Why Every Terraform Module Needs Proper Validation

If you've ever deployed a Terraform module only to discover that someone passed a private subnet ID where a public one was expected, you know the pain. The deployment "succeeds", but nothing works. You spend 30 minutes debugging, only to realize the input was wrong from the start. Terraform has tools to prevent this. Most people don't use them. The Problem: Silent Misconfiguration Consider a simple NAT Gateway module: variable "subnet_id" { description = "Subnet to place the NAT Gateway in" type = string } resource "aws_nat_gateway" "this" { allocation_id = aws_eip . this . id subnet_id = var . subnet_id } This accepts any subnet ID. Public, private, doesn't matter. Terraform won't complain. AWS won't complain (immediately). But your private subnets won't have internet access, and you'll spend time figuring out why. The Fix: Validation Blocks Since Terraform 1.0, you can add validation blocks to variables: variable "public_subnet_ids" { description = "Public subnet IDs for NAT Gateway