---
globs: '["terraform/**/*.tf"]'
alwaysApply: true
---

Always run terraform validate and plan before applying changes. Reference PCI-DSS in comments.