# Y Miyazaki Config Terraform Review

> Input

- Skill: `tomevault-io/y-miyazaki-config-terraform-review` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/y-miyazaki-config-terraform-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/y-miyazaki-config-terraform-review/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/y-miyazaki-config-terraform-review

---


## Input

- Terraform `.tf`/`.tfvars` files and PR context or file diffs (required)

## Output Specification

Return structured Markdown in accordance with [references/common-output-format.md](references/common-output-format.md).

Minimal inline contract (used if reference file is unavailable):

```markdown
## Checks Summary
- Total: <n>, Passed: <n>, Failed: <n>, Deferred: <n>

## Checks (Failed/Deferred Only)
| ItemID | Status | Evidence | Fix |

## Issues
1. <ItemID>: <title>
   - File: <path>#L<line>
   - Problem: <specific>
   - Recommendation: <fix>
```

Each issue must include file path, risk summary, and remediation guidance.

## Execution Scope

- Apply review checklist from [references/common-checklist.md](references/common-checklist.md)
- **Do not execute validation tools** (`terraform fmt`, `terraform validate`, `tflint`, `trivy`, or `terraform-validation` skill scripts)
- This skill consumes pre-existing validation output logs as input — it does not produce them
- Do not modify Terraform files or approve/merge PRs
- Scope includes Terraform only; Terragrunt files are out of scope.
- Scope assumes a single repository context.
- Scope is provider-agnostic unless a referenced checklist item states provider-specific constraints.

### USE FOR:

- reviewing Terraform PRs for security, architecture, and module design issues
- assessing cross-module risks and environment-specific concerns in Terraform changes
- evaluating Terraform changes when validation output logs are available or partially available

### DO NOT USE FOR:

- executing validation tools (`terraform fmt/validate`, `tflint`, `trivy`) — use `terraform-validation` skill
- implementing new Terraform resources as code changes
- running any CLI validation workflow

## Reference Files Guide

- [common-checklist.md](references/common-checklist.md) (always read)
- [common-output-format.md](references/common-output-format.md) (always read)
- [category-global.md](references/category-global.md), [category-security.md](references/category-security.md), [category-modules.md](references/category-modules.md), [category-state.md](references/category-state.md) - Read when reviewing resource structure, security, modules, or state management.
- [category-ci-lint.md](references/category-ci-lint.md), [category-compliance.md](references/category-compliance.md), [category-cost.md](references/category-cost.md), [category-data-sources.md](references/category-data-sources.md) - Read when reviewing CI integration, compliance, cost concerns, or data sources.
- [category-dependency.md](references/category-dependency.md), [category-events.md](references/category-events.md), [category-migration.md](references/category-migration.md), [category-naming.md](references/category-naming.md) - Read when reviewing dependencies, events, migration, or naming conventions.
- [category-outputs.md](references/category-outputs.md), [category-patterns.md](references/category-patterns.md), [category-performance.md](references/category-performance.md), [category-tagging.md](references/category-tagging.md) - Read when reviewing outputs, design patterns, performance, or tagging.
- [category-tfvars.md](references/category-tfvars.md), [category-variables.md](references/category-variables.md), [category-versioning.md](references/category-versioning.md) - Read when reviewing variable definitions, tfvars, or version constraints.
- When uncertain which categories apply, default to: category-security, category-global, category-modules, category-state.
- [common-troubleshooting.md](references/common-troubleshooting.md) - Read on failure or when evidence is unavailable

## Workflow

1. Read PR context and module scope.
2. Check if `terraform-validation` output logs exist (pre-generated by the `terraform-validation` skill or CI). If logs are missing, inform user: "Validation logs are needed for a complete review. Please run the terraform-validation skill and share output." Then proceed with partial review: evaluate security and architecture checks directly from `.tf` source, defer tool-dependent checks.
3. If PR context is unavailable, review file diffs only and defer PR-context-dependent checks.
4. If changed files contain no `.tf` or `.tfvars`, return `status: skipped` with reason `no Terraform review target`.
5. If validation output is partial, keep available findings and defer missing-tool checks with explicit tool name.
6. Review checklist categories touched by changed files and collect failed/deferred items.
7. If a referenced category file is missing, defer affected checks with the missing file path.
8. Output required sections per [references/common-output-format.md](references/common-output-format.md). Prioritize `SEC-*` findings first, then correctness, then maintainability. For conflicting findings, prioritize the higher-severity category and document the conflict in `## Issues`.

### Examples

- Prompt: `Review this Terraform PR and return failed/deferred checks only.`
- Input context: changed files `terraform/env/prod/main.tf`, `terraform/env/prod/variables.tf`, `terraform/env/prod/terraform.tfvars`; validation log missing `tflint` output.
- Output sample: `## Checks Summary` with deferred count, `## Checks (Failed/Deferred Only)` including deferred `tflint` check with reason `missing terraform-validation output`, and `## Issues` ordered by `SEC-*`, correctness, maintainability.
- Prompt: `Review this Terraform PR and report security reasoning from existing validation logs.`
- Output sample: security findings are evaluated from existing logs and code context; no validator commands are executed.

---
> Source: [y-miyazaki/config](https://github.com/y-miyazaki/config) — distributed by [TomeVault](https://tomevault.io).
<!-- tomevault:4.0:skill_md:2026-06-15 -->