# Terraform Skill

Use when writing, reviewing, or debugging Terraform/OpenTofu modules, tests, CI, scans...

- Repository: https://github.com/antonbabenko/terraform-skill (2434 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-24
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add antonbabenko/terraform-skill --skill terraform-skill -g -a claude-code -y`
Codex: `npx skills add antonbabenko/terraform-skill --skill terraform-skill -g -a codex -y`
Cursor: `npx skills add antonbabenko/terraform-skill --skill terraform-skill -g -a cursor -y`
Gemini CLI: `npx skills add antonbabenko/terraform-skill --skill terraform-skill -g -a gemini-cli -y`

## Description

Use when writing, reviewing, or debugging Terraform/OpenTofu modules, tests, CI, scans, or state ops - diagnoses failure mode (identity churn, secrets, blast radius, CI drift, state corruption) with version-aware guards.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Terraform Skill for Claude

Diagnose-first guidance for Terraform and OpenTofu. Core file is a workflow; depth lives in references loaded on demand.

## Response Contract

Every Terraform/OpenTofu response must include:

1. **Assumptions & version floor**, runtime (`terraform` or `tofu`), exact version, providers, state backend, execution path (local/CI/Cloud/Atlantis), environment criticality. State assumptions explicitly if the user did not provide them.
2. **Risk category addressed**, one or more of: identity churn, secret exposure, blast radius, CI drift, compliance gaps, state corruption, provider upgrade risk, testing blind spots.
3. **Chosen remediation & tradeoffs**, what was chosen, what was traded off, why.
4. **Validation plan**, exact commands (`fmt -check`, `validate`, `plan -out`, policy check) tailored to runtime and risk tier.
5. **Rollback notes**, for any destructive or state-mutating change: how to undo, what evidence to keep.

Never recommend direct production apply without a reviewed plan artifact and approval.

Never run `terraform destroy` (targeted or full) without first running `terraform plan -destroy` and showing the user every resource that will be deleted, including implicit dependents pulled in via locals or `for_each`. Get explicit confirmation before proceeding. Never use `-auto-approve` on destroy.

## Workflow

The rest: https://github.com/antonbabenko/terraform-skill/blob/HEAD/skills/terraform-skill/SKILL.md