{"id":"82e8faf9-6595-43e0-9e03-727ec5ea8f3c","shortId":"SCvpSG","kind":"skill","title":"terraform-skill","tagline":"Use when writing, reviewing, or debugging Terraform/OpenTofu modules, tests, CI, scans, or state ops - diagnoses failure mode (identity churn, secrets, blast radius, CI drift, state corruption) with version-aware guards.","description":"# Terraform Skill for Claude\n\nDiagnose-first guidance for Terraform and OpenTofu. Core file is a workflow; depth lives in references loaded on demand.\n\n## Response Contract\n\nEvery Terraform/OpenTofu response must include:\n\n1. **Assumptions & version floor** — runtime (`terraform` or `tofu`), exact version, providers, state backend, execution path (local/CI/Cloud/Atlantis), environment criticality. State assumptions explicitly if the user did not provide them.\n2. **Risk category addressed** — one or more of: identity churn, secret exposure, blast radius, CI drift, compliance gaps, state corruption, provider upgrade risk, testing blind spots.\n3. **Chosen remediation & tradeoffs** — what was chosen, what was traded off, why.\n4. **Validation plan** — exact commands (`fmt -check`, `validate`, `plan -out`, policy check) tailored to runtime and risk tier.\n5. **Rollback notes** — for any destructive or state-mutating change: how to undo, what evidence to keep.\n\nNever recommend direct production apply without a reviewed plan artifact and approval.\n\n## Workflow\n\n1. **Capture execution context** — runtime+version, provider(s), backend, execution path, environment criticality.\n2. **Diagnose failure mode(s)** using the routing table below. If intent spans categories, load both references.\n3. **Load only the matching reference file(s)** — do not preload depth the task does not need.\n4. **Propose fix with risk controls** — why this addresses the mode, what could still go wrong, guardrails (tests/approvals/rollback).\n5. **Generate artifacts** — HCL, migration blocks (`moved`, `import`), CI changes, policy rules.\n6. **Validate before finalizing** — run validation commands tailored to risk tier.\n7. **Emit the Response Contract** at the end.\n\n## Diagnose Before You Generate\n\n| Failure category | Symptoms | Primary references |\n|------------------|----------|--------------------|\n| **Identity churn** | Resource addresses shift after refactor, `count` index churn, missing `moved` blocks | [Code Patterns: count vs for_each](references/code-patterns.md#count-vs-for_each-deep-dive), [Code Patterns: moved blocks](references/code-patterns.md#moved-blocks-terraform-11), [Code Patterns: LLM mistakes](references/code-patterns.md#llm-mistake-checklist--code-patterns) |\n| **Secret exposure** | Secrets in defaults, state, logs, CI artifacts | [Security & Compliance](references/security-compliance.md), [Code Patterns: write-only](references/code-patterns.md#write-only-arguments-terraform-111), [State Management](references/state-management.md) |\n| **Blast radius** | Oversized stacks, shared prod/non-prod state, unsafe applies | [State Management](references/state-management.md), [Module Patterns](references/module-patterns.md) |\n| **CI drift** | Local plan ≠ CI plan, apply without reviewed artifact, unpinned versions | [CI/CD Workflows](references/ci-cd-workflows.md), [Code Patterns: versions](references/code-patterns.md#version-management) |\n| **Compliance gaps** | Missing policy stage, no approval model, no evidence retention | [Security & Compliance](references/security-compliance.md), [CI/CD Workflows](references/ci-cd-workflows.md) |\n| **Testing blind spots** | Plan-only validation of computed values, set-type indexing, mock/real confusion | [Testing Frameworks](references/testing-frameworks.md) |\n| **State corruption / recovery** | Stuck lock, backend migration, drift reconciliation | [State Management](references/state-management.md) |\n| **Provider upgrade risk** | Breaking-change provider bump, unpinned modules | [Code Patterns: versions](references/code-patterns.md#version-management), [Module Patterns](references/module-patterns.md) |\n| **Provider lifecycle** | Removing a provider with resources still in state, orphaned resources, `removed` block usage | [State Management: Provider Removal](references/state-management.md#provider-removal) |\n| **Navigation / safe-rename blind spots** | Cannot locate symbol defs/refs semantically, value-symbol rename done as blind text replace, grep-only refactor missing refs, hallucinated `rg` shim | [Code Intelligence](references/code-intelligence-lsp.md#terraform-ls-capability-matrix) |\n\n## When to Use This Skill\n\n**Activate when:** creating or reviewing Terraform/OpenTofu configurations or modules, setting up or debugging tests, structuring multi-environment deployments, implementing IaC CI/CD, choosing module patterns or state organization, configuring or migrating remote state backends.\n\n**Don't use for:** basic HCL syntax questions Claude already knows, provider API reference (link to docs), cloud-platform questions unrelated to Terraform/OpenTofu.\n\n## Core Principles\n\n### Module Hierarchy\n\n| Type | When to Use | Scope |\n|------|-------------|-------|\n| **Resource module** | Single logical group of connected resources | VPC + subnets, SG + rules |\n| **Infrastructure module** | Collection of resource modules for a purpose | Multiple resource modules in one region/account |\n| **Composition** | Complete infrastructure | Spans multiple regions/accounts |\n\nFlow: resource → resource module → infrastructure module → composition.\n\n### Directory Layout\n\n```\nenvironments/   # prod/ staging/ dev/  — per-env configurations\nmodules/        # networking/ compute/ data/ — reusable modules\nexamples/       # minimal/ complete/ — docs + integration fixtures\n```\n\nSeparate **environments** from **modules**. Use `examples/` as both documentation and test fixtures. Keep modules small and single-responsibility.\n\nSee [Module Patterns](references/module-patterns.md) for architecture principles, naming conventions, variable/output contracts.\n\n### Naming Conventions (summary)\n\n- Descriptive resource names (`aws_instance.web_server`, not `aws_instance.main`)\n- Reserve `this` for genuine singleton resources only\n- Prefix variables with context (`vpc_cidr_block`, not `cidr`)\n- Standard files: `main.tf`, `variables.tf`, `outputs.tf`, `versions.tf`\n\nSee [Module Patterns: Variable Naming](references/module-patterns.md) and [Code Patterns: Block Ordering](references/code-patterns.md#block-ordering--structure) for examples.\n\n### Block Ordering (summary)\n\nResource blocks: `count`/`for_each` first → arguments → `tags` → `depends_on` → `lifecycle`.\nVariable blocks: `description` → `type` → `default` → `validation` → `nullable` → `sensitive`.\n\nSee [Code Patterns: Block Ordering & Structure](references/code-patterns.md#block-ordering--structure) for the full rules and examples.\n\n## Testing Strategy\n\n### Decision Matrix: Which Testing Approach?\n\n| Situation | Approach | Tools | Cost |\n|-----------|----------|-------|------|\n| Quick syntax check | Static analysis | `validate`, `fmt` | Free |\n| Pre-commit validation | Static + lint | `validate`, `tflint`, `trivy`, `checkov` | Free |\n| Terraform 1.6+, simple logic | Native test framework | `terraform test` | Free-Low |\n| Pre-1.6, or Go expertise | Integration testing | Terratest | Low-Med |\n| Security/compliance focus | Policy as code | OPA, Sentinel | Free |\n| Cost-sensitive workflow | Mock providers (1.7+) | Native tests + mocks | Free |\n| Multi-cloud, complex | Full integration | Terratest + real infra | Med-High |\n\n### Native Test Rules (1.6+)\n\nBefore writing test code: validate resource schemas via Terraform MCP so assertions target real attributes.\n\n- `command = plan` — fast, for input-derived values only\n- `command = apply` — required for **computed values** (ARNs, generated names) and **set-type nested blocks**\n- Set-type blocks cannot be indexed with `[0]` — use `for` expressions or materialize via `command = apply`\n- Common set types: S3 encryption rules, lifecycle transitions, IAM policy statements\n\nSee [Testing Frameworks](references/testing-frameworks.md) for static-analysis pipelines, native-test patterns, Terratest integration, mock providers, and the full LLM-mistake checklist.\n\n## Count vs For_Each — Quick Rule\n\n| Scenario | Use | Why |\n|----------|-----|-----|\n| Boolean condition (create / don't) | `count = condition ? 1 : 0` | Optional singleton toggle |\n| Items may be reordered or removed | `for_each = toset(list)` | Stable resource addresses |\n| Reference by key | `for_each = map` | Named access |\n| Multiple named resources | `for_each` | Better identity stability |\n\n**Never** use list index as long-lived identity — removing a middle element reshuffles every address after it. For the decision matrix, safe migration playbook, `moved` block patterns, and known-at-plan failure cases, see [Code Patterns: count vs for_each](references/code-patterns.md#count-vs-for_each-deep-dive).\n\n## Locals for Dependency Management\n\nUsing `try()` in a local to prefer a conditional resource's attribute over its parent is a specialized but high-value pattern — it forces correct deletion order without explicit `depends_on`. Common use: VPC + secondary CIDR associations + subnets.\n\nSee [Code Patterns: Locals for Dependency Management](references/code-patterns.md#locals-for-dependency-management) for the full pattern and worked example.\n\n## Module Development\n\nStandard layout:\n\n```\nmy-module/\n├── README.md       # Usage documentation\n├── main.tf         # Primary resources\n├── variables.tf    # Typed inputs with descriptions\n├── outputs.tf      # Output values\n├── versions.tf     # required_version + required_providers\n├── examples/\n│   ├── minimal/\n│   └── complete/\n└── tests/\n    └── module_test.tftest.hcl   # or Go for Terratest\n```\n\n**Variable contracts**: always `description`, always explicit `type`, use `validation` for complex constraints, use `sensitive = true` for secrets, prefer `optional()` with typed defaults (1.3+) over untyped `map(any)`.\n\n**Output contracts**: always `description`, mark sensitive outputs, expose stable subsets (not whole provider objects).\n\nSee [Module Patterns](references/module-patterns.md) for the full contract patterns, module release checklist, and LLM-mistake checklist.\n\n## CI/CD\n\nPipeline stages: **validate** → **test** → **plan** → **apply** (with environment protection).\n\nCost control: mock providers on PR validation, real-cloud integration only on main or scheduled, tag test resources, auto-cleanup.\n\nDrift prevention: pin runtime and providers, commit `.terraform.lock.hcl`, apply the **reviewed plan artifact** from the plan stage (do not re-run `plan` inside the apply job), run policy/security stage on every path to apply.\n\nSee [CI/CD Workflows](references/ci-cd-workflows.md) for GitHub Actions, GitLab CI, and Atlantis templates plus the LLM-mistake checklist.\n\n## Security & Compliance\n\n**Essential checks:**\n\n```bash\ntrivy config .\ncheckov -d .\n```\n\n**Don't:** store secrets in variables or `.tfvars`, use default VPC, skip encryption, open security groups to `0.0.0.0/0`, use inline `ingress`/`egress` blocks in `aws_security_group`.\n\n**Do:** source secrets from AWS Secrets Manager / Parameter Store or use `write_only` arguments on 1.11+, create dedicated VPCs, enforce encryption at rest and TLS, least-privilege SGs, use separate `aws_vpc_security_group_{ingress,egress}_rule` resources (AWS provider v5+).\n\nMarking a variable `sensitive = true` masks display only — the value still lives in state. Use `write_only` / `*_wo` on 1.11+, or keep secret material out of Terraform entirely via runtime lookups.\n\nSee [Security & Compliance](references/security-compliance.md) for trivy/checkov pipelines, state-file hardening, compliance mappings, and the LLM-mistake checklist.\n\n## State Management\n\n**Never use local state in teams or production.** Remote backends provide automatic locking, encryption, versioning, audit logging, and safe collaboration.\n\n### Minimum Viable Backend (AWS S3, 1.10+)\n\n```hcl\nterraform {\n  backend \"s3\" {\n    bucket        = \"my-terraform-state\"\n    key           = \"prod/vpc/terraform.tfstate\"\n    region        = \"us-east-1\"\n    encrypt       = true\n    use_lockfile  = true   # Native S3 locking, 1.10+\n  }\n}\n```\n\nOn Terraform < 1.10, use `dynamodb_table = \"terraform-state-lock\"` instead of `use_lockfile`. Azure Storage, GCS, and Terraform Cloud all offer built-in locking — see the State Management reference for syntax.\n\n### State Organization\n\n| Pattern | Use When | Example Path |\n|---------|----------|--------------|\n| **Per environment** | Different teams per env | `prod/terraform.tfstate`, `staging/...` |\n| **Per component** | Independent lifecycles | `prod/vpc/`, `prod/eks/`, `prod/rds/` |\n| **Hybrid** (recommended) | Both benefits | `prod/networking/`, `prod/compute/`, `staging/networking/` |\n\nSplit state when: different teams, different update cadences, or >500 resources. Combine when: tightly coupled resources, <100 resources, same lifecycle.\n\nSee [State Management](references/state-management.md) for locking, migration, multi-team isolation, disaster recovery, and the LLM-mistake checklist.\n\n## Version Management\n\n| Component | Strategy | Example |\n|-----------|----------|---------|\n| Terraform runtime | Pin minor | `required_version = \"~> 1.9\"` |\n| Providers | Pin major | `version = \"~> 5.0\"` |\n| Modules (prod) | Pin exact | `version = \"5.1.2\"` |\n| Modules (dev) | Allow patch | `version = \"~> 5.1\"` |\n\nCommit `.terraform.lock.hcl` intentionally. Keep provider/runtime upgrades in a separate PR from functional changes. See [Code Patterns: Version Management](references/code-patterns.md#version-management) for constraint syntax and upgrade workflow.\n\n## Modern Terraform Features (1.0+)\n\n| Feature | Min version | Common use |\n|---------|-------------|------------|\n| `try()` | 0.13+ | Safe fallbacks, replaces `element(concat())` |\n| `nullable = false` | 1.1+ | Prevent `null` silently overriding defaults |\n| `moved` blocks | 1.1+ | Refactor without destroy/recreate |\n| `optional()` with defaults | 1.3+ | Typed object attributes |\n| `import` blocks | 1.5+ | Declarative imports, reviewable in VCS |\n| `check` blocks | 1.5+ | Runtime assertions |\n| Native `terraform test` | 1.6+ | Built-in test framework |\n| Mock providers | 1.7+ | Cost-free unit testing |\n| `removed` blocks | 1.7+ | Declarative resource removal |\n| Provider-defined functions | 1.8+ | Provider-specific transformations (requires provider to declare functions) |\n| Cross-variable validation | 1.9+ | Reference other `var.*` in `validation` blocks |\n| `write_only` arguments | 1.11+ | Secrets never stored in state |\n| S3 native lock-file | 1.10+ | State locking without DynamoDB |\n\nBefore emitting a feature, verify the runtime floor. See [Code Patterns: Feature Guard Table](references/code-patterns.md#feature-guard-table--version-floor--common-llm-errors) for the full table with common LLM error patterns per feature.\n\n## Runtime-Specific Guidance\n\n- **Terraform 1.0-1.5 / OpenTofu 1.0-1.5**: Terratest for integration, static analysis + plan validation only (no native tests).\n- **1.6+**: native `terraform test` / `tofu test` available — migrate simple unit tests, keep Terratest for complex integration.\n- **1.7+**: mock providers cut test cost — mock for unit tests, real runs for final integration.\n- **1.10+**: S3 native lock-file (`use_lockfile`) is the correct default for new configurations — DynamoDB locking is no longer required.\n- **1.11+**: `write_only` arguments for secret handling keep credentials out of state.\n- **Terraform vs OpenTofu**: both supported. For licensing, governance, and feature delta, see [Quick Reference: Terraform vs OpenTofu](references/quick-reference.md#terraform-vs-opentofu-comparison).\n\n## Code Intelligence (terraform-ls)\n\nSemantic navigation for HCL. terraform-ls is optional; without it every row below degrades to a disclosed `rg` + Read fallback.\n\nSelf-contained terraform-ls layer of a generic code-intelligence discipline - apply the rows below directly. Recommended companion: the `code-intelligence` plugin (same `antonbabenko/agent-plugins` marketplace) carries the generic discipline (position anchoring, degradation gate, disclosure format, anti-phantom-shim) and ships `/code-intelligence:doctor` for readiness. If it is installed, defer to its generic protocol; this skill stays fully self-contained without it.\n\n| Goal | Use | Tradeoff |\n|------|-----|----------|\n| Find definition / all references | terraform-ls `goToDefinition` / `findReferences` | Needs `init` + a position anchor |\n| Rename value symbol (var/local/output/provider alias) | Manual: `findReferences` -> per-file fresh Read -> edit -> `validate` | No rename provider |\n| Rename resource/module address | `moved` block + `plan` shows 0 destroy | Text rename forces destroy/recreate |\n| Exact text / known name / `.tfvars` / non-HCL | `rg` + Read | No semantic scope |\n\n✅ Supported: `goToDefinition`, `findReferences`, `documentSymbol`, `hover`, `workspaceSymbol`.\n❌ Unsupported: `goToImplementation`, call hierarchy, rename provider. Do not call these then report their absence as a finding.\n\n- ✅ Prereq: local `terraform`/`tofu` on PATH, `terraform init` run; cold start may need one retry.\n- ✅ LSP calls are position-anchored (`file:line:character`) - anchor with `rg` first, never symbol-name-only.\n- ❌ Do not claim \"LSP broken, using rg\" until the [Degradation Gate](references/code-intelligence-lsp.md#degradation-gate) passes; disclose any tool substitution on the first line.\n\nDepth: [Code Intelligence](references/code-intelligence-lsp.md#terraform-ls-capability-matrix).\n\n## Reference Files\n\nProgressive disclosure — essentials here, depth on demand:\n\n- [Testing Frameworks](references/testing-frameworks.md) — static analysis, native tests, Terratest, mock providers\n- [Module Patterns](references/module-patterns.md) — structure, variable/output contracts, `terraform_remote_state` rules, release checklist\n- [CI/CD Workflows](references/ci-cd-workflows.md) — GitHub Actions, GitLab CI, Atlantis, cost control\n- [Security & Compliance](references/security-compliance.md) — trivy/checkov, secrets handling, compliance mappings\n- [State Management](references/state-management.md) — backends, locking, migration, multi-team, recovery\n- [Code Patterns](references/code-patterns.md) — block ordering, `count`/`for_each` deep dive, modern features, version management, locals\n- [Code Intelligence](references/code-intelligence-lsp.md) - terraform-ls capabilities, position-anchored calls, manual rename, degradation gate\n- [Quick Reference](references/quick-reference.md) — command cheat sheets, flowcharts, troubleshooting\n\n## License\n\nApache License 2.0. See LICENSE for full terms.\n\n**Copyright © 2026 Anton Babenko**","tags":["terraform","skill","antonbabenko","agent-skills","best-practices","claude-code","claude-skills","devops","infrastructure-as-code","modules","opentofu","testing"],"capabilities":["skill","source-antonbabenko","skill-terraform-skill","topic-agent-skills","topic-best-practices","topic-claude-code","topic-claude-skills","topic-devops","topic-infrastructure-as-code","topic-modules","topic-opentofu","topic-terraform","topic-testing"],"categories":["terraform-skill"],"synonyms":[],"warnings":[],"endpointUrl":"https://skills.sh/antonbabenko/terraform-skill/terraform-skill","protocol":"skill","transport":"skills-sh","auth":{"type":"none","details":{"cli":"npx skills add antonbabenko/terraform-skill","source_repo":"https://github.com/antonbabenko/terraform-skill","install_from":"skills.sh"}},"qualityScore":"0.700","qualityRationale":"deterministic score 0.70 from registry signals: · indexed on github topic:agent-skills · 1859 github stars · SKILL.md body (18,462 chars)","verified":false,"liveness":"unknown","lastLivenessCheck":null,"agentReviews":{"count":0,"score_avg":null,"cost_usd_avg":null,"success_rate":null,"latency_p50_ms":null,"narrative_summary":null,"summary_updated_at":null},"enrichmentModel":"deterministic:skill-github:v1","enrichmentVersion":1,"enrichedAt":"2026-05-18T18:52:55.478Z","embedding":null,"createdAt":"2026-04-18T20:37:46.512Z","updatedAt":"2026-05-18T18:52:55.478Z","lastSeenAt":"2026-05-18T18:52:55.478Z","tsv":"'-1.5':1802,1805 '-1.6':824 '/0':1329 '/code-intelligence':1975 '0':916,977,2038 '0.0.0.0':1328 '0.13':1652 '1':66,181,976,1474 '1.0':1645,1801,1804 '1.1':1660,1668 '1.10':1458,1483,1486,1754,1848 '1.11':1354,1400,1743,1869 '1.3':1181,1675 '1.5':1681,1689 '1.6':812,868,1695,1817 '1.7':848,1703,1711,1833 '1.8':1719 '1.9':1596,1733 '100':1562 '11':323 '111':359 '2':94,194 '2.0':2246 '2026':2253 '3':120,211 '4':132,228 '5':150,246 '5.0':1601 '5.1':1613 '5.1.2':1607 '500':1555 '6':258 '7':269 'absenc':2076 'access':1001 'action':1290,2181 'activ':533 'address':97,236,289,993,1025,2033 'alia':2018 'allow':1610 'alreadi':576 'alway':1161,1163,1188 'analysi':796,943,1810,2159 'anchor':1964,2013,2100,2104,2229 'anti':1970 'anti-phantom-shim':1969 'anton':2254 'antonbabenko/agent-plugins':1957 'apach':2244 'api':579 'appli':172,371,384,894,924,1223,1257,1274,1283,1944 'approach':787,789 'approv':179,406 'architectur':686 'argument':357,751,1352,1742,1872 'arn':899 'artifact':177,248,344,387,1261 'assert':880,1691 'associ':1102 'assumpt':67,85 'atlanti':1294,2184 'attribut':883,1076,1678 'audit':1448 'auto':1247 'auto-cleanup':1246 'automat':1444 'avail':1823 'aw':1336,1343,1370,1378,1456 'awar':33 'aws_instance.main':701 'aws_instance.web':698 'azur':1498 'babenko':2255 'backend':78,189,441,566,1442,1455,1461,2198 'bash':1306 'basic':571 'benefit':1542 'better':1007 'blast':24,106,363 'blind':118,418,495,508 'block':251,298,317,321,481,715,733,737,742,746,757,767,772,907,911,1036,1334,1667,1680,1688,1710,1739,2035,2208 'block-ord':736,771 'boolean':969 'break':452 'breaking-chang':451 'broken':2117 'bucket':1463 'built':1507,1697 'built-in':1506,1696 'bump':455 'cadenc':1553 'call':2065,2071,2096,2230 'cannot':497,912 'capabl':526,2144,2226 'captur':182 'carri':1959 'case':1044 'categori':96,207,282 'chang':160,255,453,1626 'charact':2103 'cheat':2239 'check':138,143,794,1305,1687 'checklist':332,959,1211,1216,1301,1430,1584,2176 'checkov':809,1309 'choos':555 'chosen':121,126 'churn':22,103,287,295 'ci':13,26,108,254,343,378,382,1292,2183 'ci/cd':390,414,554,1217,1285,2177 'cidr':714,717,1101 'claim':2115 'claud':38,575 'cleanup':1248 'cloud':585,855,1236,1503 'cloud-platform':584 'code':299,314,324,334,348,393,458,520,731,765,838,872,1046,1105,1628,1768,1904,1941,1953,2138,2205,2220 'code-intellig':1940,1952 'code-pattern':333 'cold':2089 'collabor':1452 'collect':614 'combin':1557 'command':136,264,884,893,923,2238 'commit':802,1255,1614 'common':925,1097,1649,1782,1790 'common-llm-error':1781 'companion':1950 'comparison':1903 'complet':628,658,1152 'complex':856,1169,1831 'complianc':110,346,400,412,1303,1414,1423,2188,2193 'compon':1533,1587 'composit':627,639 'comput':425,652,897 'concat':1657 'condit':970,975,1073 'config':1308 'configur':539,561,649,1862 'confus':432 'connect':606 'constraint':1170,1637 'contain':1932,1994 'context':184,712 'contract':60,273,691,1160,1187,1207,2170 'control':233,1228,2186 'convent':689,693 'copyright':2252 'core':47,591 'correct':1090,1858 'corrupt':29,113,437 'cost':791,843,1227,1705,1838,2185 'cost-fre':1704 'cost-sensit':842 'could':240 'count':293,301,307,747,960,974,1048,1054,2210 'count-vs-for':306,1053 'coupl':1560 'creat':535,971,1355 'credenti':1877 'critic':83,193 'cross':1730 'cross-vari':1729 'cut':1836 'd':1310 'data':653 'debug':9,545 'decis':783,1030 'declar':1682,1712,1727 'dedic':1356 'deep':312,1059,2213 'default':340,760,1180,1320,1665,1674,1859 'defer':1983 'defin':1717 'definit':2001 'defs/refs':500 'degrad':1923,1965,2122,2126,2233 'degradation-g':2125 'delet':1091 'delta':1891 'demand':58,2154 'depend':753,1063,1095,1109,1115 'deploy':551 'depth':52,222,2137,2152 'deriv':890 'descript':695,758,1141,1162,1189 'destroy':2039 'destroy/recreate':1671,2043 'destruct':155 'dev':645,1609 'develop':1125 'diagnos':18,40,195,277 'diagnose-first':39 'differ':1526,1549,1551 'direct':170,1948 'directori':640 'disast':1577 'disciplin':1943,1962 'disclos':1926,2129 'disclosur':1967,2149 'display':1387 'dive':313,1060,2214 'doc':583,659 'doctor':1976 'document':670,1133 'documentsymbol':2060 'done':506 'drift':27,109,379,443,1249 'dynamodb':1488,1758,1863 'each-deep-d':310,1057 'east':1473 'edit':2026 'egress':1333,1375 'element':1022,1656 'emit':270,1760 'encrypt':929,1323,1359,1446,1475 'end':276 'enforc':1358 'entir':1408 'env':648,1529 'environ':82,192,550,642,663,1225,1525 'error':1784,1792 'essenti':1304,2150 'everi':61,1024,1280,1920 'evid':165,409 'exact':74,135,1605,2044 'exampl':656,667,741,780,1123,1150,1522,1589 'execut':79,183,190 'expertis':827 'explicit':86,1094,1164 'expos':1193 'exposur':105,337 'express':919 'failur':19,196,281,1043 'fallback':1654,1929 'fals':1659 'fast':886 'featur':1644,1646,1762,1770,1775,1795,1890,2216 'feature-guard-t':1774 'file':48,217,719,1421,1753,1853,2023,2101,2147 'final':261,1846 'find':2000,2079 'findrefer':2008,2020,2059 'first':41,750,2107,2135 'fix':230 'fixtur':661,673 'floor':69,1766,1780 'flow':633 'flowchart':2241 'fmt':137,798 'focus':835 'forc':1089,2042 'format':1968 'framework':434,817,938,1700,2156 'free':799,810,821,841,852,1706 'free-low':820 'fresh':2024 'full':777,857,955,1119,1206,1787,2250 'fulli':1991 'function':1625,1718,1728 'gap':111,401 'gate':1966,2123,2127,2234 'gcs':1500 'generat':247,280,900 'generic':1939,1961,1986 'genuin':705 'github':1289,2180 'gitlab':1291,2182 'go':242,826,1156 'goal':1997 'gotodefinit':2007,2058 'gotoimplement':2064 'govern':1888 'grep':512 'grep-on':511 'group':604,1326,1338,1373 'guard':34,1771,1776 'guardrail':244 'guidanc':42,1799 'hallucin':517 'handl':1875,2192 'harden':1422 'hcl':249,572,1459,1912,2051 'hierarchi':594,2066 'high':864,1085 'high-valu':1084 'hover':2061 'hybrid':1539 'iac':553 'iam':933 'ident':21,102,286,1008,1018 'implement':552 'import':253,1679,1683 'includ':65 'independ':1534 'index':294,430,914,1013 'infra':861 'infrastructur':612,629,637 'ingress':1332,1374 'init':2010,2087 'inlin':1331 'input':889,1139 'input-deriv':888 'insid':1272 'instal':1982 'instead':1494 'integr':660,828,858,950,1237,1808,1832,1847 'intellig':521,1905,1942,1954,2139,2221 'intent':205,1616 'isol':1576 'item':981 'job':1275 'keep':167,674,1402,1617,1828,1876 'key':996,1468 'know':577 'known':1040,2046 'known-at-plan':1039 'layer':1936 'layout':641,1127 'least':1365 'least-privileg':1364 'licens':1887,2243,2245,2248 'lifecycl':469,755,931,1535,1565 'line':2102,2136 'link':581 'lint':805 'list':990,1012 'live':53,1017,1392 'llm':326,330,957,1214,1299,1428,1582,1783,1791 'llm-mistak':956,1213,1298,1427,1581 'llm-mistake-checklist':329 'load':56,208,212 'local':380,1061,1069,1107,1113,1435,2081,2219 'local/ci/cloud/atlantis':81 'locals-for-dependency-manag':1112 'locat':498 'lock':440,1445,1482,1493,1509,1571,1752,1756,1852,1864,2199 'lock-fil':1751,1851 'lockfil':1478,1497,1855 'log':342,1449 'logic':603,814 'long':1016 'long-liv':1015 'longer':1867 'lookup':1411 'low':822,832 'low-m':831 'ls':525,1908,1915,1935,2006,2143,2225 'lsp':2095,2116 'main':1240 'main.tf':720,1134 'major':1599 'manag':361,373,399,446,464,484,1064,1110,1116,1345,1432,1513,1568,1586,1631,1635,2196,2218 'manual':2019,2231 'map':999,1184,1424,2194 'mark':1190,1381 'marketplac':1958 'mask':1386 'match':215 'materi':921,1404 'matrix':527,784,1031,2145 'may':982,2091 'mcp':878 'med':833,863 'med-high':862 'middl':1021 'migrat':250,442,563,1033,1572,1824,2200 'min':1647 'minim':657,1151 'minimum':1453 'minor':1593 'miss':296,402,515 'mistak':327,331,958,1215,1300,1429,1583 'mock':846,851,951,1229,1701,1834,1839,2163 'mock/real':431 'mode':20,197,238 'model':407 'modern':1642,2215 'modul':11,375,457,465,541,556,593,601,613,617,623,636,638,650,655,665,675,682,725,1124,1130,1201,1209,1602,1608,2165 'module_test.tftest.hcl':1154 'move':252,297,316,320,1035,1666,2034 'moved-blocks-terraform':319 'multi':549,854,1574,2202 'multi-cloud':853 'multi-environ':548 'multi-team':1573,2201 'multipl':621,631,1002 'must':64 'mutat':159 'my-modul':1128 'my-terraform-st':1464 'name':688,692,697,728,901,1000,1003,2047,2111 'nativ':815,849,865,946,1480,1692,1750,1815,1818,1850,2160 'native-test':945 'navig':491,1910 'need':227,2009,2092 'nest':906 'network':651 'never':168,1010,1433,1745,2108 'new':1861 'non':2050 'non-hcl':2049 'note':152 'null':1662 'nullabl':762,1658 'object':1199,1677 'offer':1505 'one':98,625,2093 'op':17 'opa':839 'open':1324 'opentofu':46,1803,1883,1897,1902 'option':978,1177,1672,1917 'order':734,738,743,768,773,1092,2209 'organ':560,1518 'orphan':478 'output':1143,1186,1192 'outputs.tf':722,1142 'overrid':1664 'overs':365 'paramet':1346 'parent':1079 'pass':2128 'patch':1611 'path':80,191,1281,1523,2085 'pattern':300,315,325,335,349,376,394,459,466,557,683,726,732,766,948,1037,1047,1087,1106,1120,1202,1208,1519,1629,1769,1793,2166,2206 'per':647,1524,1528,1532,1794,2022 'per-env':646 'per-fil':2021 'phantom':1971 'pin':1251,1592,1598,1604 'pipelin':944,1218,1418 'plan':134,140,176,381,383,421,885,1042,1222,1260,1264,1271,1811,2036 'plan-on':420 'platform':586 'playbook':1034 'plugin':1955 'plus':1296 'polici':142,256,403,836,934 'policy/security':1277 'posit':1963,2012,2099,2228 'position-anchor':2098,2227 'pr':1232,1623 'pre':801,823 'pre-commit':800 'prefer':1071,1176 'prefix':709 'preload':221 'prereq':2080 'prevent':1250,1661 'primari':284,1135 'principl':592,687 'privileg':1366 'prod':643,1603 'prod/compute':1544 'prod/eks':1537 'prod/networking':1543 'prod/non-prod':368 'prod/rds':1538 'prod/terraform.tfstate':1530 'prod/vpc':1536 'prod/vpc/terraform.tfstate':1469 'product':171,1440 'progress':2148 'propos':229 'protect':1226 'protocol':1987 'provid':76,92,114,187,448,454,468,472,485,489,578,847,952,1149,1198,1230,1254,1379,1443,1597,1702,1716,1721,1725,1835,2030,2068,2164 'provider-defin':1715 'provider-remov':488 'provider-specif':1720 'provider/runtime':1618 'purpos':620 'question':574,587 'quick':792,964,1893,2235 'radius':25,107,364 're':1269 're-run':1268 'read':1928,2025,2053 'readi':1978 'readme.md':1131 'real':860,882,1235,1843 'real-cloud':1234 'recommend':169,1540,1949 'reconcili':444 'recoveri':438,1578,2204 'ref':516 'refactor':292,514,1669 'refer':55,210,216,285,580,994,1514,1734,1894,2003,2146,2236 'references/ci-cd-workflows.md':392,416,1287,2179 'references/code-intelligence-lsp.md':522,2124,2140,2222 'references/code-patterns.md':305,318,328,353,396,461,735,770,1052,1111,1632,1773,2207 'references/module-patterns.md':377,467,684,729,1203,2167 'references/quick-reference.md':1898,2237 'references/security-compliance.md':347,413,1415,2189 'references/state-management.md':362,374,447,487,1569,2197 'references/testing-frameworks.md':435,939,2157 'region':1470 'region/account':626 'regions/accounts':632 'releas':1210,2175 'remedi':122 'remot':564,1441,2172 'remov':470,480,486,490,986,1019,1709,1714 'renam':494,505,2014,2029,2031,2041,2067,2232 'reorder':984 'replac':510,1655 'report':2074 'requir':895,1146,1148,1594,1724,1868 'reserv':702 'reshuffl':1023 'resourc':288,474,479,600,607,616,622,634,635,696,707,745,874,992,1004,1074,1136,1245,1377,1556,1561,1563,1713 'resource/module':2032 'respons':59,63,272,680 'rest':1361 'retent':410 'retri':2094 'reusabl':654 'review':7,175,386,537,1259,1684 'rg':518,1927,2052,2106,2119 'risk':95,116,148,232,267,450 'rollback':151 'rout':201 'row':1921,1946 'rule':257,611,778,867,930,965,1376,2174 'run':262,1270,1276,1844,2088 'runtim':70,146,185,1252,1410,1591,1690,1765,1797 'runtime-specif':1796 's3':928,1457,1462,1481,1749,1849 'safe':493,1032,1451,1653 'safe-renam':492 'scan':14 'scenario':966 'schedul':1242 'schema':875 'scope':599,2056 'secondari':1100 'secret':23,104,336,338,1175,1314,1341,1344,1403,1744,1874,2191 'secur':345,411,1302,1325,1337,1372,1413,2187 'security/compliance':834 'see':681,724,764,936,1045,1104,1200,1284,1412,1510,1566,1627,1767,1892,2247 'self':1931,1993 'self-contain':1930,1992 'semant':501,1909,2055 'sensit':763,844,1172,1191,1384 'sentinel':840 'separ':662,1369,1622 'server':699 'set':428,542,904,909,926 'set-typ':427,903,908 'sg':610 'sgs':1367 'share':367 'sheet':2240 'shift':290 'shim':519,1972 'ship':1974 'show':2037 'silent':1663 'simpl':813,1825 'singl':602,679 'single-respons':678 'singleton':706,979 'situat':788 'skill':3,36,532,1989 'skill-terraform-skill' 'skip':1322 'small':676 'sourc':1340 'source-antonbabenko' 'span':206,630 'special':1082 'specif':1722,1798 'split':1546 'spot':119,419,496 'stabil':1009 'stabl':991,1194 'stack':366 'stage':404,644,1219,1265,1278,1531 'staging/networking':1545 'standard':718,1126 'start':2090 'state':16,28,77,84,112,158,341,360,369,372,436,445,477,483,559,565,1394,1420,1431,1436,1467,1492,1512,1517,1547,1567,1748,1755,1880,2173,2195 'state-fil':1419 'state-mut':157 'statement':935 'static':795,804,942,1809,2158 'static-analysi':941 'stay':1990 'still':241,475,1391 'storag':1499 'store':1313,1347,1746 'strategi':782,1588 'structur':547,739,769,774,2168 'stuck':439 'subnet':609,1103 'subset':1195 'substitut':2132 'summari':694,744 'support':1885,2057 'symbol':499,504,2016,2110 'symbol-name-on':2109 'symptom':283 'syntax':573,793,1516,1638 'tabl':202,1489,1772,1777,1788 'tag':752,1243 'tailor':144,265 'target':881 'task':224 'team':1438,1527,1550,1575,2203 'templat':1295 'term':2251 'terraform':2,35,44,71,322,358,524,811,818,877,1407,1460,1466,1485,1491,1502,1590,1643,1693,1800,1819,1881,1895,1900,1907,1914,1934,2005,2082,2086,2142,2171,2224 'terraform-l':1906,1913,1933,2004,2223 'terraform-ls-capability-matrix':523,2141 'terraform-skil':1 'terraform-state-lock':1490 'terraform-vs-opentofu-comparison':1899 'terraform.lock.hcl':1256,1615 'terraform/opentofu':10,62,538,590 'terratest':830,859,949,1158,1806,1829,2162 'test':12,117,417,433,546,672,781,786,816,819,829,850,866,871,937,947,1153,1221,1244,1694,1699,1708,1816,1820,1822,1827,1837,1842,2155,2161 'tests/approvals/rollback':245 'text':509,2040,2045 'tflint':807 'tfvar':1318,2048 'tier':149,268 'tight':1559 'tls':1363 'tofu':73,1821,2083 'toggl':980 'tool':790,2131 'topic-agent-skills' 'topic-best-practices' 'topic-claude-code' 'topic-claude-skills' 'topic-devops' 'topic-infrastructure-as-code' 'topic-modules' 'topic-opentofu' 'topic-terraform' 'topic-testing' 'toset':989 'trade':129 'tradeoff':123,1999 'transform':1723 'transit':932 'tri':1066,1651 'trivi':808,1307 'trivy/checkov':1417,2190 'troubleshoot':2242 'true':1173,1385,1476,1479 'type':429,595,759,905,910,927,1138,1165,1179,1676 'undo':163 'unit':1707,1826,1841 'unpin':388,456 'unrel':588 'unsaf':370 'unsupport':2063 'untyp':1183 'updat':1552 'upgrad':115,449,1619,1640 'us':1472 'us-east':1471 'usag':482,1132 'use':4,199,530,569,598,666,917,967,1011,1065,1098,1166,1171,1319,1330,1349,1368,1395,1434,1477,1487,1496,1520,1650,1854,1998,2118 'user':89 'v5':1380 'valid':133,139,259,263,423,761,797,803,806,873,1167,1220,1233,1732,1738,1812,2027 'valu':426,503,891,898,1086,1144,1390,2015 'value-symbol':502 'var':1736 'var/local/output/provider':2017 'variabl':710,727,756,1159,1316,1383,1731 'variable/output':690,2169 'variables.tf':721,1137 'vcs':1686 'verifi':1763 'version':32,68,75,186,389,395,398,460,463,1147,1447,1585,1595,1600,1606,1612,1630,1634,1648,1779,2217 'version-awar':31 'version-floor':1778 'version-manag':397,462,1633 'versions.tf':723,1145 'via':876,922,1409 'viabl':1454 'vpc':608,713,1099,1321,1371 'vpcs':1357 'vs':302,308,961,1049,1055,1882,1896,1901 'whole':1197 'without':173,385,1093,1670,1757,1918,1995 'wo':1398 'work':1122 'workflow':51,180,391,415,845,1286,1641,2178 'workspacesymbol':2062 'write':6,351,355,870,1350,1396,1740,1870 'write-on':350 'write-only-arguments-terraform':354 'wrong':243","prices":[{"id":"cdad3c97-42d0-4c8d-8f80-f0ddc381d2b6","listingId":"82e8faf9-6595-43e0-9e03-727ec5ea8f3c","amountUsd":"0","unit":"free","nativeCurrency":null,"nativeAmount":null,"chain":null,"payTo":null,"paymentMethod":"skill-free","isPrimary":true,"details":{"org":"antonbabenko","category":"terraform-skill","install_from":"skills.sh"},"createdAt":"2026-04-18T20:37:46.512Z"}],"sources":[{"listingId":"82e8faf9-6595-43e0-9e03-727ec5ea8f3c","source":"github","sourceId":"antonbabenko/terraform-skill/terraform-skill","sourceUrl":"https://github.com/antonbabenko/terraform-skill/tree/master/skills/terraform-skill","isPrimary":false,"firstSeenAt":"2026-04-22T18:53:42.146Z","lastSeenAt":"2026-05-18T18:52:55.478Z"},{"listingId":"82e8faf9-6595-43e0-9e03-727ec5ea8f3c","source":"skills_sh","sourceId":"antonbabenko/terraform-skill/terraform-skill","sourceUrl":"https://skills.sh/antonbabenko/terraform-skill/terraform-skill","isPrimary":true,"firstSeenAt":"2026-04-18T20:37:46.512Z","lastSeenAt":"2026-05-07T22:40:38.735Z"}],"details":{"listingId":"82e8faf9-6595-43e0-9e03-727ec5ea8f3c","quickStartSnippet":null,"exampleRequest":null,"exampleResponse":null,"schema":null,"openapiUrl":null,"agentsTxtUrl":null,"citations":[],"useCases":[],"bestFor":[],"notFor":[],"kindDetails":{"org":"antonbabenko","slug":"terraform-skill","github":{"repo":"antonbabenko/terraform-skill","stars":1859,"topics":["agent-skills","best-practices","claude-code","claude-skills","devops","infrastructure-as-code","modules","opentofu","terraform","testing"],"license":"other","html_url":"https://github.com/antonbabenko/terraform-skill","pushed_at":"2026-05-18T09:53:41Z","description":"Terraform & OpenTofu Skill for AI Agents - testing, modules, CI/CD, and production patterns","skill_md_sha":"30e094e488dac5dfe6ccd858fbd10cccf24fe41f","skill_md_path":"skills/terraform-skill/SKILL.md","default_branch":"master","skill_tree_url":"https://github.com/antonbabenko/terraform-skill/tree/master/skills/terraform-skill"},"layout":"multi","source":"github","category":"terraform-skill","frontmatter":{"name":"terraform-skill","license":"Apache-2.0","description":"Use when writing, reviewing, or debugging Terraform/OpenTofu modules, tests, CI, scans, or state ops - diagnoses failure mode (identity churn, secrets, blast radius, CI drift, state corruption) with version-aware guards."},"skills_sh_url":"https://skills.sh/antonbabenko/terraform-skill/terraform-skill"},"updatedAt":"2026-05-18T18:52:55.478Z"}}