Workspaces vs Directory-per-Environment

Scenario: Development and production need different providers, access controls, and release cadence, but one workspace-driven root has accumulated dozens of conditionals.

Directory-per-environment or separate repositories create explicit roots with separate backend configuration, credentials, and review controls. Workspaces reduce duplication when topology truly matches. A common compromise uses reusable modules plus thin environment roots. Choose based on isolation, topology divergence, promotion needs, and team ownership—not on which produces fewer files.

Analogy: Workspaces are identical apartments on different floors; separate roots are different buildings. If production needs a vault and guards that development does not, it may need a different building.

A worked configuration

environments/
  dev/main.tf      # calls ../../modules/service
  stage/main.tf
  prod/main.tf
modules/
  service/main.tf

Duplicated environment roots can drift, so keep them thin and promote module versions deliberately. A single conditional root can hide risky production-only behavior, so constrain complexity and test every branch.

Note: Treat the plan as a change contract: understand every create, update, replacement, and destroy before approving it.

Goal: Reinforce this lesson in the tf-workspace-environments Terraform lab. Open /labs/terraform and choose slug tf-workspace-environments; the lab runs real Terraform against the offline FakeCloud provider.