Menu
Terraform best practices: state, security, modules, workflow, testing, tooling. Use when writing or reviewing Terraform code.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | terraform |
| description | Terraform best practices: state, security, modules, workflow, testing, tooling. Use when writing or reviewing Terraform code. |
dev, staging, prod). Never share state across envs.tfstate or .tfstate.backup to git. Add to .gitignoresensitive = true on all outputs containing secrets, tokens, or credentials. Limits plaintext exposure in logs and state diffs.tf files or terraform.tfvars committed to git. Pass via TF_VAR_* env vars, Vault, or secret manager at plan/apply timeprevent_destroy = true on critical resources (databases, buckets, KMS keys)plan before every apply. Review the diff. Never auto-apply to production without human approval~> 5.0 locks to 5.x not 6.x. Full pins for production stabilityrequired_version in every root module. Prevents silent version drift across team membersplan on PR (post as comment), apply on merge to main. Never apply from developer laptops in productionterraform fmt -recursive and terraform validate in CI. Fail on violationstflint for provider-specific lint. checkov or tfsec for security misconfigurations. Both in CI pre-applyplan runs that alert on non-empty diffsterraform-docs to auto-generate module README from variables and outputs. Enforce via CI checktfenv for CLI version management. Commit .terraform-version to reposensitive = true on any output with secret values?ref=main — breaks reproducibilityfor_each over count for resources with identity (databases, buckets, queues). count only for truly homogeneous replicasmoved blocks when renaming or refactoring resources. removed blocks when deleting managed resourcesvalidation { condition = ... error_message = "..." }<env>-<service>-<resource>. Pick one convention, enforce via tflintlocals for repeated expressions. No duplicated logic across resourcesterraform_data (1.4+) over deprecated null_resource for triggers and lifecycle hookslocal-exec provisioners — side effects that survive plan/apply cycles. Use provider resourceslifecycle blocks only when needed. Document ignore_changes with a comment explaining whydata source lookups from resource definitions. No inline data lookups mixed into resource argumentsterraform test (native, 1.6+) for unit and integration testing of modulescheck blocks for post-apply assertions: validate actual resource state beyond what Terraform tracks| Tool | Purpose |
|---|---|
tfenv | CLI version management |
terraform fmt | Formatting |
tflint | Provider-aware linting |
checkov / tfsec | Security misconfiguration scanning |
| Infracost | Cost delta per PR |
| Atlantis | Self-hosted GitOps PR automation |
terraform-docs | Auto-generated module documentation |
| Terragrunt | DRY multi-env root module wiring |
terraform test / Terratest | Module testing |
Docker best practices: image security, build efficiency, runtime hardening, Compose, local tooling (Colima, OrbStack). Use when writing or reviewing Dockerfiles and Compose files.
AWS best practices: IAM, secrets, networking, security, compute, IaC, ops. Use when building, reviewing, or modifying AWS resources.
GCP best practices: IAM, secrets, networking, security, compute, IaC, ops. Use when building, reviewing, or modifying GCP resources.
Idiomatic Go 1.25 practices: errors, interfaces, concurrency, generics, testing, security, tooling. Use when writing or reviewing Go code.
Modern Java practices: design, errors, concurrency, security, testing, tooling. Targets Java 21 LTS baseline; Java 25 LTS features called out explicitly. Use when writing or reviewing Java code.
Behavioral guidelines to reduce common LLM coding mistakes. Use when writing, reviewing, or refactoring code to avoid overcomplication, make surgical changes, surface assumptions, and define verifiable success criteria.