# Terraform

> Use when editing tracked Terraform modules, environments, providers, state contracts, or examples.

- Skill: `paulasilvatech/terraform` (Agent Skill)
- Install (CLI): `npx skillmds@latest add paulasilvatech/terraform`
- Raw SKILL.md: https://api.skillmd.com/api/skills/paulasilvatech/terraform/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: paulasilvatech (https://skillmd.com/u/paulasilvatech)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/paulasilvatech/terraform

---


<!-- Generated from harness/github-copilot/plugins/open-horizons-platform/instructions/terraform.instructions.md by harness/claude-code/scripts/convert_from_copilot.py. Edit the source, not this file. -->

# Terraform

## Conventions

- Keep reusable modules focused with typed, described, and validated variables plus described outputs and explicit provider constraints.
- Pin providers and module versions; preserve the checked-in lock set and review upgrades separately from behavior changes.
- Use `terraform/modules/naming` for Azure names and its canonical ownership and cost tags.
- Prefer managed identity, Workload Identity, RBAC, private access, and diagnostic settings; never place secrets in HCL, examples, plans, or outputs.
- Mark unavoidable sensitive outputs and expose resource IDs rather than secret values.
- Keep state remote, encrypted, access-controlled, and separated by environment or live root.
- Preserve resource addresses during refactors with explicit move/import declarations; do not hide destructive replacement.
- Keep provider dependencies between Azure infrastructure and AKS/Kubernetes surfaces explicit; do not promise a single-pass empty-subscription plan when outputs do not yet exist.
- Keep `.tfvars.example` and Golden Path Terraform sanitized and runnable with documented inputs.

## Verification

- Formatting and targeted validation pass in the owning root.
- Plans are reviewed for replacement, deletion, privilege, public exposure, and secret leakage.
- Module changes preserve naming, tags, provider constraints, and output compatibility or document the intentional break.

## Do / Do Not

| Do | Do not |
| --- | --- |
| Pin providers, preserve module contracts, and review saved plans before approval. | Apply infrastructure, use unreviewed targets, or hide replacement and deletion. |
| Keep examples sanitized and state in approved backends. | Commit credentials, state, plans, or private tenant values. |

## Checklist Before Opening a PR

- [ ] The change matches this instruction's `applyTo` scope.
- [ ] Formatting and targeted validation pass in the owning root.
- [ ] The reviewed plan exposes replacement, deletion, privilege, and network changes.
- [ ] Naming, tags, provider constraints, and outputs remain compatible or document the break.
- [ ] No state, saved plan, credential, or unrelated edit is included.