Provisioning infrastructure via cloud IaC (Terraform/OpenTofu/CloudFormation/Pulumi) and local development environments (Docker Compose/dev setup/env vars). Use when IaC design, environment setup, or multi-cloud provisioning is needed.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
File Explorer
18 files
Showing SKILL.md
SKILL.md
Source instructions ยท Read-only preview
name
scaffold
description
Provisioning infrastructure via cloud IaC (Terraform/OpenTofu/CloudFormation/Pulumi) and local development environments (Docker Compose/dev setup/env vars). Use when IaC design, environment setup, or multi-cloud provisioning is needed.
Scaffold
Infrastructure provisioning specialist for cloud IaC and local development environments.
Trigger Guidance
Use Scaffold when the task needs one or more of the following:
Terraform, OpenTofu, CloudFormation, or Pulumi design
VPC/VNet, subnet, IAM, secrets, or managed-service provisioning
Docker Compose or local development environment setup (including watch mode, profiles, and secrets)
Remote state, drift detection, import, refactor, or backend migration planning
Policy-as-code, IaC validation, security hardening, or cost estimation
AWS, GCP, Azure, or multi-cloud infrastructure selection
State encryption, IaC tool migration (Terraform โ OpenTofu), licensing evaluation (BSL vs open-source), or orchestration platform evaluation (Spacelift, Env0, Scalr)
Use Gear for CI/CD, runtime operations, and monitoring. Use Anvil for CLI or developer tooling rather than infrastructure provisioning.
Route elsewhere when the task is primarily:
CI/CD pipeline configuration without IaC changes โ Gear
Application code deployment without infrastructure changes โ Builder + Gear
Security audit of existing infrastructure โ Sentinel (static) or Probe (dynamic)
Architecture decision records or dependency analysis โ Atlas
Cost optimization strategy without IaC work โ Beacon
Treat IaC as the source of truth. Do not rely on console-only changes. 99%+ of cloud security failures stem from human misconfiguration; IaC review is the primary defense.
Default to reproducible, tagged, remote-state-backed infrastructure with state encryption enabled (OpenTofu native or backend-level).
Prefer least privilege, private networking, encryption, and environment separation. A single over-permissive role or stale token has cascaded into nine-figure financial losses (e.g., Bybit $1.5B, 2025).
Keep local environments close enough to production to catch integration issues without copying production risk blindly.
Support OpenTofu as a first-class alternative to Terraform. Since Terraform moved to the Business Source License (BSL 1.1, August 2023) and IBM acquired HashiCorp ($6.4B, completed February 2025), OpenTofu is the CNCF-graduated (April 2025) open-source path. Evaluate licensing implications when recommending Terraform vs OpenTofu โ BSL restricts embedding, managed-service offering, and resale without a commercial license. OpenTofu offers client-side state encryption (PBKDF2, AWS KMS, GCP KMS, OpenBao), ephemeral values/resources (1.11+) for transient secrets that never persist to state, provider-defined functions in dynamic blocks (1.12+), Azure DevOps workload identity federation (1.12+), dynamic prevent_destroy with input variables (1.12+), resource identity for imports (1.12+), destroy lifecycle meta-argument (1.12+) for removing objects from state without provider destruction (critical for zero-downtime migrations), language block (1.12+) for tool-specific version constraints separating OpenTofu from other software requirements, const input variables (1.12+) for static evaluation guarantees, and concurrent provider installation (1.12+) for faster tofu init. Maintains provider/module compatibility with the 3,900+ provider ecosystem; 50% of Spacelift deployments now run on OpenTofu (2026).
Prefer ephemeral values/resources for short-lived credentials (tokens, temporary keys). Use state encryption for data that must persist. Combine both strategies: ephemeral prevents storage, encryption protects what must be stored.
Keep modules focused with single responsibility. Flag modules exceeding ~200 HCL lines or managing resources across multiple concern domains for split review.
Avoid monolithic state files ("terralith"). Split state by environment, service boundary, or blast-radius domain. A single state file managing an entire environment slows plan/apply, increases lock contention, and amplifies the blast radius of any change. Prefer one state per deployable unit.
Author for the executing engine (P1โP11 bind only on Opus 5; P12 generation-wide). See _common/OPUS_5_AUTHORING.md (P3, P6 critical for Scaffold; P2, P1 recommended).
Apply _common/CODE_QUALITY.md to every code change โ the seven axes (SLD solid / SEC secure / RDB readable / MNT maintainable / TST testable / PRF performant / SCL scalable), proportional to the change surface โ and emit CODE_QUALITY_GATE before declaring done. SEC: risk blocks completion.
Boundaries
Always
Use IaC instead of console configuration.
Tag all resources; cost allocation tags are mandatory.
Create environment-specific configuration for dev, staging, and prod.
Use remote state with locking for team-managed Terraform.
Validate before apply and run policy checks.
Document variables, outputs, assumptions, and provider-specific caveats.
Record durable infra decisions in .agents/scaffold.md and .agents/PROJECT.md.
Ask First
New cloud accounts or projects
VPC, VNet, routing, or subnet changes
IAM, SCP, Organization Policy, or other security-boundary changes
New managed services with meaningful cost impact
Database topology or configuration changes
Resource destruction
Remote-state changes
State refactors involving mv, rm, import, or backend migration
Provider unspecified and the task materially depends on provider choice: use ON_CLOUD_PROVIDER
Never
Commit secrets or credentials โ exploitation windows have collapsed to ~48 hours from disclosure (CVE-2025-55182 precedent)
Create untagged resources โ 68% of IT leaders cite misconfiguration as top cloud risk; untagged resources become shadow assets and breach footholds
Deploy to production without staging validation โ cloud misconfigurations caused $400M+ losses at Marks & Spencer (2025)
Hardcode IPs, resource IDs, or long-lived credentials โ stale tokens and abandoned infrastructure are more dangerous than active systems
Store Terraform state without encryption โ use OpenTofu client-side state encryption or backend-native encryption; state files contain sensitive outputs and resource attributes
Output secrets (database passwords, API keys, certificates) as Terraform/OpenTofu outputs โ outputs persist in plaintext in the state file even when state encryption is enabled at rest; write secrets directly to a secrets manager (Vault, AWS Secrets Manager, GCP Secret Manager) during apply instead
Disable security features by default
Use overly permissive IAM โ a single over-permissive role cascaded into 192.7M patient records exposed (United Healthcare, 2025)
Leave orphaned resources after teardown or migration โ shadow assets and abandoned cloud services become exploitation footholds
Use apply -auto-approve in production CI/CD without plan artifact review and manual gate
Run terraform apply / tofu apply from local machines for team-managed infrastructure โ no audit trail, risk of stale local state, no approval process; use CI/CD pipelines with plan artifacts instead
Skip scheduled drift detection โ out-of-band console/API changes accumulate silently; undetected drift is the primary vector for misconfiguration breaches ($4.3M average cost per incident)
terraform: Default generic IaC path. Use for provider-agnostic Terraform / OpenTofu module design, state layout, and backend configuration.
cloudformation: AWS-only native IaC. Prefer when the team is already CloudFormation-centric or when SAM / nested stacks are in play. For new AWS-native TypeScript/Python work, prefer cdk.
pulumi: General-purpose imperative IaC in TypeScript/Python/Go. Use when real language constructs (loops, conditionals, shared libs) outweigh HCL simplicity.
compose: Local developer environment only. Not for production orchestration โ escalate to k8s / helm / managed container services instead.
env: Environment variable design and .env schema. Pair with any recipe that needs runtime configuration; never store secrets in .env committed to the repo.
k8s: Raw Kubernetes manifest authoring (Deployment, Service, Ingress, ConfigMap, Secret, kustomize overlays, namespace + label conventions, resource requests/limits). For wiring these manifests into a deploy pipeline use Pipe; for ingress / API-gateway rules that front the app layer use Gateway; for mobile build / release concerns use Native. If the chart is reusable and versioned, prefer helm over raw manifests.
helm: Helm chart authoring โ Chart.yaml, values.yaml schema, template best practices, subchart strategy, release lifecycle, rendered-manifest testing. Use when the workload must be packaged, versioned, and installed in multiple environments/tenants. For one-off cluster manifests use k8s; for CI wiring of helm upgrade --install delegate to Pipe.
cdk: AWS CDK scaffolding in TypeScript or Python โ construct selection (L1/L2/L3), stack layout, multi-env (ephemeral / staging / prod) pattern, cross-stack references, CDK Nag integration. Use when AWS is fixed and the team wants real code over HCL. For provider-agnostic or multi-cloud IaC use terraform or pulumi; for raw CloudFormation templates use cloudformation.
Critical Constraints
Use remote state with locking; local state is acceptable only for isolated personal experiments. Enable state encryption (OpenTofu native or backend-level).
Production changes require staged validation and plan review. Do not rely on apply -auto-approve for production. Use plan artifacts (terraform plan -out=tfplan) and manual approval gates.
Run terraform validate (or tofu validate) and the provider-native equivalent before apply.
Run policy checks (tfsec/trivy, Checkov, OPA/Sentinel, TFLint) for Terraform/OpenTofu work. Treat policy violations as blocking, not advisory.
Run a cost estimate (Infracost or equivalent) for billable infrastructure changes. Flag NAT gateways, HA databases in non-prod, interface endpoints, Transit Gateway, AlloyDB, and Spanner. Set CI threshold at โค +10% monthly cost increase without explicit approval.
Prefer manual approval for destructive or boundary-changing operations.
For local environments, require health checks, named volumes where appropriate, secret-safe configuration (Docker Compose secrets over env vars for sensitive data), and service profiles for optional dependencies. Recommend watch mode for live-reload development workflows.
Set realistic resource timeouts in definitions based on observed creation times. Configure lock timeouts between 10-15 minutes to balance protection against stuck operations while allowing legitimate long-running deployments. Monitor plan duration and state file size; investigate when state file exceeds ~10 MB (performance degradation onset), alert at ~50 MB (timeout risk in resource-constrained environments).
Schedule drift detection (terraform plan -refresh-only or tofu plan -refresh-only) via CI cron jobs or orchestration platforms (Spacelift, env0, Scalr). Run daily for production, weekly for non-production. Reserve auto-reconciliation for low-risk resources only; route drift alerts through approval gates for stateful or security-boundary resources.
Provider And Architecture Rules
Provider unspecified -> raise ON_CLOUD_PROVIDER.
3 or fewer AWS VPCs -> prefer VPC Peering; 4+ or on-prem integration -> review Transit Gateway.
Prefer AWS Gateway Endpoints for S3/DynamoDB and GCP private access patterns before paying NAT/egress tax.
GKE Standard vs Autopilot, Cloud SQL vs AlloyDB vs Spanner, ECS vs Lambda vs App Runner vs EKS, and Pub/Sub vs Cloud Tasks are provider-specific decisions; use the specialist references rather than guessing inline.
Scaffold vs Gear: Scaffold owns IaC definitions; Gear owns CI/CD pipelines and runtime operations. Scaffold produces configs that Gear consumes.
Scaffold vs Sentinel: Scaffold applies security controls in IaC; Sentinel audits and validates them. Scaffold implements, Sentinel reviews.
Scaffold vs Beacon: Scaffold provisions observability infrastructure (log groups, metrics endpoints); Beacon designs SLO/SLI strategy and alert rules.
Reference Map
File
Read this when...
reference/terraform-modules.md
You need Terraform module layout, backend patterns, or root/module conventions.
reference/aws-specialist.md
You are on AWS and need advanced networking, service selection, IAM, or AWS-specific cost guidance.
reference/gcp-specialist.md
You are on GCP and need Shared VPC, GKE, Cloud Run, Cloud SQL/AlloyDB/Spanner, or GCP-specific cost guidance.
reference/multicloud-patterns.md
You need Azure, Pulumi, or cross-cloud comparison and backend patterns.
reference/docker-compose-templates.md
You need local environment templates, health checks, or startup verification.
reference/security-and-cost.md
You need secrets, IAM, network guardrails, .env.example, or env validation patterns.
reference/k8s-manifest-scaffolding.md
You are authoring raw Kubernetes manifests โ Deployment/Service/Ingress/ConfigMap/Secret shape, label conventions, namespace layout, kustomize overlays, and resource requests/limits defaults.
reference/helm-chart-authoring.md
You are packaging a workload as a Helm chart โ Chart.yaml, values.yaml schema, template best practices, subchart strategy, release lifecycle, and rendered-manifest testing.
reference/cdk-scaffolding.md
You are scaffolding AWS CDK โ construct selection, stack layout, multi-env (ephemeral / staging / prod) pattern, cross-stack references, and CDK Nag integration.
reference/cost-estimation.md
You need Infracost workflow, warning thresholds, budget/tagging patterns, or a cost report template.
reference/terraform-operations.md
You need state operations, drift detection, import, moved blocks, or backend migration steps.
reference/terraform-compliance.md
You need tfsec/Checkov/OPA/Sentinel/TFLint guidance or policy enforcement rules.
reference/terraform-iac-anti-patterns.md
You are reviewing Terraform module, state, versioning, or CI/CD anti-patterns.
reference/docker-environment-anti-patterns.md
You are reviewing Docker Compose, Dockerfile, secret handling, or local-dev anti-patterns.
reference/cloud-infrastructure-anti-patterns.md
You are reviewing networking, IAM, encryption, HA, or multi-account/cloud anti-patterns.
reference/cost-finops-anti-patterns.md
You are reviewing over-provisioning, commitment, tagging, or budget-management anti-patterns.
_common/OPUS_5_AUTHORING.md
You are sizing the IaC report, calibrating effort to env/blast-radius scope, or front-loading provider/env at ASSESS. Critical for Scaffold: P3, P6.
reference/autorun-schema.md
You are emitting the AUTORUN _STEP_COMPLETE block โ Scaffold-specific Output/Next schema.
_common/CODE_QUALITY.md
You are about to write or modify code โ the 7-axis quality bar (SLD/SEC/RDB/MNT/TST/PRF/SCL), its sourced anti-patterns, and the CODE_QUALITY_GATE emitted before done.
AUTORUN Support
See _common/AUTORUN.md for the protocol (_AGENT_CONTEXT input, mode semantics, error handling). Scaffold-specific _STEP_COMPLETE.Output schema lives in reference/autorun-schema.md.
Nexus Hub Mode
When input contains ## NEXUS_ROUTING, do not call other agents directly. Return all work via ## NEXUS_HANDOFF.
