Terraform

Terraform & OpenTofu Skill

Comprehensive Terraform and OpenTofu guidance covering testing, modules, CI/CD, security, and production patterns.

When to Use This Skill

Activate when:

• Creating new Terraform or OpenTofu configurations or modules
• Setting up testing infrastructure for IaC code
• Deciding between testing approaches (validate, plan, frameworks)
• Structuring multi-environment deployments
• Implementing CI/CD for infrastructure-as-code
• Reviewing or refactoring existing Terraform/OpenTofu projects

Don't use for:

• Basic Terraform syntax questions (Claude knows this)
• Provider-specific API reference (link to docs instead)
• Cloud platform questions unrelated to Terraform/OpenTofu

Reference Guide

Load detailed guidance based on context:

Core Principles

Module Hierarchy

Hierarchy: Resource → Resource Module → Infrastructure Module → Composition

Naming Conventions

# Descriptive, contextual names
resource "aws_instance" "web_server" { }
resource "aws_s3_bucket" "application_logs" { }

# "this" for singleton resources in modules
resource "aws_vpc" "this" { }

# Variables: context-specific, snake_case
var.vpc_cidr_block          # Not just "cidr"
var.database_instance_class # Not just "instance_class"

Code Structure Standards

Resource block ordering:

1. count or for_each FIRST (blank line after)
2. Other arguments
3. tags as last real argument
4. depends_on after tags (if needed)
5. lifecycle at the very end (if needed)

Variable block ordering:

1. description (ALWAYS required)
2. type
3. default
4. sensitive / nullable
5. validation

Testing Strategy

Decision Matrix

Testing Pyramid

        /\
       /  \          End-to-End (Expensive)
      /____\         Full environment deployment
     /      \
    /________\       Integration (Moderate)
   /          \      Module testing in isolation
  /____________\
 /              \    Static Analysis (Cheap)
/________________\   validate, fmt, lint, security scanning

Modern Terraform Features

Version Verification

CRITICAL: Before proposing any Terraform configuration, you MUST:

1. Check the Terraform version:

   terraform version -json | python3 -c "import json,sys; print(json.load(sys.stdin)['terraform_version'])"
   

2. Check provider versions: terraform providers
3. Never assume feature availability from training data
4. Search official documentation if in doubt

CI/CD Integration

Recommended Stages

1. Validate — format + syntax + linting + security scanning
2. Test — automated tests (native or Terratest)
3. Plan — generate and review execution plan
4. Apply — execute changes (with approvals for production)

Cost Optimization

1. Use mocking for PR validation (free)
2. Run integration tests only on main branch (controlled cost)
3. Implement auto-cleanup (prevent orphaned resources)
4. Tag all test resources (track spending)

Security Essentials

# Static security scanning
trivy config .
checkov -d .

Avoid: secrets in variables, default VPC, missing encryption, open security groups. Use: AWS Secrets Manager, dedicated VPCs, encryption at rest, least-privilege SGs.

Constraints

MUST DO

• Use semantic versioning for modules
• Enable remote state with locking
• Validate inputs with validation blocks
• Use consistent naming conventions
• Tag all resources for cost tracking
• Pin provider versions
• Run terraform fmt and validate
• Include description on all variables and outputs

MUST NOT DO

• Store secrets in plain text or state
• Use local state for production
• Skip state locking
• Hardcode environment-specific values
• Create circular module dependencies
• Commit .terraform directories
• Use count when items may be reordered (use for_each)

Attribution

Based on antonbabenko/terraform-skill and jeffallan/claude-skills. Additional resources: terraform-best-practices.com.

Source: jdiegosierra/enterprise-agent-plugins — distributed by TomeVault.