Dhruvinrsoni Agentskills Garden Terraform Iac

Terraform / Infrastructure as Code

"If you can't reproduce your infrastructure from code, it's not infrastructure."

Context

Invoked when provisioning cloud infrastructure. Generates Terraform modules following best practices for state management, security, and reusability.

Micro-Skills

1. Module Generation ⚡ (Power Mode)

Steps:

1. Identify required resources from the system design.
2. Generate Terraform module structure:

   terraform/
   ├── main.tf           # Resource definitions
   ├── variables.tf      # Input variables
   ├── outputs.tf        # Output values
   ├── providers.tf      # Provider configuration
   ├── versions.tf       # Terraform and provider version constraints
   └── terraform.tfvars  # (gitignored) Environment-specific values
   

3. Use data sources for existing resources (don't recreate).
4. Tag all resources consistently (team, project, environment).

2. State Management ⚡ (Power Mode)

Steps:

1. Configure remote state backend:
   • AWS: S3 + DynamoDB for locking.
   • Azure: Storage Account + Blob.
   • GCP: GCS bucket.
2. Enable state encryption.
3. Set up state locking to prevent concurrent modifications.
4. Never commit terraform.tfstate or .tfvars with secrets.

3. Environment Separation ⚡ (Power Mode)

Steps:

1. Use workspaces or directory-based separation:

   environments/
   ├── dev/
   │   ├── main.tf → ../../modules/
   │   └── terraform.tfvars
   ├── staging/
   └── production/
   

2. Use the same modules across environments with different variables.
3. Implement environment promotion (dev → staging → prod).

4. Security & Compliance ⚡ (Power Mode)

Steps:

1. Use tfsec or checkov to scan for misconfigurations.
2. Encrypt sensitive outputs.
3. Use IAM roles with least privilege.
4. Enable audit logging for infrastructure changes.
5. Run terraform plan in CI, require approval for apply.

Outputs

Scope

In Scope

• Generating Terraform (and OpenTofu) modules, configurations, and variable definitions
• Supporting alternative IaC tools: Pulumi, CloudFormation, and Bicep when requested
• Remote state backend configuration with locking and encryption (S3/DynamoDB, Azure Blob, GCS)
• Environment separation strategies: workspaces, directory-based, or Terragrunt hierarchies
• Drift detection: comparing deployed resources against declared state via terraform plan
• Modular design: composable, reusable modules with well-defined inputs, outputs, and versioning
• Security scanning of IaC files with tfsec, checkov, or trivy config
• Resource tagging standards and naming conventions across all managed resources
• Import of existing (manually created) resources into Terraform state

Out of Scope

• Application source code or runtime configuration changes
• CI/CD pipeline design (handled by ci-pipeline; this skill produces the IaC files the pipeline deploys)
• Kubernetes manifest or Helm chart authoring (handled by kubernetes-helm)
• Cloud console or CLI-based manual resource creation
• Cost optimization analysis (pricing model assessment, reserved-instance planning)
• IAM policy design beyond what is needed for Terraform execution roles

Guardrails

• Never commit terraform.tfstate, .tfvars files with secrets, or provider credentials to version control.
• Always configure a remote backend with state locking before any apply operation.
• Pin provider versions in versions.tf to prevent unexpected upgrades.
• Tag every resource with at minimum: project, environment, managed-by=terraform.
• Run terraform fmt and terraform validate before committing any changes.
• Run security scanner (tfsec / checkov) on every change; do not merge with unresolved critical findings.
• Use data sources to reference existing resources — never recreate resources managed outside this configuration.
• All sensitive variables must be marked sensitive = true and must never appear in plan output or logs.
• Require terraform plan output review in CI before any terraform apply execution.

Ask-When-Ambiguous

Triggers

• The target cloud provider is not specified or the project spans multiple providers
• State backend preferences are unknown (S3, Azure Blob, GCS, Terraform Cloud)
• The environment separation strategy is not defined (workspaces vs. directory-based vs. Terragrunt)
• Existing infrastructure needs to be imported but the resource IDs are not provided
• The desired IaC tool is not Terraform (user may prefer Pulumi, CloudFormation, or Bicep)

Question Templates

1. "Which cloud provider(s) are you targeting — AWS, Azure, GCP, or multi-cloud?"
2. "Where should Terraform state be stored — S3 + DynamoDB, Azure Storage, GCS, or Terraform Cloud?"
3. "How do you want to separate environments — Terraform workspaces, directory-per-env, or Terragrunt?"
4. "Are there existing cloud resources that need to be imported into Terraform state? If so, provide the resource IDs."
5. "Do you want to use Terraform/OpenTofu, or would you prefer Pulumi, CloudFormation, or Bicep?"

Decision Criteria

Success Criteria

• All Terraform files pass terraform validate and terraform fmt checks
• Remote state backend is configured with encryption and locking enabled
• terraform plan shows expected changes with zero unexpected resource modifications
• Security scan (tfsec/checkov) reports zero critical findings
• All resources are tagged with project, environment, and managed-by labels
• Modules have documented variables.tf and outputs.tf with descriptions for every variable
• Sensitive values are marked sensitive = true and excluded from logs
• Environment separation is consistent — same modules deployed across dev, staging, and production

Failure Modes

Audit Log

• [timestamp] module-generated: Created Terraform module at <path> for <resource-type> on <provider>
• [timestamp] state-backend-configured: Set up <backend-type> backend with encryption=<bool>, locking=<bool>
• [timestamp] environment-created: Generated environment config for <env-name> using <separation-strategy>
• [timestamp] drift-detected: terraform plan shows <n> unexpected changes in <environment>
• [timestamp] security-scanned: Ran <scanner> — <critical> critical, <high> high findings
• [timestamp] resource-imported: Imported <resource-type>.<resource-name> with ID <resource-id>
• [timestamp] plan-approved: terraform plan reviewed and approved for <environment> with <n> changes

Source: dhruvinrsoni/agentskills-garden — distributed by TomeVault.