infrastructure-as-code_skill

Overview

This skill provides pragmatic guidance and battle-tested patterns for provisioning and managing cloud infrastructure with Terraform, Pulumi, and CloudFormation. It focuses on preserving state, preventing drift, reducing blast radius, and protecting production environments. Advice is grounded in real operational failures and prescriptive patterns for creation, diagnosis, and validation.

How this skill works

The skill inspects IaC designs, state handling, backend configuration, locking, secret management, and workflow guards. It flags risky patterns (e.g., secrets in state, single-point backends, large-monolith modules) and recommends concrete mitigations such as remote locked backends, modular refactors, and mandatory plan reviews. For diagnostics it emphasizes root-cause analysis of state drift, import needs, and failed applies.

When to use it

• Designing new infrastructure or refactoring existing IaC
• Setting up remote state backends and locking for Terraform/Pulumi
• Performing risk assessments before terraform apply/stack updates
• Investigating production outages tied to state drift or misapplied changes
• Creating CI/CD pipelines that run plan/review/apply workflows

Best practices

• Treat state as sacred: enforce remote backends with backups and locking
• Always run and review an explicit plan before applying changes
• Split infrastructure into small, purpose-driven modules to limit blast radius
• Never store plaintext secrets in state; integrate secret managers or encrypted variables
• Validate changes against strict rulesets and run drift detection regularly

Example use cases

• Configure S3/DynamoDB or equivalent remote backend with state locking for Terraform
• Refactor a large monolithic module into smaller reusable modules to reduce risk during deploys
• Create CI gating that requires human review of terraform plan for production workspaces
• Diagnose and repair state drift by comparing live resources against state and performing controlled imports
• Migrate on-prem IaC to cloud-native providers while preserving state and minimizing downtime