Menu
Terraform infrastructure operations with safety controls
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/oimiragieo/agent-studio --skill terraform-infraThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Showing SKILL.md
| name | terraform-infra |
| description | Terraform infrastructure operations with safety controls |
| version | 1.1.0 |
| model | sonnet |
| invoked_by | both |
| user_invocable | true |
| tools | ["Bash","Read","Glob"] |
| best_practices | ["Always run plan before apply","Review plan output carefully","Never force push to production"] |
| error_handling | graceful |
| streaming | supported |
| verified | true |
| lastVerifiedAt | "2026-02-22T00:00:00.000Z" |
| source | builtin |
| trust_score | 100 |
| provenance_sha | 8b169d711eee942c |
The skill invokes the Terraform CLI. Install:
brew tap hashicorp/tap && brew install hashicorp/tap/terraformchoco install terraform or download from HashiCorpsudo apt update && sudo apt install terraform (see HashiCorp install)Verify: terraform --version
Workflow: terraform init → terraform fmt → terraform validate → terraform plan -out=tfplan → review → terraform apply tfplan. Use terraform show tfplan to inspect.
Hacks: Always run plan before apply; never apply blind. Use remote state (e.g. S3 + lock) for team work. Prefer -auto-approve only in CI with reviewed plans. Use terraform state list and terraform state show <resource> to debug. Use service accounts / workload identity in pipelines; avoid static keys.
HashiCorp Terraform Associate (004): IaC concepts, Terraform fundamentals, state, modules, Terraform Cloud. Learning path. Skill data: init → fmt → validate → plan -out → apply; remote state; no blind apply.
Suggested hooks: Pre-apply: run terraform plan -out=tfplan and gate on review. CI: apply only after plan approval. Use with devops (primary).
Workflows: Use with devops (primary). Flow: init → plan → review → apply; use state commands for debugging. See ci-cd-implementation-rule for pipeline integration.
Provides 90%+ context savings vs raw Terraform MCP server. Includes critical safety controls for infrastructure operations.
| Tool | Description | Confirmation |
|---|---|---|
| plan | Generate terraform plan | No |
| validate | Validate configuration | No |
| fmt | Format terraform files | No |
| Tool | Description | Confirmation |
|---|---|---|
| show | Display current state | No |
| list | List state resources | No |
| state-mv | Move resource in state | Yes |
| Tool | Description | Confirmation |
|---|---|---|
| workspace-list | List workspaces | No |
| workspace-select | Select workspace | No |
| workspace-new | Create workspace | Yes |
| Tool | Description | Confirmation |
|---|---|---|
| apply | Apply changes | REQUIRED |
| Tool | Status |
|---|---|
| destroy | BLOCKED |
| state-rm | BLOCKED |
# Initialize
terraform init
# Plan changes
terraform plan -out=tfplan
# Validate
terraform validate
# Apply (requires -auto-approve for automation)
terraform apply tfplan
⚠️ terraform apply ALWAYS requires confirmation ⚠️ terraform destroy is BLOCKED by default ⚠️ State modifications require confirmation ⚠️ Review plan output before apply
| Issue | Solution |
|---|---|
| Init failed | Check provider credentials |
| State locked | Check for other operations |
| Plan failed | Review error output carefully |
Structure modules following HashiCorp conventions:
modules/
vpc/
main.tf # Resource definitions
variables.tf # Input variables
outputs.tf # Output values
versions.tf # Required provider versions
README.md # Module documentation
| Practice | Description |
|---|---|
| Single responsibility | Each module manages one logical resource group |
| Typed variables | Use type constraints on all variables |
| Validation blocks | Add validation {} for input constraints |
| Sensitive outputs | Mark secrets with sensitive = true |
| Version constraints | Pin module source versions |
# Local module
module "vpc" {
source = "./modules/vpc"
}
# Terraform Registry
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
version = "~> 5.0"
}
# Git source (pinned tag)
module "vpc" {
source = "git::https://github.com/org/modules.git//vpc?ref=v1.2.0"
}
package provider
import (
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
)
func Provider() *schema.Provider {
return &schema.Provider{
Schema: map[string]*schema.Schema{
"api_key": {
Type: schema.TypeString,
Required: true,
Sensitive: true,
DefaultFunc: schema.EnvDefaultFunc("API_KEY", nil),
},
},
ResourcesMap: map[string]*schema.Resource{
"myservice_resource": resourceMyServiceResource(),
},
}
}
# Validate module syntax
cd modules/vpc && terraform validate
# Run module tests (Terraform 1.6+)
terraform test
# Plan with module
terraform plan -var-file=examples/basic.tfvars
terraform plan and review the output before executing terraform apply.tf files — use secret managers (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault)terraform state commands exclusively| Anti-Pattern | Why It Fails | Correct Approach |
|---|---|---|
| Hardcoded credentials in .tf files | Secret exposure in VCS, compliance failure | Use variables with secret manager backend |
| No state locking | Concurrent applies corrupt state | Enable backend locking (S3+DynamoDB, Azure Blob, GCS) |
terraform apply without plan review | Unexpected resource deletion or recreation | Always plan first, review diff, then apply |
| Unversioned providers and modules | Non-reproducible builds and breaking changes | Pin versions: version = "~> 4.0" |
| Untagged resources | Untrackable costs and compliance failure | Tag all resources with env, owner, cost-center |
Before starting:
Read .claude/context/memory/learnings.md
After completing:
.claude/context/memory/learnings.md.claude/context/memory/issues.md.claude/context/memory/decisions.mdASSUME INTERRUPTION: If it's not in memory, it didn't happen.
Agent frontmatter enhancements — disallowedTools, mcpServers scoping, fork_eligible field
Context management — pre-compact persistence, threshold alignment, microcompact/circuit breaker detection
Hook enhancements — updatedInput for bash safety prefixes, suppressOutput for verbose blocks, denial-based routing feedback
Based on SOC occupation classification
