How do I install the Infra Terraform skill?

Run npx skillmds@latest add tomevault-io/infra-terraform in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Infra Terraform safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Infra Terraform?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Infra Terraform free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Infra Terraform?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Infra Terraform by tomevault-io — Agent Skill

Name: Infra Terraform
Author: tomevault-io

Infra Terraform

Terraform / IaC skill. Covers modularity, state management, variables and environments, drift detection, least privilege, plan and review, and rollback and splitting. Used for designing or reviewing infrastructure code. Use when this capability is needed.

tomevault-io Updated Sep 17, 2026

File contents

Terraform / IaC

When to Use

Standing up new cloud infrastructure; converting hand-managed resources to IaC; multi-environment governance.
Collaboration protocol: see ops-agent-collaboration.

Golden Rules

Modular: reusable modules are versioned; business code composes them as root modules.
Remote state + locking: remote backend + locking; never share local state across people.
Environment isolation: dev / staging / prod each have their own state; never share one state across environments.
Plan must be reviewed: review the plan before apply; CI runs plan and outputs the diff.
Least-privilege IAM: the IaC execution role is authorized only within the change scope.
Drift detection: regularly run terraform plan to see drift versus reality.
Rollback path: either revert PR + apply, or restore from snapshot; never hand-fix.

Routines

Routine A: Repository Layout

modules/
  network/
  database/
envs/
  dev/main.tf
  staging/main.tf
  prod/main.tf
state backend: s3 + dynamodb lock

Routine B: Release Flow

PR modifies envs/staging
-> CI runs fmt + validate + plan
-> review plan output
-> merge + auto apply (staging)
prod requires a separate manual apply trigger

Routine C: Drift Monitoring

Daily scheduled plan per env; alert if output is non-empty
Manual reconciliation: either bring IaC in line or revert reality

Anti-patterns

[BAD] Multiple people editing local state

Fix: remote backend + locking.

[BAD] Manually changing resources in the console

Problem: drift from code. Fix: all changes go through IaC.

[BAD] One state containing multiple environments

Fix: separate state per env.

[BAD] Applying without reviewing the plan

Fix: CI plan output must be reviewed.

[BAD] IaC role with full admin

Fix: least privilege, scoped per module.

Review Checklist

Modular + remote state + locking?
Each environment with its own state?
Plan included in review?
Drift detection in place?
IAM minimal?
Rollback path clear?

Source: OriPoin/AgentOrch — distributed by TomeVault.

---name: infra-terraformdescription: Terraform / IaC skill. Covers modularity, state management, variables and environments, drift detection, least privilege, plan and review, and rollback and splitting. Used for designing or reviewing infrastructure code. Use when this capability is needed.---# Terraform / IaC## When to Use- Standing up new cloud infrastructure; converting hand-managed resources to IaC; multi-environment governance.- Collaboration protocol: see [ops-agent-collaboration](../ops-agent-collaboration/SKILL.md).## Golden Rules1. **Modular**: reusable modules are versioned; business code composes them as root modules.2. **Remote state + locking**: remote backend + locking; never share local state across people.3. **Environment isolation**: dev / staging / prod each have their own state; never share one state across environments.4. **Plan must be reviewed**: review the plan before apply; CI runs plan and outputs the diff.5. **Least-privilege IAM**: the IaC execution role is authorized only within the change scope.6. **Drift detection**: regularly run `terraform plan` to see drift versus reality.7. **Rollback path**: either revert PR + apply, or restore from snapshot; never hand-fix.## Routines### Routine A: Repository Layout```modules/ network/ database/envs/ dev/main.tf staging/main.tf prod/main.tfstate backend: s3 + dynamodb lock```### Routine B: Release Flow```PR modifies envs/staging-> CI runs fmt + validate + plan-> review plan output-> merge + auto apply (staging)prod requires a separate manual apply trigger```### Routine C: Drift Monitoring```Daily scheduled plan per env; alert if output is non-emptyManual reconciliation: either bring IaC in line or revert reality```## Anti-patterns### [BAD] Multiple people editing local stateFix: remote backend + locking.### [BAD] Manually changing resources in the consoleProblem: drift from code. Fix: all changes go through IaC.### [BAD] One state containing multiple environmentsFix: separate state per env.### [BAD] Applying without reviewing the planFix: CI plan output must be reviewed.### [BAD] IaC role with full adminFix: least privilege, scoped per module.## Review Checklist- Modular + remote state + locking?- Each environment with its own state?- Plan included in review?- Drift detection in place?- IAM minimal?- Rollback path clear?---> Source: [OriPoin/AgentOrch](https://github.com/OriPoin/AgentOrch) — distributed by [TomeVault](https://tomevault.io).

Frequently asked questions