
+## Providers
+
+No providers.
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 5.8.1 |
+
+## Resources
+
+No resources.
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_azs"></a> [azs](#input\_azs) | n/a | `list(string)` | n/a | yes |
+| <a name="input_env"></a> [env](#input\_env) | n/a | `string` | n/a | yes |
+| <a name="input_private_subnet_cidrs"></a> [private\_subnet\_cidrs](#input\_private\_subnet\_cidrs) | n/a | `list(string)` | n/a | yes |
+| <a name="input_project"></a> [project](#input\_project) | n/a | `string` | n/a | yes |
+| <a name="input_public_subnet_cidrs"></a> [public\_subnet\_cidrs](#input\_public\_subnet\_cidrs) | n/a | `list(string)` | n/a | yes |
+| <a name="input_region"></a> [region](#input\_region) | n/a | `string` | n/a | yes |
+| <a name="input_vpc_cidr"></a> [vpc\_cidr](#input\_vpc\_cidr) | n/a | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_private_subnets"></a> [private\_subnets](#output\_private\_subnets) | n/a |
+| <a name="output_public_subnets"></a> [public\_subnets](#output\_public\_subnets) | n/a |
+| <a name="output_vpc_id"></a> [vpc\_id](#output\_vpc\_id) | n/a |
+<!-- END_TF_DOCS -->