# Exercise 1: Choose and Design an Environment Layout

`PetPal` currently has one Terraform directory and uses CLI workspaces `default` (which is production!), `staging` and `andrei-test`. Last month someone ran `terraform destroy` in what they thought was `andrei-test`; it was `default`. Production was down for 2 hours.

Requirements:
- dev, staging, prod; dev gets per-PR preview environments for the `services` unit
- prod must be impossible to change from a laptop
- network and database change rarely; services change daily
- staging must test the exact module versions that will go to prod

## Deliverables

1. **Folder layout** (tree) for modules and live environments, with units per environment and backend keys.
2. **Account and credential model**: AWS accounts, which role applies each environment, where those credentials exist.
3. **Promotion flow**: how a module change travels dev → staging → prod (which file changes in each step, who approves).
4. **Preview environments**: how a PR gets its own `services` stack and how it's destroyed (naming, state key, cost controls).
5. **Migration plan** from the current workspaces to the new layout without recreating production (`terraform state` / `init -migrate-state` / backend key changes).
6. **Guardrails** that would have prevented the destroy incident (at least four).

## Requirements Checklist

- [ ] Directory-per-environment layout with `live/{dev,staging,prod}/{network,data,services}` and shared `modules/`; one backend key per unit/env.
- [ ] Separate AWS accounts (or at least separate roles) per environment; prod apply role assumable only by CI (OIDC) — no human credentials.
- [ ] Promotion = PR bumping a pinned module version/ref per environment; prod requires approval in a protected environment.
- [ ] Previews use a unique name/prefix and state key per PR (or CLI workspaces scoped to previews), created on PR open and destroyed on merge/close, with TTL/cost alerts.
- [ ] Migration copies existing workspace state objects to the new keys (`env:/staging/...` → `staging/...`), runs `init -migrate-state`, and verifies `plan` shows no changes.
- [ ] Guardrails include prevent_destroy on critical resources, no prod credentials locally, plan review in CI, workspace/env shown in prompts or removal of CLI workspaces for prod, deletion protection on RDS/ALB.