Terraform skill

--- name: terraform-skill description: Use when writing, reviewing, or debugging Terraform/OpenTofu modules, tests, CI, scans, or state ops:diagnoses failure modes (identity churn, secrets, blast radius, CI drift, state corruption) with version-aware guards. license: Apache-2.0 metadata: author: Anton Babenko version: 1.17.1 --- # Terraform Skill for Claude Diagnose-first guidance for Terraform and OpenTofu. The core file is a workflow; depth is provided by references loaded on demand. ## Response Contract Every Terraform/OpenTofu response must include: 1. Assumptions & version floor : runtime (terraform or tofu), exact version, providers, state backend, execution path (local/CI/Cloud/Atlantis), environment criticality. State assumptions explicitly if the user did not provide them. 2. Risk category addressed : one or more of: identity churn, secret exposure, blast radius, CI drift, compliance gaps, state corruption, provider upgrade risk, testing blind spots. 3. Chosen remediation & tradeoffs : what was chosen, what was sacrificed, and why. 4. Validation plan : exact commands (fmt -check, validate, plan -out, policy check) tailored to the runtime and risk tier. 5. Rollback notes : for any destructive or state-altering change: how to undo it, what evidence to retain. Never recommend applying changes directly to production without a reviewed plan artifact and approval. Never run “terraform destroy” (targeted or full) without first running “terraform plan -destroy” and showing the user every resource that will be deleted:including implicit dependencies pulled in via locals or `for_each. Obtain explicit confirmation before proceeding. Never use -auto-approve on destroy. ## Workflow 1. **Capture execution context** : runtime+version, provider(s), backend, execution path, environment criticality. 2. **Diagnose failure mode(s)** using the routing table below. If the intent spans categories, load both references. 3. **Load only the matching reference file(s)** : do not preload depth that the task does not need. 4. **Propose a fix with risk controls** : explain why this addresses the failure mode, what could still go wrong, and the safeguards (tests, approvals, rollback). 5. **Generate artifacts** : HCL, migration blocks (moved, import), CI changes, policy rules. 6. **Validate before finalizing** : run validation commands tailored to the risk tier. 7. **Generate the Response Contract** at the end. ## Diagnose Before You Generate | Failure category | Symptoms | Primary references | |------------------|----------|--------------------| | **Identity churn** | Resource addresses change after refactoring, count index churn, missing moved blocks | [Code Patterns: count vs. for_each](references/ code-patterns.md #count-vs-for_each-deep-dive), [Code Patterns: moved blocks](references/ code-patterns.md #moved-blocks-terraform-11), [Code Patterns: LLM mistakes](references/ code-patterns.md #llm-mistake-checklist--code-patterns) | | **Secret exposure** | Secrets in defaults, state, logs, CI artifacts | [Security & Compliance](references/ security-compliance.md), [Code Patterns: write-only](references/ code-patterns.md #write-only-arguments-terraform-111), [State Management](references/ state-management.md) | | **Blast radius** | Oversized stacks, shared production/non-production state, unsafe apply operations | [State Management](references/ state-management.md), [Module Patterns](references/ module-patterns.md) | | **Destroy cascade** | Targeted destroy deletes more than expected; locals referencing a targeted resource make all for_each` consumers implicit dependents | Response Contract: plan-destroy first; State Management: Safe Destroy | | CI drift | Local plan ≠ CI plan, apply without reviewed artifact, unpinned versions | CI/CD Workflows, Code Patterns: versions | | Compliance gaps | Missing policy stage, no approval model, no evidence retention | Security & Compliance, CI/CD Workflows | | Testing blind spots | Plan-only validation of computed values, set-type indexing, confusion between mock and real data