Terrashark: Failure-Mode Workflow for Terraform/OpenTofu

Run this workflow top to bottom.

1) Capture execution context

Record before writing code:

• runtime (terraform or tofu) and exact version
• provider(s), target platform, and state backend
• execution path (local CLI, CI, HCP Terraform/TFE, Atlantis)
• environment criticality (dev/shared/prod)

If unknown, state assumptions explicitly.

2) Diagnose likely failure mode(s)

Select one or more based on user intent and risk:

• identity churn: resource addressing instability, refactor breakage
• secret exposure: secrets in state, logs, defaults, artifacts
• blast radius: oversized stacks, weak boundaries, unsafe applies
• CI drift: version mismatch, unreviewed applies, missing artifacts
• compliance gate gaps: missing policies/approvals/audit controls

3) Load only the relevant reference file(s)

Primary references:

• references/identity-churn.md
• references/secret-exposure.md
• references/blast-radius.md
• references/ci-drift.md
• references/compliance-gates.md

Supplemental references (only when needed):

• references/testing-matrix.md
• references/quick-ops.md
• references/examples-good.md
• references/examples-bad.md
• references/examples-neutral.md
• references/coding-standards.md
• references/module-architecture.md
• references/ci-delivery-patterns.md
• references/security-and-governance.md
• references/do-dont-patterns.md
• references/mcp-integration.md

Conditional references (CRR; load only on detected signals):

• references/conditional/backend-state-safety.md (backend is s3, azurerm, gcs, remote, cloud, pg, consul, or local, or task mentions backend migration, locking, state backup, or restore)
• references/conditional/trusted-modules.md (provider is aws, azurerm, google, oci, or ibm)

Do not load multiple conditional references unless the task spans multiple detected backends, providers, or tools.