terraform_skill

Overview

This skill provides practical, production-ready guidance for authoring, testing, and operating Terraform or OpenTofu infrastructure-as-code. It focuses on module design, testing strategies (native tests, Terratest), CI/CD patterns, state and dependency management, and security scanning. Use it to improve reliability, maintainability, and cost control for IaC projects.

How this skill works

The skill inspects common Terraform/OpenTofu workflows and recommends patterns for module hierarchy, file and block ordering, naming conventions, and version pinning. It helps choose and implement testing approaches, integrate static and security scanners (trivy, checkov), design CI/CD pipelines, and troubleshoot state or dependency issues. Advice is actionable and tied to Terraform features (native tests, mock providers) and real-world cost tradeoffs.

When to use it

• Creating or refactoring Terraform/OpenTofu modules and environments
• Choosing a testing approach: quick validation, native tests, or Terratest
• Designing CI/CD pipelines for plan/review/apply with cost controls
• Debugging state, dependency ordering, or resource recreation issues
• Implementing security scanning and policy-as-code checks

Best practices

• Separate reusable modules from environment configs; keep modules small and single-responsibility
• Use descriptive resource names; use "this" only for true singletons
• Order blocks consistently: count/for_each first, tags near end, lifecycle last
• Prefer for_each for stable addressing; use count only for simple boolean or fixed counts
• Run static analysis and security scans in PRs; run expensive integration tests only on main
• Pin Terraform minor versions and provider major versions; lock module versions in prod

Example use cases

• Create a networking module with examples/complete and examples/minimal for tests and docs
• Add native terraform test files for input validation and use mock providers to avoid cloud costs
• Set up CI stages: validate (fmt, validate, tflint), test (native/Terratest), plan, apply with approvals
• Migrate count-based subnets to for_each to prevent cascading recreation when zones change
• Integrate trivy and checkov in pre-commit or pipeline to catch misconfigurations early