● Communauté
antonbabenko
⚡ Instantané
terraform-skill
par antonbabenko · antonbabenko/terraform-skill
Maintained by Anton Babenko — Terraform and OpenTofu patterns from terraform-best-practices.com and terraform-aws-modules, with when-and-why decision frameworks.
A Claude agent skill for Terraform/OpenTofu work. Teaches Claude to choose between native Terraform tests (1.6+) and Terratest, structure modules like terraform-aws-modules, wire up GitHub Actions / GitLab CI with cost estimation and security scanning, and apply production patterns. Explains not just 'what' but 'when and why'.
Pourquoi l'utiliser
Fonctionnalités clés
- Testing decision framework: native tests vs Terratest by scenario
- Module structure, naming, versioning, and docs conventions
- Ready-to-adapt GitHub Actions and GitLab CI pipelines with Infracost + tfsec/Checkov
- Side-by-side recommended vs problematic patterns
- Based on terraform-best-practices.com and the terraform-aws-modules ecosystem
Démo en direct
Aperçu en pratique
terraform-skill.replay
▶ prêt
Cas d'usage
Usages concrets : terraform-skill
Quand l'utiliser : You're splitting out a module for internal or public reuse and want the structure right the first time.
Déroulement
-
State the module's purpose
Use the terraform-skill. Scaffold a module for an AWS ECS service with optional ALB and CloudWatch alarms.✓ Copié
→ Structure follows terraform-aws-modules conventions — main.tf, variables.tf, outputs.tf, versions.tf, README.md, examples/
-
Add tests
Recommend tests — native or Terratest? Apply the decision framework.✓ Copié
→ Reasoned choice and scaffolded test files
Résultat : A module that passes review on the first PR.
Pièges
- Versioning too loose (~> vs specific) — Skill defaults to pinned minors for required_providers
Quand l'utiliser : Your repo lacks plan-on-PR, cost checks, or security scans.
Prérequis
- GitHub or GitLab hosting — For the respective pipeline template
Déroulement
-
Request the pipeline
Use terraform-skill. Add GitHub Actions for plan-on-PR, Infracost, tfsec, and gated apply on main.✓ Copié
→ Workflow files with concurrency guards, OIDC auth, status checks
-
Security tune
Which Checkov / tfsec rules should we fail on vs warn?✓ Copié
→ Opinionated list with rationale
Résultat : A pipeline that blocks risky changes without slowing everyone down.
Pièges
- Pipeline uses long-lived AWS keys — Skill prefers OIDC/role assumption, not static keys
Quand l'utiliser : You feel the pain of copy-pasted env folders or a monolith state.
Déroulement
-
Describe the envs
Use terraform-skill. We need dev/staging/prod plus per-tenant envs. What layout scales?✓ Copié
→ Recommendation with tradeoffs (workspaces vs dirs vs Terragrunt)
-
Plan the migration
We're currently on a single state. Sketch the migration.✓ Copié
→ State-move plan with risk callouts
Résultat : A layout you can defend in an ADR.
Pièges
- Moving state without imports/breakdowns can destroy resources — The skill insists on terraform state mv / import steps, not delete-and-recreate
Combinaisons
Associez-le à d'autres MCPs pour un effet X10
Skill produces module + workflow; GitHub MCP opens the PR
Scaffold the module, add the workflow, open a PR into our platform repo.✓ Copié
Cross-check the Terraform plan against live AWS state
Show me the plan, then diff against actual resources via the AWS MCP.✓ Copié
Coût et limites
Coût d'exécution
- Quota d'API
- None
- Tokens par appel
- 2-6k per session — moderate
- Monétaire
- Free — skill is local
- Astuce
- Ask one focused question (testing / CI / layout) at a time.
Sécurité
Permissions, secrets, portée
Stockage des identifiants : No credentials in the skill. Any provider creds belong in your env, not the generated code.
Sortie de données : None from the skill itself
- Generated CI pipelines may reference secret names — make sure you set those secrets in the repo settings before merging.
Dépannage
Erreurs courantes et correctifs
Skill's suggestion conflicts with your org's style
Provide your .terraform-docs config and existing module as style anchors.
Recommended OIDC setup fails on assume-role
Check the trust policy's sub condition matches your branch/env.
Alternatives
terraform-skill vs autres
| Alternative | Quand l'utiliser | Compromis |
|---|
| Terragrunt-first skills | You're committed to Terragrunt | Less coverage here; Terragrunt workflows differ substantially |
| Cloud-provider-native IaC skills (aws-cdk, pulumi) | You're not on Terraform/OpenTofu | Different tool, different patterns |