Context
After reading a lot about Terraform and playing with it in minor projects, I'd like to start using it in a real, production environment.
As the environment is mostly in AWS, I'd go for the S3 backend, but I'm open to change this.
Task
I'd like to have separate Terraform projects (states) per infrastucture layer. Clearly, the top layers should be able to access to output of lower layers. I can use the Terraform remote state data source to get this data.
I've seen different setups around the internet.
Setup #1
|–globals
|–modules
|-infrastucture1
| |-layer1
| | |-layer2
Setup #1
|–globals
|–modules
|-infrastucture1
| |-layer1
| |-layer2
Setup #3
Everything above has its separate git repo.
Question
- What would be the recommended code organisation for this?
- What access rights do I have to add to the lower layers' S3 buckets to keep their state safe, but still allow Terraform remote state to access it?