{"id":"0b5687a7-1cc2-4462-88ef-a03d4fa6777f","shortId":"MWq4Tb","kind":"skill","title":"terraform","tagline":"Use when creating, adopting, refactoring, or operating Terraform, *.tf files, .terraform.lock.hcl, terragrunt.hcl, root modules, backends, state, workspaces, imports, CI plan/apply, tests, or policy checks.","description":"# Terraform\n\n## Overview\n\nUse this skill to keep Terraform work small-state, reviewable, and brownfield-safe.\n\nThis repo should treat Terraform as four separate concerns:\n\n1. **Place** Terraform in the right part of the repo.\n2. **Provision** new infrastructure with clear root-module boundaries.\n3. **Adopt** existing infrastructure without taking unsafe shortcuts.\n4. **Operate** Terraform through validated plans, CI, and policy checks.\n\nFor this repo family, default to **brownfield embedding** inside an existing product repo unless the user explicitly wants a dedicated infrastructure repository.\n\n## Quick Reference\n\n| Decision | Default | Avoid |\n|---|---|---|\n| Brownfield placement | `infra/terraform/` inside the existing repo | Mixing Terraform into `src/` or app runtime folders |\n| Environment model | Separate directories and separate state per env/root | Using CLI workspaces for `dev` / `stage` / `prod` |\n| State size | One root module per deployable unit or boundary | Giant multi-service roots |\n| GCP backend | GCS remote state | Local state for shared environments |\n| Local auth | ADC | Long-lived service account keys |\n| CI auth | Attached service account on GCP, otherwise WIF | Downloaded JSON keys when avoidable |\n| Sensitive values | Treat state and plan artifacts as sensitive; prefer Secret Manager plus `sensitive` / `ephemeral` patterns when supported | Hardcoding secrets or committing plan/state artifacts |\n| Brownfield adoption | Export/import, review, then refactor with `moved` blocks | Hand-editing state to “make it fit” |\n\n## Operating Lanes\n\n### Lane 1: Repo and State Design\n\n- Keep Terraform in a clearly scoped infrastructure area.\n- Prefer `infra/terraform/` for brownfield repos.\n- Keep reusable modules separate from live environment roots.\n- Keep each root module small enough that reviewers can understand a plan.\n\n### Lane 2: Greenfield Provisioning\n\n- Start with a small root module and a reusable module boundary only where reuse is real.\n- Pin provider and module versions.\n- Check in `.terraform.lock.hcl`.\n\n### Lane 3: Brownfield Adoption\n\n- Inventory what already exists.\n- Export or import existing resources into Terraform.\n- Normalize the generated or imported configuration.\n- Refactor with `moved` blocks instead of destructive rename/recreate cycles.\n\n### Lane 4: Day-2 Operations\n\n- Run `fmt`, `validate`, saved `plan`, and policy checks before `apply`.\n- Prefer CI-mediated `plan` and `apply`, especially for shared environments.\n- Upgrade versions intentionally and review lockfile drift.\n\n<workflow>\n\n## Workflow\n\n### Step 1: Choose Repo Placement\n\nUse the smallest layout that preserves clear ownership.\n\n- **Brownfield application repo:** put Terraform under `infra/terraform/`.\n- **Dedicated infra repo:** keep the same internal split of `modules/` and live environment roots.\n- **Service-specific IaC:** place service roots under `infra/terraform/environments/<env>/<service>/`.\n\nRead [references/layout.md](references/layout.md) before creating directories.\n\n### Step 2: Define Root-Module Boundaries\n\nA root module is a state boundary. Treat it as an operational boundary too.\n\n- Split by application, shared platform service, or blast-radius boundary.\n- Prefer separate roots for shared networking, project/bootstrap, and app-service stacks.\n- Keep unrelated systems out of the same state even if they deploy together.\n\n### Step 3: Establish Backend and Auth\n\nFor GCP, default to:\n\n- **Local development:** ADC\n- **Privileged local work:** service account impersonation\n- **CI on Google Cloud:** attached service account\n- **CI outside Google Cloud:** Workload Identity Federation\n- **Remote state:** GCS backend per root/environment\n\nRead [references/gcp.md](references/gcp.md) before writing provider or backend configuration.\n\nIf the root spans multiple projects, regions, or beta-only resources, define explicit provider aliases instead of overloading one default `google` provider configuration.\n\n### Step 3.5: Handle Sensitive Values Early\n\nTreat Terraform state files, saved plan files, and plan JSON as sensitive artifacts.\n\n- Keep state and plan artifacts out of Git.\n- Prefer Secret Manager or another external secret source over plaintext secrets in `.tfvars`.\n- Use `sensitive = true` for inputs and outputs that must be redacted.\n- Use `ephemeral = true` or write-only arguments when the provider/resource supports them and the value should stay out of state and plan files entirely.\n\n### Step 4: Pick the Environment Model\n\nUse separate directories and separate state for `dev`, `stage`, and `prod`.\n\nUse Terraform CLI workspaces only when all of the following are true:\n\n- the configuration is the same shape in every instance\n- credentials and approvals are the same\n- the backend is shared intentionally\n- the instances are peers, not separate systems\n\nIf any of those conditions are false, do not use CLI workspaces as the primary environment model.\n\n### Step 5: Implement and Validate\n\nBefore proposing an `apply`, run the low-risk checks first:\n\n1. `terraform fmt`\n2. `terraform init`\n3. `terraform validate`\n4. `terraform plan -out=tfplan`\n5. `terraform show -json tfplan > tfplan.json` when policy tooling or machine review is needed\n6. `terraform test` when the module or root justifies it\n\nUse [references/testing.md](references/testing.md) for the validation pipeline.\n\n### Step 6: Brownfield Adoption Path\n\nWhen a system already exists:\n\n1. Decide the target root-module boundary before importing anything.\n2. Export existing GCP resources if that accelerates discovery.\n3. Add `import` blocks or targeted imports for the selected boundary.\n4. Generate configuration when helpful, but treat it as a scaffold.\n5. Refactor into the desired module shape.\n6. Use `moved` blocks to preserve state history during renames or splits.\n\nUse [references/brownfield.md](references/brownfield.md) for the exact flow.\n\n### Step 7: Connect Service-Specific Patterns\n\nAfter the Terraform structure is sound, pull in service-specific references:\n\n- Cloud Run examples: [../cloud-run/references/terraform.md](../cloud-run/references/terraform.md)\n- GKE examples: [../gke/references/terraform.md](../gke/references/terraform.md)\n\n</workflow>\n\n<guardrails>\n\n## Guardrails\n\n- **Do not use CLI workspaces for system decomposition** or for environments with separate credentials or approvals.\n- **Do not put unrelated services in one state** just because a single PR touches them.\n- **Do not hand-edit Terraform state** unless it is a documented break-glass recovery.\n- **Do not normalize brownfield infrastructure by deleting and recreating it** when import and refactor paths exist.\n- **Do not treat exported or generated HCL as production-ready** until it is cleaned up and reviewed.\n- **Do not rely on service account keys by default on GCP** when ADC, impersonation, or Workload Identity Federation are available.\n- **Do not treat remote state as non-sensitive**. State files and saved plans can contain secrets, tokens, and generated credentials.\n- **Do not skip `.terraform.lock.hcl` in root modules** that will be shared or reviewed.\n- **Do not hide destructive changes inside apply-only workflows**. Save and review the plan first.\n- **Do not introduce Terragrunt as the default architecture** unless the repo already standardized on it. Plain Terraform is the baseline.\n- **Do not let helper scripts become hidden infrastructure dependencies**. Prefer provider resources and documented modules first.\n- **Do not leave stateful resources without lifecycle protection**. Use `prevent_destroy` and provider-specific deletion protection where the platform supports them.\n\n</guardrails>\n\n<validation>\n\n## Validation Checkpoint\n\nBefore claiming a Terraform change is ready, verify:\n\n- [ ] the repo layout keeps Terraform out of application runtime folders\n- [ ] each root module has a clear ownership and state boundary\n- [ ] environment separation uses directories/state, or workspace use is explicitly justified\n- [ ] backend and authentication strategy are documented\n- [ ] sensitive inputs, state, and plan artifacts are handled as secrets\n- [ ] provider aliases or `google-beta` configuration are explicit when multi-project, multi-region, or beta-only resources are involved\n- [ ] provider and module versions are pinned intentionally\n- [ ] `.terraform.lock.hcl` is committed when the root is meant to be versioned\n- [ ] `terraform fmt`, `terraform validate`, and a saved `terraform plan -out=...` were run\n- [ ] stateful resources use lifecycle protection or an explicitly documented exception\n- [ ] brownfield imports, generated config, and `moved` blocks are documented when applicable\n- [ ] policy validation and module tests were considered for shared or sensitive infrastructure\n\n</validation>\n\n<example>\n\n## Example\n\nBrownfield application repo layout:\n\n```text\nrepo/\n├── src/\n├── tests/\n├── .agents/\n└── infra/\n    └── terraform/\n        ├── modules/\n        │   ├── project-services/\n        │   ├── network/\n        │   └── cloud-run-service/\n        └── environments/\n            ├── dev/\n            │   ├── shared-network/\n            │   └── api-service/\n            ├── stage/\n            │   ├── shared-network/\n            │   └── api-service/\n            └── prod/\n                ├── shared-network/\n                └── api-service/\n```\n\nMinimal root files:\n\n```text\napi-service/\n├── backend.tf\n├── main.tf\n├── providers.tf\n├── terraform.tf\n├── terraform.tfvars\n├── variables.tf\n├── outputs.tf\n└── README.md\n```\n\nGCP root skeleton:\n\n```hcl\nterraform {\n  required_version = \">= 1.10.0\"\n\n  required_providers {\n    google = {\n      source  = \"hashicorp/google\"\n      version = \"~> 6.0\" # Pin to a current minor series intentionally.\n    }\n  }\n\n  backend \"gcs\" {}\n}\n\nprovider \"google\" {\n  project = var.project_id\n  region  = var.region\n}\n\nmodule \"service\" {\n  source     = \"../../modules/cloud-run-service\"\n  project_id = var.project_id\n  region     = var.region\n  name       = var.name\n}\n```\n\n</example>\n\n---\n\n## References Index\n\n- **[Layout and Workspaces](references/layout.md)**\n  - Brownfield repo placement, root-module boundaries, directory conventions, and when not to use CLI workspaces.\n- **[GCP Terraform Patterns](references/gcp.md)**\n  - ADC, impersonation, WIF, GCS backends, API enablement, module pinning, and policy validation on Google Cloud.\n- **[Brownfield Adoption](references/brownfield.md)**\n  - Export, import blocks, generated configuration, and refactoring with `moved` blocks.\n- **[Testing and Delivery](references/testing.md)**\n  - `fmt`, `validate`, saved plans, `terraform test`, CI, and policy checks.\n\n## Official References\n\n- <https://docs.cloud.google.com/docs/terraform/best-practices/general-style-structure>\n- <https://docs.cloud.google.com/docs/terraform/best-practices/root-modules>\n- <https://docs.cloud.google.com/docs/terraform/best-practices/operations>\n- <https://docs.cloud.google.com/docs/terraform/best-practices/testing>\n- <https://docs.cloud.google.com/docs/terraform/authentication>\n- <https://docs.cloud.google.com/docs/terraform/resource-management/export>\n- <https://docs.cloud.google.com/docs/terraform/resource-management/import>\n- <https://docs.cloud.google.com/docs/terraform/policy-validation/quickstart>\n- <https://developer.hashicorp.com/terraform/language/style>\n- <https://developer.hashicorp.com/terraform/language/state/workspaces>\n- <https://developer.hashicorp.com/terraform/language/import>\n- <https://developer.hashicorp.com/terraform/language/modules/develop/refactoring>","tags":["terraform","flow","cofin","agent-skills","ai-agents","beads","claude-code","codex","cursor","developer-tools","gemini-cli","opencode"],"capabilities":["skill","source-cofin","skill-terraform","topic-agent-skills","topic-ai-agents","topic-beads","topic-claude-code","topic-codex","topic-cursor","topic-developer-tools","topic-gemini-cli","topic-opencode","topic-plugin","topic-slash-commands","topic-spec-driven-development"],"categories":["flow"],"synonyms":[],"warnings":[],"endpointUrl":"https://skills.sh/cofin/flow/terraform","protocol":"skill","transport":"skills-sh","auth":{"type":"none","details":{"cli":"npx skills add cofin/flow","source_repo":"https://github.com/cofin/flow","install_from":"skills.sh"}},"qualityScore":"0.455","qualityRationale":"deterministic score 0.46 from registry signals: · indexed on github topic:agent-skills · 11 github stars · SKILL.md body (11,548 chars)","verified":false,"liveness":"unknown","lastLivenessCheck":null,"agentReviews":{"count":0,"score_avg":null,"cost_usd_avg":null,"success_rate":null,"latency_p50_ms":null,"narrative_summary":null,"summary_updated_at":null},"enrichmentModel":"deterministic:skill-github:v1","enrichmentVersion":1,"enrichedAt":"2026-05-18T19:07:40.064Z","embedding":null,"createdAt":"2026-04-23T13:04:02.286Z","updatedAt":"2026-05-18T19:07:40.064Z","lastSeenAt":"2026-05-18T19:07:40.064Z","tsv":"'-2':339 '/../modules/cloud-run-service':1308 '/cloud-run/references/terraform.md':858,859 '/docs/terraform/authentication':1401 '/docs/terraform/best-practices/general-style-structure':1389 '/docs/terraform/best-practices/operations':1395 '/docs/terraform/best-practices/root-modules':1392 '/docs/terraform/best-practices/testing':1398 '/docs/terraform/policy-validation/quickstart':1410 '/docs/terraform/resource-management/export':1404 '/docs/terraform/resource-management/import':1407 '/gke/references/terraform.md':862,863 '/terraform/language/import':1419 '/terraform/language/modules/develop/refactoring':1422 '/terraform/language/state/workspaces':1416 '/terraform/language/style':1413 '1':52,240,371,713,768 '1.10.0':1281 '2':62,279,420,716,779 '3':72,307,477,719,788 '3.5':549 '4':80,337,625,722,799 '5':698,727,810 '6':741,759,817 '6.0':1288 '7':837 'acceler':786 'account':180,186,493,501,951 'adc':175,488,958,1343 'add':789 'adopt':5,73,221,309,761,1359 'agent':1225 'alias':539,1131 'alreadi':312,766,1027 'anoth':579 'anyth':778 'api':1243,1250,1257,1264,1348 'api-servic':1242,1249,1256,1263 'app':129,460 'app-servic':459 'appli':350,357,705,1007 'applic':384,442,1091,1203,1218 'apply-on':1006 'approv':664,880 'architectur':1023 'area':252 'argument':606 'artifact':202,219,566,571,1125 'attach':184,499 'auth':174,183,481 'authent':1116 'avail':965 'avoid':116,195 'backend':16,164,479,512,522,669,1114,1296,1347 'backend.tf':1266 'baselin':1035 'becom':1041 'beta':533,1135,1148 'beta-on':532,1147 'blast':448 'blast-radius':447 'block':228,330,791,820,1199,1363,1370 'boundari':71,157,292,425,432,438,450,775,798,1103,1329 'break':909 'break-glass':908 'brownfield':41,96,117,220,256,308,383,760,915,1193,1217,1323,1358 'brownfield-saf':40 'chang':1004,1080 'check':25,89,303,348,711,1384 'checkpoint':1075 'choos':372 'ci':20,86,182,353,495,502,1381 'ci-medi':352 'claim':1077 'clean':942 'clear':67,249,381,1099 'cli':142,643,690,868,1337 'cloud':498,505,855,1234,1357 'cloud-run-servic':1233 'commit':217,1162 'concern':51 'condit':684 'config':1196 'configur':326,523,547,654,801,1136,1365 'connect':838 'consid':1210 'contain':981 'convent':1331 'creat':4,417 'credenti':662,878,986 'current':1292 'cycl':335 'day':338 'decid':769 'decis':114 'decomposit':872 'dedic':109,390 'default':94,115,484,544,954,1022 'defin':421,536 'delet':918,1067 'deliveri':1373 'depend':1044 'deploy':154,474 'design':244 'desir':814 'destroy':1062 'destruct':333,1003 'dev':145,637,1238 'develop':487 'developer.hashicorp.com':1412,1415,1418,1421 'developer.hashicorp.com/terraform/language/import':1417 'developer.hashicorp.com/terraform/language/modules/develop/refactoring':1420 'developer.hashicorp.com/terraform/language/state/workspaces':1414 'developer.hashicorp.com/terraform/language/style':1411 'directori':135,418,632,1330 'directories/state':1107 'discoveri':787 'docs.cloud.google.com':1388,1391,1394,1397,1400,1403,1406,1409 'docs.cloud.google.com/docs/terraform/authentication':1399 'docs.cloud.google.com/docs/terraform/best-practices/general-style-structure':1387 'docs.cloud.google.com/docs/terraform/best-practices/operations':1393 'docs.cloud.google.com/docs/terraform/best-practices/root-modules':1390 'docs.cloud.google.com/docs/terraform/best-practices/testing':1396 'docs.cloud.google.com/docs/terraform/policy-validation/quickstart':1408 'docs.cloud.google.com/docs/terraform/resource-management/export':1402 'docs.cloud.google.com/docs/terraform/resource-management/import':1405 'document':907,1049,1119,1191,1201 'download':191 'drift':368 'earli':553 'edit':231,900 'embed':97 'enabl':1349 'enough':271 'entir':623 'env/root':140 'environ':132,172,264,361,402,628,695,875,1104,1237 'ephemer':210,600 'especi':358 'establish':478 'even':471 'everi':660 'exact':834 'exampl':857,861,1216 'except':1192 'exist':74,100,122,313,317,767,781,927 'explicit':106,537,1112,1138,1190 'export':314,780,931,1361 'export/import':222 'extern':580 'fals':686 'famili':93 'feder':508,963 'file':11,557,560,622,976,1261 'first':712,1015,1051 'fit':236 'flow':835 'fmt':342,715,1172,1375 'folder':131,1093 'follow':650 'four':49 'gcp':163,188,483,782,956,1274,1339 'gcs':165,511,1297,1346 'generat':323,800,933,985,1195,1364 'giant':158 'git':574 'gke':860 'glass':910 'googl':497,504,545,1134,1284,1299,1356 'google-beta':1133 'greenfield':280 'guardrail':864 'hand':230,899 'hand-edit':229,898 'handl':550,1127 'hardcod':214 'hashicorp/google':1286 'hcl':934,1277 'help':803 'helper':1039 'hidden':1042 'hide':1002 'histori':824 'iac':407 'id':1302,1310,1312 'ident':507,962 'imperson':494,959,1344 'implement':699 'import':19,316,325,777,790,794,923,1194,1362 'index':1318 'infra':391,1226 'infra/terraform':119,254,389 'infra/terraform/environments':412 'infrastructur':65,75,110,251,916,1043,1215 'init':718 'input':592,1121 'insid':98,120,1005 'instanc':661,674 'instead':331,540 'intent':364,672,1159,1295 'intern':396 'introduc':1018 'inventori':310 'involv':1152 'json':192,563,730 'justifi':749,1113 'keep':32,245,258,266,393,463,567,1087 'key':181,193,952 'lane':238,239,278,306,336 'layout':378,1086,1220,1319 'leav':1054 'let':1038 'lifecycl':1058,1186 'live':178,263,401 'local':168,173,486,490 'lockfil':367 'long':177 'long-liv':176 'low':709 'low-risk':708 'machin':737 'main.tf':1267 'make':234 'manag':207,577 'meant':1167 'mediat':354 'minim':1259 'minor':1293 'mix':124 'model':133,629,696 'modul':15,70,152,260,269,287,291,301,399,424,428,746,774,815,993,1050,1096,1155,1207,1228,1305,1328,1350 'move':227,329,819,1198,1369 'multi':160,1141,1144 'multi-project':1140 'multi-region':1143 'multi-servic':159 'multipl':528 'must':596 'name':1315 'need':740 'network':456,1232,1241,1248,1255 'new':64 'non':973 'non-sensit':972 'normal':321,914 'offici':1385 'one':150,543,887 'oper':8,81,237,340,437 'otherwis':189 'output':594 'outputs.tf':1272 'outsid':503 'overload':542 'overview':27 'ownership':382,1100 'part':58 'path':762,926 'pattern':211,842,1341 'peer':676 'per':139,153,513 'pick':626 'pin':298,1158,1289,1351 'pipelin':757 'place':53,408 'placement':118,374,1325 'plain':1031 'plaintext':584 'plan':85,201,277,345,355,559,562,570,621,724,979,1014,1124,1179,1378 'plan/apply':21 'plan/state':218 'platform':444,1071 'plus':208 'polici':24,88,347,734,1204,1353,1383 'pr':893 'prefer':205,253,351,451,575,1045 'preserv':380,822 'prevent':1061 'primari':694 'privileg':489 'prod':147,640,1252 'product':101,937 'production-readi':936 'project':529,1142,1230,1300,1309 'project-servic':1229 'project/bootstrap':457 'propos':703 'protect':1059,1068,1187 'provid':299,520,538,546,1046,1065,1130,1153,1283,1298 'provider-specif':1064 'provider/resource':609 'providers.tf':1268 'provis':63,281 'pull':849 'put':386,883 'quick':112 'radius':449 'read':413,515 'readi':938,1082 'readme.md':1273 'real':297 'recoveri':911 'recreat':920 'redact':598 'refactor':6,225,327,811,925,1367 'refer':113,854,1317,1386 'references/brownfield.md':830,831,1360 'references/gcp.md':516,517,1342 'references/layout.md':414,415,1322 'references/testing.md':752,753,1374 'region':530,1145,1303,1313 'reli':948 'remot':166,509,969 'renam':826 'rename/recreate':334 'repo':44,61,92,102,123,241,257,373,385,392,1026,1085,1219,1222,1324 'repositori':111 'requir':1279,1282 'resourc':318,535,783,1047,1056,1150,1184 'reus':295 'reusabl':259,290 'review':38,223,273,366,738,945,999,1012 'right':57 'risk':710 'root':14,69,151,162,265,268,286,403,410,423,427,453,526,748,773,992,1095,1165,1260,1275,1327 'root-modul':68,422,772,1326 'root/environment':514 'run':341,706,856,1182,1235 'runtim':130,1092 'safe':42 'save':344,558,978,1010,1177,1377 'scaffold':809 'scope':250 'script':1040 'secret':206,215,576,581,585,982,1129 'select':797 'sensit':196,204,209,551,565,589,974,1120,1214 'separ':50,134,137,261,452,631,634,678,877,1105 'seri':1294 'servic':161,179,185,405,409,445,461,492,500,840,852,885,950,1231,1236,1244,1251,1258,1265,1306 'service-specif':404,839,851 'shape':658,816 'share':171,360,443,455,671,997,1212,1240,1247,1254 'shared-network':1239,1246,1253 'shortcut':79 'show':729 'singl':892 'size':149 'skeleton':1276 'skill':30 'skill-terraform' 'skip':989 'small':36,270,285 'small-stat':35 'smallest':377 'sound':848 'sourc':582,1285,1307 'source-cofin' 'span':527 'specif':406,841,853,1066 'split':397,440,828 'src':127,1223 'stack':462 'stage':146,638,1245 'standard':1028 'start':282 'state':17,37,138,148,167,169,199,232,243,431,470,510,556,568,619,635,823,888,902,970,975,1055,1102,1122,1183 'stay':616 'step':370,419,476,548,624,697,758,836 'strategi':1117 'structur':846 'support':213,610,1072 'system':465,679,765,871 'take':77 'target':771,793 'terraform':1,9,26,33,47,54,82,125,246,320,387,555,642,714,717,720,723,728,742,845,901,1032,1079,1088,1171,1173,1178,1227,1278,1340,1379 'terraform.lock.hcl':12,305,990,1160 'terraform.tf':1269 'terraform.tfvars':1270 'terragrunt':1019 'terragrunt.hcl':13 'test':22,743,1208,1224,1371,1380 'text':1221,1262 'tf':10 'tfplan':726,731 'tfplan.json':732 'tfvar':587 'togeth':475 'token':983 'tool':735 'topic-agent-skills' 'topic-ai-agents' 'topic-beads' 'topic-claude-code' 'topic-codex' 'topic-cursor' 'topic-developer-tools' 'topic-gemini-cli' 'topic-opencode' 'topic-plugin' 'topic-slash-commands' 'topic-spec-driven-development' 'touch':894 'treat':46,198,433,554,805,930,968 'true':590,601,652 'understand':275 'unit':155 'unless':103,903,1024 'unrel':464,884 'unsaf':78 'upgrad':362 'use':2,28,141,375,588,599,630,641,689,751,818,829,867,1060,1106,1110,1185,1336 'user':105 'valid':84,343,701,721,756,1074,1174,1205,1354,1376 'valu':197,552,614 'var.name':1316 'var.project':1301,1311 'var.region':1304,1314 'variables.tf':1271 'verifi':1083 'version':302,363,1156,1170,1280,1287 'want':107 'wif':190,1345 'without':76,1057 'work':34,491 'workflow':369,1009 'workload':506,961 'workspac':18,143,644,691,869,1109,1321,1338 'write':519,604 'write-on':603","prices":[{"id":"ef6639dd-0e19-42d2-b46f-8a4154adee8a","listingId":"0b5687a7-1cc2-4462-88ef-a03d4fa6777f","amountUsd":"0","unit":"free","nativeCurrency":null,"nativeAmount":null,"chain":null,"payTo":null,"paymentMethod":"skill-free","isPrimary":true,"details":{"org":"cofin","category":"flow","install_from":"skills.sh"},"createdAt":"2026-04-23T13:04:02.286Z"}],"sources":[{"listingId":"0b5687a7-1cc2-4462-88ef-a03d4fa6777f","source":"github","sourceId":"cofin/flow/terraform","sourceUrl":"https://github.com/cofin/flow/tree/main/skills/terraform","isPrimary":false,"firstSeenAt":"2026-04-23T13:04:02.286Z","lastSeenAt":"2026-05-18T19:07:40.064Z"}],"details":{"listingId":"0b5687a7-1cc2-4462-88ef-a03d4fa6777f","quickStartSnippet":null,"exampleRequest":null,"exampleResponse":null,"schema":null,"openapiUrl":null,"agentsTxtUrl":null,"citations":[],"useCases":[],"bestFor":[],"notFor":[],"kindDetails":{"org":"cofin","slug":"terraform","github":{"repo":"cofin/flow","stars":11,"topics":["agent-skills","ai-agents","beads","claude-code","codex","context-driven-development","cursor","developer-tools","gemini-cli","opencode","plugin","slash-commands","spec-driven-development","subagents","tdd","workflow"],"license":"apache-2.0","html_url":"https://github.com/cofin/flow","pushed_at":"2026-04-27T19:07:26Z","description":"Context-Driven Development toolkit for AI agents — spec-first planning, TDD workflow, and Beads integration.","skill_md_sha":"0e567ad965f883c47ebcd86db1ffa9773126ee0a","skill_md_path":"skills/terraform/SKILL.md","default_branch":"main","skill_tree_url":"https://github.com/cofin/flow/tree/main/skills/terraform"},"layout":"multi","source":"github","category":"flow","frontmatter":{"name":"terraform","description":"Use when creating, adopting, refactoring, or operating Terraform, *.tf files, .terraform.lock.hcl, terragrunt.hcl, root modules, backends, state, workspaces, imports, CI plan/apply, tests, or policy checks."},"skills_sh_url":"https://skills.sh/cofin/flow/terraform"},"updatedAt":"2026-05-18T19:07:40.064Z"}}