terraform-skill

Name: terraform-skill
Author: antonbabenko

2.2kstars196forks

How to install terraform-skill?

antonbabenko/terraform-skill/terraform-skill

$npx -y skills add antonbabenko/terraform-skill --skill terraform-skill

Installs into the current project.

Summary

Use when writing, reviewing, or debugging Terraform/OpenTofu modules, tests, CI, scans, or state ops - diagnoses failure mode (identity churn, secrets, blast radius, CI drift, state corruption) with version-aware guards.

Files · 1

View on GitHub

SKILL.md

1	# Terraform Skill for Claude
2
3	Diagnose-first guidance for Terraform and OpenTofu. Core file is a workflow; depth lives in references loaded on demand.
4
5	## Response Contract
6
7	Every Terraform/OpenTofu response must include:
8
9	1. Assumptions & version floor — runtime (`terraform` or `tofu`), exact version, providers, state backend, execution path (local/CI/Cloud/Atlantis), environment criticality. State assumptions explicitly if the user did not provide them.
10	2. Risk category addressed — one or more of: identity churn, secret exposure, blast radius, CI drift, compliance gaps, state corruption, provider upgrade risk, testing blind spots.
11	3. Chosen remediation & tradeoffs — what was chosen, what was traded off, why.
12	4. Validation plan — exact commands (`fmt -check`, `validate`, `plan -out`, policy check) tailored to runtime and risk tier.
13	5. Rollback notes — for any destructive or state-mutating change: how to undo, what evidence to keep.
14
15	Never recommend direct production apply without a reviewed plan artifact and approval.
16
17	Never run `terraform destroy` (targeted or full) without first running `terraform plan -destroy` and showing the user every resource that will be deleted — including implicit dependents pulled in via locals or `for_each`. Get explicit confirmation before proceeding. Never use `-auto-approve` on destroy.
18
19	## Workflow
20
21	1. Capture execution context — runtime+version, provider(s), backend, execution path, environment criticality.
22	2. Diagnose failure mode(s) using the routing table below. If intent spans categories, load both references.
23	3. Load only the matching reference file(s) — do not preload depth the task does not need.
24	4. Propose fix with risk controls — why this addresses the mode, what could still go wrong, guardrails (tests/approvals/rollback).
25	5. Generate artifacts — HCL, migration blocks (`moved`, `import`), CI changes, policy rules.
26	6. Validate before finalizing — run validation commands tailored to risk tier.
27	7. Emit the Response Contract at the end.
28
29	## Diagnose Before You Generate
30
31	\| Failure category \| Symptoms \| Primary references \|
32	\|------------------\|----------\|--------------------\|
33	\| Identity churn \| Resource addresses shift after refactor, `count` index churn, missing `moved` blocks \| [Code Patterns: count vs for_each](references/code-patterns.md#count-vs-for_each-deep-dive), [Code Patterns: moved blocks](references/code-patterns.md#moved-blocks-terraform-11), [Code Patterns: LLM mistakes](references/code-patterns.md#llm-mistake-checklist--code-patterns) \|
34	\| Secret exposure \| Secrets in defaults, state, logs, CI artifacts \| [Security & Compliance](references/security-compliance.md), [Code Patterns: write-only](references/code-patterns.md#write-only-arguments-terraform-111), [State Management](references/state-management.md) \|
35	\| Blast radius \| Oversized stacks, shared prod/non-prod state, unsafe applies \| [State Management](references/state-management.md), [Module Patterns](references/module-patterns.md) \|
36	\| Destroy cascade \| Targeted destroy deletes more than expected; locals referencing a targeted resource make all `for_each` consumers implicit dependents \| Response Contract: plan-destroy first; [State Management: Safe Destroy](references/state-management.md#safe-destroy-protocol) \|
37	\| CI drift \| Local plan ≠ CI plan, apply without reviewed artifact, unpinned versions \| [CI/CD Workflows](references/ci-cd-workflows.md), [Code Patterns: versions](references/code-patterns.md#version-management) \|
38	\| Compliance gaps \| Missing policy stage, no approval model, no evidence retention \| [Security & Compliance](references/security-compliance.md), [CI/CD Workflows](references/ci-cd-workflows.md) \|
39	\| Testing blind spots \| Plan-only validation of computed values, set-type indexing, mock/real confusion \| [Testing Frameworks](references/testing-frameworks.md) \|
40	\| State corruption / recovery \| Stuck lock, backend migration, drift reconciliation \| [State Management](references/state-management.md) \|
41	\| Provider upgrade risk \| Breaking-change provider bump, unpinned modules \| [Code Patterns: versions](references/code-patterns.md#version-management), [Module Patterns](references/module-patterns.md) \|
42	\| Provider lifecycle \| Removing a provider with resources still in state, orphaned resources, `removed` block usage \| [State Management: Provider Removal](references/state-management.md#provider-removal) \|
43	\| Bootstrap / orchestration misuse \| `null_resource` + `local-exec` for bootstrap, `remote-exec` for setup scripts, provisioner stdout leaking secrets in CI logs \| [Code Patte

People who liked this also viewed

6 picks

Type

terraform-skill

2.2kstars196forks

View on GitHub

How to install terraform-skill?

antonbabenko/terraform-skill/terraform-skill

$npx -y skills add antonbabenko/terraform-skill --skill terraform-skill

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Terraform Skill for Claude
2
3	Diagnose-first guidance for Terraform and OpenTofu. Core file is a workflow; depth lives in references loaded on demand.
4
5	## Response Contract
6
7	Every Terraform/OpenTofu response must include:
8
9	1. Assumptions & version floor — runtime (`terraform` or `tofu`), exact version, providers, state backend, execution path (local/CI/Cloud/Atlantis), environment criticality. State assumptions explicitly if the user did not provide them.
10	2. Risk category addressed — one or more of: identity churn, secret exposure, blast radius, CI drift, compliance gaps, state corruption, provider upgrade risk, testing blind spots.
11	3. Chosen remediation & tradeoffs — what was chosen, what was traded off, why.
12	4. Validation plan — exact commands (`fmt -check`, `validate`, `plan -out`, policy check) tailored to runtime and risk tier.
13	5. Rollback notes — for any destructive or state-mutating change: how to undo, what evidence to keep.
14
15	Never recommend direct production apply without a reviewed plan artifact and approval.
16
17	Never run `terraform destroy` (targeted or full) without first running `terraform plan -destroy` and showing the user every resource that will be deleted — including implicit dependents pulled in via locals or `for_each`. Get explicit confirmation before proceeding. Never use `-auto-approve` on destroy.
18
19	## Workflow
20
21	1. Capture execution context — runtime+version, provider(s), backend, execution path, environment criticality.
22	2. Diagnose failure mode(s) using the routing table below. If intent spans categories, load both references.
23	3. Load only the matching reference file(s) — do not preload depth the task does not need.
24	4. Propose fix with risk controls — why this addresses the mode, what could still go wrong, guardrails (tests/approvals/rollback).
25	5. Generate artifacts — HCL, migration blocks (`moved`, `import`), CI changes, policy rules.
26	6. Validate before finalizing — run validation commands tailored to risk tier.
27	7. Emit the Response Contract at the end.
28
29	## Diagnose Before You Generate
30
31	\| Failure category \| Symptoms \| Primary references \|
32	\|------------------\|----------\|--------------------\|
33	\| Identity churn \| Resource addresses shift after refactor, `count` index churn, missing `moved` blocks \| [Code Patterns: count vs for_each](references/code-patterns.md#count-vs-for_each-deep-dive), [Code Patterns: moved blocks](references/code-patterns.md#moved-blocks-terraform-11), [Code Patterns: LLM mistakes](references/code-patterns.md#llm-mistake-checklist--code-patterns) \|
34	\| Secret exposure \| Secrets in defaults, state, logs, CI artifacts \| [Security & Compliance](references/security-compliance.md), [Code Patterns: write-only](references/code-patterns.md#write-only-arguments-terraform-111), [State Management](references/state-management.md) \|
35	\| Blast radius \| Oversized stacks, shared prod/non-prod state, unsafe applies \| [State Management](references/state-management.md), [Module Patterns](references/module-patterns.md) \|
36	\| Destroy cascade \| Targeted destroy deletes more than expected; locals referencing a targeted resource make all `for_each` consumers implicit dependents \| Response Contract: plan-destroy first; [State Management: Safe Destroy](references/state-management.md#safe-destroy-protocol) \|
37	\| CI drift \| Local plan ≠ CI plan, apply without reviewed artifact, unpinned versions \| [CI/CD Workflows](references/ci-cd-workflows.md), [Code Patterns: versions](references/code-patterns.md#version-management) \|
38	\| Compliance gaps \| Missing policy stage, no approval model, no evidence retention \| [Security & Compliance](references/security-compliance.md), [CI/CD Workflows](references/ci-cd-workflows.md) \|
39	\| Testing blind spots \| Plan-only validation of computed values, set-type indexing, mock/real confusion \| [Testing Frameworks](references/testing-frameworks.md) \|
40	\| State corruption / recovery \| Stuck lock, backend migration, drift reconciliation \| [State Management](references/state-management.md) \|
41	\| Provider upgrade risk \| Breaking-change provider bump, unpinned modules \| [Code Patterns: versions](references/code-patterns.md#version-management), [Module Patterns](references/module-patterns.md) \|
42	\| Provider lifecycle \| Removing a provider with resources still in state, orphaned resources, `removed` block usage \| [State Management: Provider Removal](references/state-management.md#provider-removal) \|
43	\| Bootstrap / orchestration misuse \| `null_resource` + `local-exec` for bootstrap, `remote-exec` for setup scripts, provisioner stdout leaking secrets in CI logs \| [Code Patte

People who liked this also viewed

6 picks

Type