Y Miyazaki Config Terraform Review

Input

• Terraform .tf/.tfvars files and PR context or file diffs (required)

Output Specification

Return structured Markdown in accordance with references/common-output-format.md.

Minimal inline contract (used if reference file is unavailable):

## Checks Summary
- Total: <n>, Passed: <n>, Failed: <n>, Deferred: <n>

## Checks (Failed/Deferred Only)
| ItemID | Status | Evidence | Fix |

## Issues
1. <ItemID>: <title>
   - File: <path>#L<line>
   - Problem: <specific>
   - Recommendation: <fix>

Each issue must include file path, risk summary, and remediation guidance.

Execution Scope

• Apply review checklist from references/common-checklist.md
• Do not execute validation tools (terraform fmt, terraform validate, tflint, trivy, or terraform-validation skill scripts)
• This skill consumes pre-existing validation output logs as input — it does not produce them
• Do not modify Terraform files or approve/merge PRs
• Scope includes Terraform only; Terragrunt files are out of scope.
• Scope assumes a single repository context.
• Scope is provider-agnostic unless a referenced checklist item states provider-specific constraints.

USE FOR:

• reviewing Terraform PRs for security, architecture, and module design issues
• assessing cross-module risks and environment-specific concerns in Terraform changes
• evaluating Terraform changes when validation output logs are available or partially available

DO NOT USE FOR:

• executing validation tools (terraform fmt/validate, tflint, trivy) — use terraform-validation skill
• implementing new Terraform resources as code changes
• running any CLI validation workflow

Reference Files Guide

• common-checklist.md (always read)
• common-output-format.md (always read)
• category-global.md, category-security.md, category-modules.md, category-state.md - Read when reviewing resource structure, security, modules, or state management.
• category-ci-lint.md, category-compliance.md, category-cost.md, category-data-sources.md - Read when reviewing CI integration, compliance, cost concerns, or data sources.
• category-dependency.md, category-events.md, category-migration.md, category-naming.md - Read when reviewing dependencies, events, migration, or naming conventions.
• category-outputs.md, category-patterns.md, category-performance.md, category-tagging.md - Read when reviewing outputs, design patterns, performance, or tagging.
• category-tfvars.md, category-variables.md, category-versioning.md - Read when reviewing variable definitions, tfvars, or version constraints.
• When uncertain which categories apply, default to: category-security, category-global, category-modules, category-state.
• common-troubleshooting.md - Read on failure or when evidence is unavailable

Workflow

1. Read PR context and module scope.
2. Check if terraform-validation output logs exist (pre-generated by the terraform-validation skill or CI). If logs are missing, inform user: "Validation logs are needed for a complete review. Please run the terraform-validation skill and share output." Then proceed with partial review: evaluate security and architecture checks directly from .tf source, defer tool-dependent checks.
3. If PR context is unavailable, review file diffs only and defer PR-context-dependent checks.
4. If changed files contain no .tf or .tfvars, return status: skipped with reason no Terraform review target.
5. If validation output is partial, keep available findings and defer missing-tool checks with explicit tool name.
6. Review checklist categories touched by changed files and collect failed/deferred items.
7. If a referenced category file is missing, defer affected checks with the missing file path.
8. Output required sections per references/common-output-format.md. Prioritize SEC-* findings first, then correctness, then maintainability. For conflicting findings, prioritize the higher-severity category and document the conflict in ## Issues.

Examples

• Prompt: Review this Terraform PR and return failed/deferred checks only.
• Input context: changed files terraform/env/prod/main.tf, terraform/env/prod/variables.tf, terraform/env/prod/terraform.tfvars; validation log missing tflint output.
• Output sample: ## Checks Summary with deferred count, ## Checks (Failed/Deferred Only) including deferred tflint check with reason missing terraform-validation output, and ## Issues ordered by SEC-*, correctness, maintainability.
• Prompt: Review this Terraform PR and report security reasoning from existing validation logs.
• Output sample: security findings are evaluated from existing logs and code context; no validator commands are executed.

Source: y-miyazaki/config — distributed by TomeVault.