메뉴
End-to-end Terraform and OpenTofu security review with static analysis, policy-as-code, secrets scanning, drift detection, and CI/CD gates. Use when hardening IaC, writing OPA/Rego or Sentinel policies, or setting up Trivy/Checkov PR pipelines.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | terraform-security-review |
| version | 0.1.0 |
| description | End-to-end Terraform and OpenTofu security review with static analysis, policy-as-code, secrets scanning, drift detection, and CI/CD gates. Use when hardening IaC, writing OPA/Rego or Sentinel policies, or setting up Trivy/Checkov PR pipelines. |
Guides security reviews of Terraform and OpenTofu infrastructure-as-code across the full lifecycle: authoring, commit, CI/CD, plan-time, and runtime drift detection.
| Reference | Read when | Consult for |
|---|---|---|
references/static-analysis-tools.md | Choosing or configuring scanners | Trivy, Checkov, KICS, TFLint, Infracost setup; comparison matrix; finding normalization |
references/workflow-and-gates.md | Designing gate strategy or pre-commit setup | Pre-commit hooks, PR gate logic, plan-time flow, secret incident response, exception management |
references/ci-cd-integration.md | Building platform-specific pipelines | GitHub Actions, GitLab CI, Azure DevOps workflows; OIDC/WIF auth; SARIF upload patterns |
references/oidc-hardening.md | Securing CI/CD cloud credentials | GitHub/GitLab/Azure DevOps OIDC subject claim restrictions; AWS/Azure/GCP trust policies; common misconfigurations |
references/policy-as-code.md | Writing or reviewing custom governance rules | OPA/Rego policies, Conftest, Sentinel, plan-time evaluation, unknown-value handling, policy testing |
references/native-validation.md | Using Terraform's built-in security features | Variable validation, preconditions/postconditions, check blocks; no external tools needed |
references/secrets-and-drift.md | Detecting secrets or infrastructure drift | Gitleaks, TruffleHog, Terraform-specific secret patterns, drift detection, OpenTofu compatibility |
references/supply-chain-and-state.md | Hardening modules, providers, state, or cloud posture | Provider pinning, module verification, lock files, state encryption, cloud-specific controls, dependency automation |
references/atlantis-and-terragrunt.md | Using Atlantis or Terragrunt securely | Atlantis PR automation with security gates; Terragrunt security risks (run_cmd, generate); OpenTofu support |
references/sources-and-confidence.md | Verifying claims or uncertain areas | Source links, evidence notes, and explicitly flagged low-confidence items |
code-only (HCL source) → static analysis. plan-aware (plan JSON) → plan-time scanning with Checkov or OPA/Conftest. runtime → drift detection.sarif, json, junit) so findings can be gated, trended, and audited.trivy config . instead (all tfsec check IDs work in Trivy).terraform.lock.hcl in CIvariable validation, precondition, postcondition) as a first layer — free, no tools requiredUse this skill when writing PySpark code. Provides PySpark best practices for manageability, testability, and performance including DataFrame patterns, caching strategies, testing approaches, and deployment configurations.
Use this skill when designing REST APIs. Provides REST API design patterns including URL structure, multi-tenancy, request/response formats, HTTP methods, authorization, and testing requirements.
Use this skill when working with Splunk queries, Search Processing Language (SPL), building Splunk searches, creating dashboards, or analyzing log data. This skill provides comprehensive reference material for SPL commands, eval functions, stats functions, regex patterns, and query optimization techniques.
Use this skill when setting up Docker and Docker Compose for local development. Provides development-specific patterns for Dockerfiles and Docker Compose including live reload, volume mounting, and rapid iteration workflows.
Use this skill when building FastAPI applications. Provides FastAPI-specific best practices including project structure, routing with Pydantic models, async database patterns, dependency injection, security, and testing.
Use this skill when working with Kubernetes — writing manifests, managing clusters, debugging workloads, setting up observability, or deploying to EKS. Covers local dev, Helm, kubectl, k9s, Kustomize, OpenTelemetry, Grafana stack, and CI/CD with GitHub Actions.