design-aws-terraform-iac

星标10

分支3

更新时间2026年6月27日 19:33

Designs AWS-targeted Terraform infrastructure plans before implementation. Focuses on service selection, module boundaries, state/backends, environment separation, security/compliance guardrails, acceptance criteria, and explicit risk/validation assumptions.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

来源

soulcodex

soulcodex/agentic

打开 GitHub 仓库查看创作者相关仓库

下载

Design AWS Terraform IaC Skill

Design AWS Terraform infrastructure before writing module code.

Always pair this skill with terraform-risk-playbook. That skill is authoritative for the response contract, failure-mode classification, version/runtime guards, validation chain, and rollback notes.

Step 1 - Confirm Scope and Constraints

Capture required outcomes:

workloads and critical paths
regions, environments, and compliance constraints
cost boundaries and availability targets
runtime and version assumptions
backend and execution path assumptions (local, CI, Terraform Cloud, Atlantis)

Capture non-goals to prevent accidental over-design.

Step 2 - Map Services and Responsibility Boundaries

Use aws-service-matrix.md to map each capability to:

primary AWS service(s)
related Terraform module boundary
key operational risks and ownership notes

Design composable modules with explicit interfaces between network, security, platform, and workload layers.

Step 3 - Define State and Environment Strategy

Decide and document:

remote backend (prefer s3 with use_lockfile = true; use DynamoDB locking only as a temporary compatibility bridge for older Terraform workflows)
state key strategy per environment and region
promotion model (dev -> staging -> prod)
drift and rollback expectations
explicit handling for sensitive values in state and plans

Step 4 - Define Security and Policy Baselines

Specify minimum required controls:

IAM least privilege for CI and runtime roles
encryption at rest and in transit
tag standards for ownership, cost, and data classification
log/audit coverage and retention
secret source-of-truth and rotation boundary (for example, Secrets Manager references rather than plaintext values in variables)

Step 5 - Produce a Design Brief and Acceptance Criteria

Output a compact design brief with:

service choices and tradeoffs
module map and dependency order
state strategy and CI plan/apply gate strategy
explicit risk categories and validation expectations
rollback notes for destructive or state-mutating steps
measurable acceptance checks from acceptance-checklist.md

This skill is planning-first. For module file layout and implementation details, use create-terraform-module. For test strategy and terraform test patterns, use create-terraform-tests.

同仓库更多 Skills

同仓库

terraform-infrastructure

soulcodex/agentic

Structures, writes, and reviews Terraform infrastructure code. Covers module layout, remote state, workspace strategy, variable and secrets handling, CI plan/apply pipeline, naming conventions, and multi-region deployment patterns (provider aliases, per-region state, failover strategies), while delegating shared risk classification, version guards, and rollback contract to `terraform-risk-playbook`. Invoked when the user asks to write Terraform, set up infrastructure as code, or review IaC.

2026-06-2710

create-terraform-module

soulcodex/agentic

Creates or updates AWS-oriented Terraform module structure and implementation scaffolding. Focuses on file layout, variable/output contracts, provider and version constraints, tagging standards, safe composition patterns, and address-stability guardrails.

2026-06-2710

create-terraform-tests

soulcodex/agentic

Designs and implements Terraform module tests for AWS-targeted modules. Covers terraform-native tests, validation gates, fixture composition, and risk-focused assertions for regressions, address migration, and unsafe changes.

2026-06-2710

terraform-risk-playbook

soulcodex/agentic

Diagnoses Terraform/OpenTofu risk before generating changes. Defines the response contract, failure-mode routing, version/runtime guards, validation commands, and rollback expectations for modules, tests, CI, and state work.

2026-06-2710

use-aws-mini-stack-emulator

soulcodex/agentic

Uses lightweight AWS stack emulation for faster local Terraform iteration. Defines what can be safely validated locally, compatibility caveats, and the handoff boundary to real-AWS verification and reviewed plan/apply flows.

2026-06-2710

code-review-architecture

soulcodex/agentic

Architecture-focused code review covering hexagonal boundary violations, DDD anti-patterns, CQRS misuse, and microservices coupling issues. Applied in addition to the language-specific review skill when architecture markers are detected. Invoked when reviewing hexagonal architectures, DDD patterns, or microservices boundaries.

2026-05-3010

name	design-aws-terraform-iac
description	Designs AWS-targeted Terraform infrastructure plans before implementation. Focuses on service selection, module boundaries, state/backends, environment separation, security/compliance guardrails, acceptance criteria, and explicit risk/validation assumptions.
version	1.1.0
tags	["devops","terraform","aws","iac","architecture"]
resources	["aws-service-matrix.md","acceptance-checklist.md"]
vendor_support	{"claude":"native","opencode":"native","copilot":"prompt-inject","codex":"prompt-inject","gemini":"prompt-inject"}

Design AWS Terraform IaC Skill

Design AWS Terraform infrastructure before writing module code.

Step 1 - Confirm Scope and Constraints

Capture required outcomes:

workloads and critical paths
regions, environments, and compliance constraints
cost boundaries and availability targets
runtime and version assumptions
backend and execution path assumptions (local, CI, Terraform Cloud, Atlantis)

Capture non-goals to prevent accidental over-design.

Step 2 - Map Services and Responsibility Boundaries

Use aws-service-matrix.md to map each capability to:

primary AWS service(s)
related Terraform module boundary
key operational risks and ownership notes

Design composable modules with explicit interfaces between network, security, platform, and workload layers.

Step 3 - Define State and Environment Strategy

Decide and document:

remote backend (prefer s3 with use_lockfile = true; use DynamoDB locking only as a temporary compatibility bridge for older Terraform workflows)
state key strategy per environment and region
promotion model (dev -> staging -> prod)
drift and rollback expectations
explicit handling for sensitive values in state and plans

Step 4 - Define Security and Policy Baselines

Specify minimum required controls:

IAM least privilege for CI and runtime roles
encryption at rest and in transit
tag standards for ownership, cost, and data classification
log/audit coverage and retention
secret source-of-truth and rotation boundary (for example, Secrets Manager references rather than plaintext values in variables)

Step 5 - Produce a Design Brief and Acceptance Criteria

Output a compact design brief with:

service choices and tradeoffs
module map and dependency order
state strategy and CI plan/apply gate strategy
explicit risk categories and validation expectations
rollback notes for destructive or state-mutating steps
measurable acceptance checks from acceptance-checklist.md

This skill is planning-first. For module file layout and implementation details, use create-terraform-module. For test strategy and terraform test patterns, use create-terraform-tests.