terraform-review

name	terraform-review
description	Review Terraform quality, security, and architecture decisions. Use when reviewing Terraform PRs requiring judgment beyond automated checks across modules and environments.
license	Apache-2.0
metadata	{"author":"y-miyazaki","version":"1.0.2"}

Input

• Terraform .tf/.tfvars files and PR context or file diffs (required)

Output Specification

Return structured Markdown in accordance with references/common-output-format.md.

Minimal inline contract (used if reference file is unavailable):

## Checks Summary

- Total: <n>, Passed: <n>, Failed: <n>, Deferred: <n>

## Checks (Failed/Deferred Only)

| ItemID | Status | Evidence | Fix |

## Issues

1. <ItemID>: <title>
   - File: <path>#L<line>
   - Problem: <specific>
   - Recommendation: <fix>

Each issue must include file path, risk summary, and remediation guidance.

Execution Scope

• Apply review checklist from references/common-checklist.md
• Do not execute validation tools (terraform fmt, terraform validate, tflint, trivy, or terraform-validation skill scripts)
• This skill consumes pre-existing validation output logs as input — it does not produce them
• Do not modify Terraform files or approve/merge PRs
• Scope includes Terraform only; Terragrunt files are out of scope.
• Scope assumes a single repository context.
• Scope is provider-agnostic unless a referenced checklist item states provider-specific constraints.

USE FOR:

• reviewing Terraform PRs for security, architecture, and module design issues
• assessing cross-module risks and environment-specific concerns in Terraform changes
• evaluating Terraform changes when validation output logs are available or partially available

DO NOT USE FOR:

• executing validation tools (terraform fmt/validate, tflint, trivy) — use terraform-validation skill
• implementing new Terraform resources as code changes
• running any CLI validation workflow

Reference Files Guide

• common-checklist.md (always read)
• common-output-format.md (always read)
• common-troubleshooting.md (read on failure)
• category-global.md (always read)
• category-security.md (always read)
• category-modules.md (always read)
• category-state.md (always read)
• category-ci-lint.md (always read)
• category-compliance.md (always read)
• category-cost.md (always read)
• category-data-sources.md (always read)
• category-dependency.md (always read)
• category-events.md (always read)
• category-migration.md (always read)
• category-naming.md (always read)
• category-outputs.md (always read)
• category-patterns.md (always read)
• category-performance.md (always read)
• category-tagging.md (always read)
• category-tfvars.md (always read)
• category-variables.md (always read)
• category-versioning.md (always read)

Workflow

1. Read PR context and module scope.
2. Check if terraform-validation output logs exist (pre-generated by the terraform-validation skill or CI). If logs are missing, inform user: "Validation logs are needed for a complete review. Please run the terraform-validation skill and share output." Then proceed with partial review: evaluate security and architecture checks directly from .tf source, defer tool-dependent checks.
3. If PR context is unavailable, review file diffs only and defer PR-context-dependent checks.
4. If changed files contain no .tf or .tfvars, return status: skipped with reason no Terraform review target.
5. If validation output is partial, keep available findings and defer missing-tool checks with explicit tool name.
6. Review checklist categories touched by changed files and collect failed/deferred items. When uncertain which categories apply, prioritize category-security, category-global, category-modules, and category-state first.
7. If a referenced category file is missing, defer affected checks with the missing file path.
8. Output required sections per references/common-output-format.md. Prioritize SEC-* findings first, then correctness, then maintainability. For conflicting findings, prioritize the higher-severity category and document the conflict in ## Issues.

Error Handling

Condition	Severity	Action
terraform-validation output missing	Recoverable	Defer tool-dependent checks; review security/architecture from source
common-checklist.md unavailable	Fatal	Stop; report missing dependency
common-output-format.md unavailable	Recoverable	Use inline output contract
Changed files contain no .tf/.tfvars	Recoverable	Return status: skipped; reason no Terraform review target
Referenced category file missing	Recoverable	Defer affected checks; note missing file path

Examples

• Prompt: Review this Terraform PR and return failed/deferred checks only.
• Input context: changed files terraform/env/prod/main.tf, terraform/env/prod/variables.tf, terraform/env/prod/terraform.tfvars; validation log missing tflint output.
• Output sample: ## Checks Summary with deferred count, ## Checks (Failed/Deferred Only) including deferred tflint check with reason missing terraform-validation output, and ## Issues ordered by SEC-*, correctness, maintainability.
• Prompt: Review this Terraform PR and report security reasoning from existing validation logs.
• Output sample: security findings are evaluated from existing logs and code context; no validator commands are executed.