# Terraform Expert > Terraform/OpenTofu IaC — state management, DRY modules, safety practices Use when this capability is needed. - Skill: `tomevault-io/terraform-expert` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/terraform-expert` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/terraform-expert/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/terraform-expert --- # Terraform/OpenTofu Expert Maintain robust, DRY, and secure infrastructure as code. ## When to Use - Writing or reviewing Terraform/OpenTofu configurations - Planning infrastructure changes - Managing state and provider versions ## Conventions - **State**: `tofu plan` before `apply`. NEVER edit state manually. Pin provider versions. - **DRY**: Use modules for common resources (VPC, VM, SG). Use `locals` for naming logic. - **Data-Driven**: Fetch existing IDs via `data` sources. Validate inputs with `validation` blocks. - **Safety**: `sensitive = true` for secrets. `prevent_destroy = true` for production resources. - **Scaling**: Prefer `for_each` over `count` for resource sets. ## Bundled Rules ### IaC Tools 1. **Documentation First**: Check current official docs before generating any IaC config. 2. **No Hardcoded Versions**: Verify OS images, ISOs, container tags exist before referencing. 3. **Environment Awareness**: Consult project environment docs for endpoints, storage, networks. ## Anti-Patterns - `tofu apply` without `plan` — always review the plan first - Manual state editing — use `tofu state mv/rm` commands - Unpinned provider versions — leads to non-reproducible infrastructure --- > Source: [muratovv/ai-hats](https://github.com/muratovv/ai-hats) — distributed by [TomeVault](https://tomevault.io).