terraform-skill_skill

Overview

This skill provides practical, production-ready guidance for working with Terraform and OpenTofu. It focuses on module design, testing strategies, CI/CD integration, state and dependency management, and security scanning. Use it to make consistent architecture decisions and reduce operational risk when delivering infrastructure as code.

How this skill works

The skill inspects your architecture goals and recommends module hierarchies, file layout, naming conventions, and block ordering to improve maintainability. It guides test selection (static analysis, native tests, Terratest, mock providers), outlines CI/CD stages, and provides patterns for dependency control, state handling, and security scans like Trivy and Checkov. It also helps choose count vs for_each, design outputs/variables, and apply version pinning strategies.

When to use it

• Creating or refactoring Terraform/OpenTofu modules and multi-environment layouts
• Choosing a testing approach: validate, native tests, Terratest, or mocks
• Designing CI/CD pipelines for plan, test, and controlled apply stages
• Debugging state or dependency ordering issues during destroy/apply
• Implementing security scanning and policy-as-code in your workflow

Best practices

• Separate environments from reusable modules; use examples/ as integration fixtures
• Keep modules small and single-responsibility; include README, examples, and tests
• Always add descriptions and types to variables; mark secrets sensitive
• Order resource blocks consistently (count/for_each first, lifecycle last)
• Prefer for_each for stable addresses; use count for simple boolean or numeric replicas
• Pin Terraform minor versions and provider major versions; pin module versions in prod

Example use cases

• Design a networking module with resource-level naming and a minimal/complete example
• Set up GitHub Actions pipeline: validate → test → plan → apply with approvals
• Migrate count-based subnets into for_each to avoid resource churn across AZ removals
• Implement native Terraform tests with mock providers for PR validation to avoid real costs
• Add Trivy and Checkov scans to pre-commit/CI to catch insecure configs before merge