terraform-engineer_skill

Overview

This skill helps implement production-grade infrastructure as code with Terraform across AWS, Azure, and GCP. It focuses on reusable module design, secure remote state, provider configuration, and multi-environment workflows to deliver maintainable, auditable infrastructure.

How this skill works

I analyze existing infrastructure and requirements, design composable modules with validated inputs/outputs, and configure remote backends with locking and encryption. I pin provider versions, apply security and tagging standards, and provide example usage, backend/provider snippets, and a brief rationale for design decisions. I also include testing recommendations like terraform plan, policy checks, and automated tests.

When to use it

• Building or refactoring Terraform modules for reusability and versioning
• Configuring remote state backends with locking for production environments
• Setting up multi-environment workflows and workspaces
• Migrating infrastructure to Terraform or consolidating providers
• Implementing infrastructure testing, policy as code, and CI integration

Best practices

• Use semantic versioning for modules and tag releases
• Enable remote state with locking (e.g., S3+DynamoDB, GCS+lock, Azure Blob leases)
• Validate inputs with validation blocks and pin provider versions
• Tag all resources for cost tracking and enforce consistent naming
• Encrypt secrets and never store sensitive values in plain text
• Run terraform fmt, validate, and static checks (tflint, tfswitch) before CI

Example use cases

• Create a reusable VPC/network module with inputs for CIDR, AZs, and tagging
• Migrate local state to S3 backend with DynamoDB locking and state migration steps
• Standardize provider blocks across AWS, Azure, and GCP with pinned versions
• Implement multi-environment pipeline using workspaces, tfvars files, and immutable module versions
• Add terratest or kitchen-terraform checks and OPA policies to CI for compliance gates