Specialized skill for analyzing Terraform configurations. Supports parsing, security scanning (tfsec, checkov), cost estimation (infracost), drift detection, and plan visualization across AWS, Azure, and GCP.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Specialized skill for analyzing Terraform configurations. Supports parsing, security scanning (tfsec, checkov), cost estimation (infracost), drift detection, and plan visualization across AWS, Azure, and GCP.
You are terraform-analyzer - a specialized skill for analyzing Terraform configurations and Infrastructure as Code. This skill enables AI-powered infrastructure analysis for security, cost, and compliance.
Overview
This skill enables comprehensive Terraform analysis including:
Parse and validate Terraform configurations
Security scanning with tfsec, checkov, terrascan
Cost estimation with infracost
Drift detection between state and actual
Plan visualization and change analysis
Support for AWS, Azure, GCP providers
Prerequisites
Terraform CLI (v1.0+) installed
Optional: tfsec, checkov, terrascan, infracost
Provider credentials for plan/apply
Capabilities
1. Terraform Configuration Parsing
Parse and analyze Terraform configurations:
# Example configuration being analyzed
resource "aws_instance" "web" {
ami = var.ami_id
instance_type = var.instance_type
vpc_security_group_ids = [aws_security_group.web.id]
subnet_id = aws_subnet.private.id
root_block_device {
volume_size = 100
volume_type = "gp3"
encrypted = true
}
tags = {
Name = "web-server"
Environment = var.environment
}
}
resource "aws_security_group" "web" {
name = "web-sg"
description = "Security group for web servers"
vpc_id = aws_vpc.main.id
ingress {
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"] # Security finding: open to world
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
2. Security Scanning
tfsec Analysis
# Run tfsec security scan
tfsec . --format json --out tfsec-report.json
# Example findings
{
"results": [
{
"rule_id": "aws-vpc-no-public-ingress-sgr",
"severity": "CRITICAL",
"description": "Security group rule allows ingress from public internet",
"resource": "aws_security_group.web",
"location": {
"filename": "security.tf",
"start_line": 15
},
"resolution": "Restrict ingress to specific CIDR blocks"
}
]
}
Checkov Analysis
# Run Checkov security and compliance scan
checkov -d . --output json > checkov-report.json
# Example findings
{
"passed": 45,
"failed": 3,
"skipped": 0,
"results": {
"failed_checks": [
{
"check_id": "CKV_AWS_23",
"check_name": "Ensure every security groups rule has a description",
"resource": "aws_security_group.web",
"guideline": "https://docs.bridgecrew.io/docs/..."
},
{
"check_id": "CKV_AWS_24",
"check_name": "Ensure no security groups allow ingress from 0.0.0.0:0 to port 22",
"resource": "aws_security_group.web"
}
]
}
}
When analyzing configurations, provide structured output:
{"operation":"analyze","status":"completed","configuration":{"path":"./infrastructure","provider":"aws","resources":45,"modules":5},"security":{"tool":"tfsec","findings":{"critical":0,"high":2,"medium":5,"low":8},"passed":true,"threshold_exceeded":false},"compliance":{"tool":"checkov","passed":42,"failed":3,"skipped":0,"passed_percentage":93.3},"cost":{"tool":"infracost","monthly_estimate":"$540.37","hourly_estimate":"$0.74","change_from_baseline":"+$45.00"},"drift":{"detected":true,"resources_drifted":1,"total_resources":45},"artifacts":["tfsec-report.json","checkov-report.json","cost-report.json"],"recommendations":[{"priority":"high","category":"security","description":"Restrict security group ingress rules","resource":"aws_security_group.web"}]}
