How do I install the Terraform Deploy skill?

Run npx skillmds@latest add filipemotta/terraform-deploy in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Terraform Deploy safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Terraform Deploy?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Terraform Deploy free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Terraform Deploy?

filipemotta (@filipemotta) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Terraform Deploy by filipemotta — Agent Skill

Name: Terraform Deploy
Rating: 4.2 (5 reviews)
Author: filipemotta

Terraform Deploy

Runs the Terraform stack deploy pipeline (fmt → validate → plan → apply) in sandbox/dev environments. Use when the user asks to deploy, apply, provision or bring up Terraform infrastructure in a non-production environment, even without mentioning "terraform-deploy" explicitly. With a stack name as argument (e.g. "01-networking"), deploys only that stack; with no argument, deploys all stacks in sequence. Always skips the remote-backend stack. NEVER use against a production workspace/environment.

filipemotta Updated Sep 10, 2026

File contents

What this skill does

Runs the complete deploy pipeline for one or more Terraform stacks:

terraform fmt — formats the code
terraform validate — validates the configuration
terraform plan — generates and shows the execution plan
terraform apply -auto-approve — applies the changes

Safety boundary (read first)

This is an EXECUTION skill for sandbox and dev only:

Before step 4, confirm the target is not production. Check, in this order: terraform workspace show is not production; the -var-file in use is not a production file; the AWS account is not the production account. If any check points to production, STOP and tell the user that production applies belong in CI with human approval.
Pair this skill with hard guardrails (plan-only IAM role for production, permission boundaries, SCPs). A skill is a soft guardrail, not a substitute.

Identifying stacks

Stacks are directories containing *.tf files, typically prefixed with a two-digit order number (00-, 01-, 02-...). Rules:

ALWAYS skip remote-backend stacks (any variation: 00-remote-backend, remote_backend, remote-backend-stack). Their state bootstraps the others and never enters bulk operations.
List candidates with: ls -d */ from the Terraform root.

Arguments

With argument (e.g. /terraform-deploy 01-networking): deploy only the specified stack.
No argument: discover all stacks (except remote-backend) and deploy each one sequentially, in numeric order. Never in parallel (state and dependency conflicts).

Deploy pipeline per stack

Run the steps below for each stack, always in order. If any step fails, stop and report the error before continuing.

Step 1 — fmt

cd <stack-path>
terraform fmt

If files were reformatted, list them. Not an error, just record it.

Step 2 — validate

terraform validate

If it fails, show the complete error message and do NOT proceed to the next steps for this stack.

Step 3 — plan

terraform plan -var-file="envs/dev.tfvars"

Show the complete plan output to the user before continuing. If there is no envs/dev.tfvars, run without -var-file and record that in the report.

Step 4 — apply

terraform apply -auto-approve -var-file="envs/dev.tfvars"

Only after the safety boundary checks passed. If there is no envs/dev.tfvars, run without -var-file.

Expected output

For each stack, present a clear status block:

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Stack: 01-networking
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✓ fmt      — OK
✓ validate — Success
✓ plan     — 12 to add, 0 to change, 0 to destroy
✓ apply    — Apply complete! Resources: 12 added

If any step fails, mark it with ✗ and show the error message. When deploying multiple stacks, show a final summary for all of them.

---name: terraform-deploydescription: Runs the Terraform stack deploy pipeline (fmt → validate → plan → apply) in sandbox/dev environments. Use when the user asks to deploy, apply, provision or bring up Terraform infrastructure in a non-production environment, even without mentioning "terraform-deploy" explicitly. With a stack name as argument (e.g. "01-networking"), deploys only that stack; with no argument, deploys all stacks in sequence. Always skips the remote-backend stack. NEVER use against a production workspace/environment.---## What this skill doesRuns the complete deploy pipeline for one or more Terraform stacks:1. `terraform fmt` — formats the code2. `terraform validate` — validates the configuration3. `terraform plan` — generates and shows the execution plan4. `terraform apply -auto-approve` — applies the changes## Safety boundary (read first)This is an EXECUTION skill for **sandbox and dev only**:- Before step 4, confirm the target is not production. Check, in this order: `terraform workspace show` is not `production`; the `-var-file` in use is not a production file; the AWS account is not the production account. If any check points to production, STOP and tell the user that production applies belong in CI with human approval.- Pair this skill with hard guardrails (plan-only IAM role for production, permission boundaries, SCPs). A skill is a soft guardrail, not a substitute.## Identifying stacksStacks are directories containing `*.tf` files, typically prefixed with atwo-digit order number (`00-`, `01-`, `02-`...). Rules:- ALWAYS skip remote-backend stacks (any variation: `00-remote-backend`, `remote_backend`, `remote-backend-stack`). Their state bootstraps the others and never enters bulk operations.- List candidates with: `ls -d */` from the Terraform root.## Arguments- **With argument** (e.g. `/terraform-deploy 01-networking`): deploy only the specified stack.- **No argument**: discover all stacks (except remote-backend) and deploy each one sequentially, in numeric order. Never in parallel (state and dependency conflicts).## Deploy pipeline per stackRun the steps below for each stack, always in order. If any step fails, stopand report the error before continuing.### Step 1 — fmt```bashcd <stack-path>terraform fmt```If files were reformatted, list them. Not an error, just record it.### Step 2 — validate```bashterraform validate```If it fails, show the complete error message and do NOT proceed to the nextsteps for this stack.### Step 3 — plan```bashterraform plan -var-file="envs/dev.tfvars"```Show the complete plan output to the user before continuing. If there is no`envs/dev.tfvars`, run without `-var-file` and record that in the report.### Step 4 — apply```bashterraform apply -auto-approve -var-file="envs/dev.tfvars"```Only after the safety boundary checks passed. If there is no`envs/dev.tfvars`, run without `-var-file`.## Expected outputFor each stack, present a clear status block:```━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━Stack: 01-networking━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━✓ fmt — OK✓ validate — Success✓ plan — 12 to add, 0 to change, 0 to destroy✓ apply — Apply complete! Resources: 12 added```If any step fails, mark it with `✗` and show the error message. When deployingmultiple stacks, show a final summary for all of them.

Frequently asked questions