infrastructure-as-code_skill

Overview

This skill captures expert Terraform knowledge for Oracle Cloud Infrastructure (OCI) and prescribes safe, maintainable Infrastructure-as-Code patterns. It focuses on using OCI Landing Zone modules, provider authentication, state management, resource lifecycle traps, and cost-aware designs. Practical rules prevent common mistakes like hardcoded OCIDs, local state for teams, and unsafe lifecycle configurations.

How this skill works

The skill inspects Terraform configurations and operational workflows to identify OCI-specific anti-patterns and recommend fixes. It highlights provider authentication precedence, common provider gotchas, state file recovery and backend best practices, lifecycle protections, and recommended timeouts. The guidance emphasizes using official OCI Landing Zone modules and concrete remediation steps (import, refresh, backend migration).

When to use it

• When authoring new OCI infrastructure—prefer Landing Zone modules over hand-rolled resources.
• When troubleshooting Terraform errors: auth failures, 409 conflicts, or long-running create/delete timeouts.
• When migrating to team workflows or remediating state issues (drift, corruption, or imports).
• When enforcing production safety: prevent_destroy, ignore_changes, and explicit lifecycle controls.
• When optimizing costs: flex shapes, tagging, and avoiding orphaned volumes in dev/test.

Best practices

• Use official OCI Landing Zone Terraform modules for consistent, compliant baselines.
• Never hardcode OCIDs; use variables or data sources for portability across regions/tenancy.
• Store state in Object Storage with versioning and locking; avoid local backends for teams.
• Prefer for_each with stable keys over count to prevent mass recreation on reorder.
• Protect critical resources with lifecycle.prevent_destroy and ignore_changes for console edits.
• Set sensible timeouts for long-running resources (databases, large provisions).

Example use cases

• Import existing VCNs and subnets into Terraform state to stop manual drift and enable IaC.
• Run Terraform on an OCI instance using Instance Principal auth with proper dynamic-group and policies.
• Migrate a team from local .tfstate to OCI Object Storage backend with versioning and locking.
• Prevent accidental production deletion by adding lifecycle.prevent_destroy to databases.
• Convert a fleet provisioning using count to for_each with stable names to avoid recreations.