| name | infrastructure-as-code-terraform |
| description | Use when writing, reviewing, or debugging Terraform/OpenTofu modules, tests, CI/CD pipelines, or state operations. Diagnoses failure modes (identity churn, secrets, blast radius, CI drift, state corruption) with version-aware guidance. |
| license | Apache-2.0 |
| metadata | {"author":"Building Blocks","version":"2.0.0"} |
Terraform/OpenTofu IaC Skill
Diagnose-first guidance for Infrastructure as Code. This skill helps you write, review, and debug Terraform/OpenTofu configurations by identifying failure modes before generating solutions.
When to Use This Skill
Activate this skill when you need to:
- Write or review Terraform/OpenTofu configurations
- Debug state issues or resource drift
- Set up testing frameworks or CI/CD pipelines
- Implement security best practices
- Migrate between backends or versions
- Refactor modules or resource addressing
Core Workflow
**Capture Context** - Identify runtime (terraform/tofu), version, providers, backend, execution path (local/CI/Cloud), and environment criticality.
**Diagnose Failure Mode** - Use the failure mode table in `workflow/diagnosis-table.md` to identify which category applies: identity churn, secret exposure, blast radius, CI drift, compliance gaps, testing blind spots, state corruption, or provider risks.
**Load Reference Materials** - Access only the relevant reference files based on the diagnosed failure mode. Don't preload unnecessary depth.
**Propose Solution** - Generate fix with risk controls, explaining why this addresses the failure mode, what could still go wrong, and what guardrails are needed (tests/approvals/rollback).
**Generate Artifacts** - Create HCL code, migration blocks (`moved`, `import`), CI configuration, or policy rules as needed.
**Validate** - Run validation commands tailored to the risk tier before finalizing.
**Document Response** - Provide the complete response contract (see `workflow/response-contract.md`).
Response Contract
Every response must include:
- Assumptions & version floor - Runtime, exact version, providers, backend, execution path, environment criticality
- Risk category addressed - Which failure mode(s) being solved
- Chosen remediation & tradeoffs - What was chosen, what was traded off, why
- Validation plan - Exact commands (
fmt -check, validate, plan -out, policy check)
- Rollback notes - For destructive changes: how to undo, what evidence to keep
Critical Rule: Never recommend direct production apply without a reviewed plan artifact and approval.
Key Principles
- Diagnose before generate - Identify root cause first
- Version-aware - Check feature availability for target version
- Progressive disclosure - Load depth only when needed
- Risk-first - Always consider blast radius and rollback
- Validation-gated - Test before apply
Supporting Resources
All detailed guidance lives in supporting files:
workflow/ - Core workflow steps and contractsreferences/ - Deep-dive technical referenceschecklists/ - Quick validation checkliststemplates/ - Reusable code templates
Refer to references/quick-reference.md for command cheat sheets and decision flowcharts.
Version Support
- Terraform 1.0+ and OpenTofu 1.6+
- Version-specific features documented in
references/version-features.md
- Cross-version migration guidance available
License: Apache-2.0 | Author: Building Blocks | Version: 2.0.0
