One Terraform state for a whole environment meant 11-minute plans, fragile applies and an app deploy that could touch the VPC. How we split it into layers by rate of change and blast radius, passed values between them, moved resources with removed and import blocks, and kept the apply order sane.
We inherited an AWS account built by hand: 60 resources nobody dared to touch. Terraform import blocks with -generate-config-out let us adopt them in reviewed pull requests with a zero-change plan as proof. The workflow, the cleanup the generated code needs, and the traps.
Our shared Terraform modules broke consumers twice in one quarter. We added terraform test: fast plan-mode tests with mocked providers on every pull request, and a nightly apply-mode suite against a sandbox account. The test layout, what to assert, and what it costs.