{
"markdown": "# Terraform & OpenTofu Skill for AI Agents\n\n[](https://agentskills.io)\n[](https://www.terraform.io/)\n[](https://opentofu.org/)\n[](LICENSE)\n\nA best-practices skill for Terraform and OpenTofu, for AI coding agents (Claude Code, Cursor, Copilot, Gemini CLI, OpenCode, Codex, Kiro, and more). It helps the agent test code, structure modules, set up CI/CD, and write production infrastructure code.\n\nAWS, Azure, and GCP are all first-class. AWS stays the default in examples, but the same backend, auth, security, and resource guidance applies to all three - ask for the Azure or GCP equivalent of any pattern and the skill maps it.\n\n## What this skill provides\n\n**Testing frameworks**\n- Decision matrix for native tests vs Terratest\n- Testing workflows (static, integration, E2E)\n- Examples and patterns\n\n**Module development**\n- Structure and naming conventions\n- Versioning strategies\n- Public vs private module patterns\n\n**State management**\n- Remote backends (S3, Azure, GCS, Terraform Cloud)\n- Locking and security\n- Multi-team state isolation\n- Migration and recovery procedures\n\n**CI/CD integration**\n- GitHub Actions workflows\n- GitLab CI examples\n- Cost optimization\n- Compliance automation\n\n**Security and compliance**\n- Trivy and Checkov integration\n- Policy-as-code patterns\n- Compliance scanning workflows\n\n**Quick reference**\n- Decision flowcharts\n- Common patterns (DO vs DON'T)\n- Cheat sheets\n\n## Installation\n\nInstalled through one Claude Code marketplace, `antonbabenko/agent-plugins`\n(terraform-skill is listed there as an external plugin). Do not also add\n`antonbabenko/terraform-skill` as a marketplace - both use the same marketplace\nname and will clash.\n\n### Quick install (any agent)\n\nWorks with any [Agent Skills](https://agentskills.io)-compatible tool:\n\n```bash\nnpx skills add https://github.com/antonbabenko/terraform-skill\n```\n\n### Per-host instructions\n\n\n\n\nClaude Code
\n\n```bash\n/plugin marketplace add antonbabenko/agent-plugins\n/plugin install terraform-skill@antonbabenko\n```\n\n \n\n\nGemini CLI
\n\n```bash\ngemini extensions install https://github.com/antonbabenko/terraform-skill\n```\n\nUpdate with `gemini extensions update terraform-skill`.\n\n \n\n\nCursor
\n\n```bash\ngit clone https://github.com/antonbabenko/terraform-skill.git ~/.cursor/skills/terraform-skill\n```\n\nCursor auto-discovers skills from `.agents/skills/` and `.cursor/skills/`.\n\n \n\n\nCopilot
\n\n```bash\n/plugin install https://github.com/antonbabenko/terraform-skill\n# or\ngit clone https://github.com/antonbabenko/terraform-skill.git ~/.copilot/skills/terraform-skill\n```\n\nCopilot auto-discovers skills from `.copilot/skills/`.\n\n \n\n\nOpenCode
\n\n```bash\ngit clone https://github.com/antonbabenko/terraform-skill.git ~/.agents/skills/terraform-skill\n```\n\nOpenCode auto-discovers skills from `.agents/skills/`, `.opencode/skills/`, and `.claude/skills/`.\n\n \n\n\nCodex (OpenAI)
\n\n```bash\ngit clone https://github.com/antonbabenko/terraform-skill.git ~/.agents/skills/terraform-skill\n```\n\nCodex auto-discovers skills from `~/.agents/skills/` and `.agents/skills/`. Update with `cd ~/.agents/skills/terraform-skill && git pull`.\n\nFor a managed Codex plugin install, use the `antonbabenko/agent-plugins`\nmarketplace (`codex plugin marketplace add antonbabenko/agent-plugins`, then\ninstall `terraform-skill`). Do not add `antonbabenko/terraform-skill` as a\nseparate marketplace - it clashes by name with `agent-plugins`.\n\n \n\n\nAutohand Code
\n\nInstall the skill globally:\n\n```bash\ngit clone https://github.com/antonbabenko/terraform-skill.git\nmkdir -p ~/.autohand/skills\ncp -R terraform-skill/skills/terraform-skill ~/.autohand/skills/\n```\n\nOr install it only for the current project:\n\n```bash\ngit clone https://github.com/antonbabenko/terraform-skill.git\nmkdir -p .autohand/skills\ncp -R terraform-skill/skills/terraform-skill .autohand/skills/\n```\n\nAutohand Code discovers skills from `~/.autohand/skills/` and `.autohand/skills/`.\n\n \n\n\nKiro
\n\n```bash\ngit clone https://github.com/antonbabenko/terraform-skill.git ~/.kiro/skills/terraform-skill\n```\n\nKiro auto-discovers skills from `.kiro/skills/` (workspace) and `~/.kiro/skills/` (global).\n\n \n\n\nAntigravity/Antigravity IDE/Antigravity CLI
\n\n```bash\ngit clone https://github.com/antonbabenko/terraform-skill.git\nln -s \"$(pwd)/terraform-skill/skills/terraform-skill\" ~/.gemini/config/skills/terraform-skill\n```\n\nUpdate with `git pull`.\n\n \n\n\nKiro
\n\nThis repo is also a [Kiro Power](https://kiro.dev/docs/powers/) (root\n`POWER.md` + optional `mcp.json`). In Kiro: **Powers panel → \"Add power from\nGitHub\"**, then paste:\n\n```text\nhttps://github.com/antonbabenko/terraform-skill\n```\n\nKiro activates the power on keyword match (e.g. \"terraform\", \"opentofu\",\n\"state\", \"modules\"). Installing it also registers the optional read-only\nHashiCorp `terraform-mcp-server` (from `mcp.json`) under the Powers section of\n`~/.kiro/settings/mcp.json` — the guidance works without it. `POWER.md` is\ngenerated from `skills/terraform-skill/SKILL.md`; the skill content is shared,\nnot duplicated.\n\n \n\n\nManual (symlink local clone)
\n\n```bash\ngit clone https://github.com/antonbabenko/terraform-skill\nmkdir -p ~/.claude/plugins\nln -s \"$(pwd)/terraform-skill\" ~/.claude/plugins/terraform-skill\n```\n\nClaude Code autodiscovers the skill at `skills/terraform-skill/SKILL.md` on next launch. Edits to the clone are picked up live.\n\n \n\n\n\n### Verify installation\n\nAfter installation, try:\n```\n\"Create a Terraform module with testing for an S3 bucket\"\n```\n\nClaude picks up the skill automatically when working with Terraform or OpenTofu code.\n\n## Recommended companion: code-intelligence\n\nInstall the `code-intelligence` plugin alongside this one:\n\n```bash\n/plugin marketplace add antonbabenko/agent-plugins\n/plugin install code-intelligence@antonbabenko\n```\n\nIt holds the general, any-language rules for navigating code (when to use a\nlanguage server, plain text search, or fuzzy search; how to anchor a lookup to\na position; what to do when a tool fails; saying so when one tool is swapped\nfor another). terraform-skill is the Terraform-specific version of those rules.\nWhy install it:\n\n- **Fewer tokens** - the rules live in one place. The agent loads them when\n needed instead of repeating them in every language skill.\n- **More accurate** - it finds definitions and references by meaning, not by\n plain text matching, so renames and refactors do not miss spots or change\n the wrong ones.\n- **Faster** - it picks the right tool the first time instead of retrying,\n and says up front when it had to use a different one.\n\nterraform-skill works on its own without it. The name `code-intelligence` is\nnot unique; if a `code-intelligence` skill is active, check it is the one from\n[antonbabenko/agent-plugins](https://github.com/antonbabenko/agent-plugins).\n\n## Quick start examples\n\n**Create a module with tests (AWS / Azure / GCP):**\n> \"Create a Terraform module for an AWS VPC with native tests\"\n>\n> \"Build an Azure module: VNet, subnets, and a PostgreSQL Flexible Server, with native tests\"\n>\n> \"Write a GCP module for a VPC network, subnetwork, and Cloud SQL Postgres, with native tests\"\n\n**Set up remote state:**\n> \"Configure an S3 backend with native `use_lockfile` locking and encryption for Terraform state\"\n>\n> \"Choose and configure a remote state backend for AWS, Azure, or GCP (locking, encryption, versioning)\"\n\n**Review existing code:**\n> \"Review this Terraform configuration following best practices\"\n\n**Generate CI/CD workflow:**\n> \"Create a GitHub Actions workflow for Terraform with cost estimation\"\n\n**Testing strategy:**\n> \"Help me choose between native tests and Terratest for my modules\"\n\n**State management:**\n> \"How should I organize state files for a multi-team environment?\"\n\n## Longer example prompts\n\nThese assume a recent Terraform/OpenTofu - `use_lockfile` is 1.10+, `write_only` is 1.11+.\n\n\nAWS: production service (modules + composition, OIDC, native locking)
\n\n> \"I'm building a new production service on AWS. Design reusable Terraform modules plus a prod/staging composition for a VPC with public/private subnets across 3 AZs, an ECS Fargate service behind an ALB, and an RDS Postgres instance. Include native `terraform test` coverage, variables with descriptions/types/validation, S3 remote state with encryption, bucket versioning, and native `use_lockfile` locking (Terraform 1.10+). Keep secret values out of plan/state - use `write_only` / `*_wo` arguments where the provider supports them (Terraform 1.11+) and Secrets Manager/SSM references for runtime secrets. Add a GitHub Actions workflow that runs fmt/validate/tflint/trivy on PRs, produces a reviewed plan artifact, and applies it via AWS OIDC (no static keys). Keep prod/staging state isolated and follow naming conventions.\"\n\n \n\n\nGCP: port the AWS pattern (cross-cloud mapping, WIF, gcs backend)
\n\n> \"We're standardizing IaC across clouds. Port our AWS module pattern to GCP: reusable modules plus an environment composition for a VPC network, a regional subnetwork, and a Cloud SQL Postgres instance (`google_sql_database_instance`). Use the `gcs` backend (`bucket` + `prefix`) for remote state, and show the state bootstrap bucket separately with object versioning, uniform bucket-level access, public access prevention, and IAM bindings. Use Workload Identity Federation for keyless GitHub Actions auth (no long-lived service-account keys) and native tests. Also show the cross-cloud equivalents (resources + backend) so the team sees the AWS-to-GCP mapping.\"\n\n \n\n## What it covers\n\n### Testing strategy\n\nDecision matrices for native tests (Terraform 1.6+) vs Terratest (Go-based), plus multi-environment testing patterns.\n\n### Module development\n\nNaming conventions (`terraform--`), directory structure, input/output design, version constraints, and documentation standards.\n\n### CI/CD workflows\n\nGitHub Actions, GitLab CI, Atlantis, Infracost cost estimation, Trivy/Checkov scanning, and compliance checks.\n\n### Security and compliance\n\nStatic analysis, policy-as-code, secrets management, state file security, backend encryption, and compliance scanning workflows.\n\n### Patterns and anti-patterns\n\nSide-by-side DO vs DON'T examples for variable naming, resource naming, module composition, state management, and provider configuration.\n\n## Why this skill\n\nThis skill started from field-tested Terraform and OpenTofu patterns, then grew through contributions from people who hit missing guidance and added it back.\n\n**Sources:**\n- Patterns from [terraform-best-practices.com](https://www.terraform-best-practices.com/)\n- Approaches used across the [terraform-aws-modules](https://github.com/terraform-aws-modules) collection\n- AWS Hero experience with enterprise IaC\n\n**Version-specific guidance:**\n- Terraform 1.0+ features\n- OpenTofu 1.6+ compatibility\n- Native test framework (1.6+)\n- Current tooling ecosystem (2024-2026)\n\n**Decision frameworks:** not just \"what to do\" but \"when and why\".\n\n## Requirements\n\n- An AI agent with skill support: Claude Code, Cursor, Copilot, Gemini CLI, OpenCode, Codex, Kiro, or any [Agent Skills](https://agentskills.io)-compatible host\n- Terraform 1.0+ or OpenTofu 1.6+\n- Optional: [Terraform MCP server](https://github.com/hashicorp/terraform-mcp-server) for registry integration\n\n## Code intelligence (optional)\n\nThe skill works without a language server. To jump to a definition, find\nreferences, outline a file, or show hover docs, it can also use\n[terraform-ls](https://github.com/hashicorp/terraform-ls), HashiCorp's official\nTerraform language server.\n\n- **Optional.** Without terraform-ls the skill falls back to text search\n (`rg`) plus reading files. Nothing breaks; you get text matches instead of\n matches by meaning.\n- **Needs.** A local `terraform` (or `tofu`) binary on `PATH`, and\n `terraform init` run in the workspace, before it can resolve names across\n modules and providers.\n- **Install.** Get it from the\n [terraform-ls releases](https://github.com/hashicorp/terraform-ls/releases)\n page, or turn it on through your editor or agent host. Use whatever version\n your host supports.\n - Claude Code: install it as an LSP plugin -\n `/plugin marketplace add boostvolt/claude-code-lsps` then\n `/plugin install terraform-ls@claude-code-lsps`.\n\nHow the skill uses it:\n\n- Use the language server to follow a name to where it is defined or used; use\n `rg` plus reading files for exact text, known names, `.tfvars`, comments, and\n non-HCL files.\n- Point the language server at a spot in the file first (find an occurrence,\n then ask about that position).\n- terraform-ls cannot rename for you. To rename a variable, local, or output:\n find every reference, then edit each by hand. To rename a resource or module\n address: use a `moved` block, not a text replace.\n\n## Contributing\n\nSee [CLAUDE.md](CLAUDE.md) for skill development guidelines, content structure, how to propose improvements, and the validation approach.\n\nReport bugs or request features via [GitHub Issues](https://github.com/antonbabenko/terraform-skill/issues).\n\n## Related resources\n\n### Official documentation\n- [Terraform Language](https://developer.hashicorp.com/terraform/docs)\n- [Terraform Testing](https://developer.hashicorp.com/terraform/language/tests) - native test framework\n- [OpenTofu Documentation](https://opentofu.org/docs/)\n- [HashiCorp Recommended Practices](https://developer.hashicorp.com/terraform/cloud-docs/recommended-practices)\n\n### Community resources\n- [Terraform compliance-as-code docs](https://compliance.tf/docs/) - Compliance frameworks, controls, implementation guides, remediations, etc\n- [Awesome Terraform](https://github.com/shuaibiyy/awesome-tf)\n- [Awesome Terraform Compliance](https://github.com/antonbabenko/awesome-terraform-compliance)\n- [Terraform Best Practices](https://terraform-best-practices.com) - the guide this skill is based on\n- [terraform-aws-modules](https://github.com/terraform-aws-modules) - AWS modules collection\n- [Terratest](https://terratest.gruntwork.io/docs/) - Go testing framework for Terraform\n- [Google Cloud Best Practices](https://docs.cloud.google.com/docs/terraform/best-practices/general-style-structure)\n- [AWS Terraform Best Practices](https://docs.aws.amazon.com/prescriptive-guidance/latest/terraform-aws-provider-best-practices/introduction.html)\n\n### Development tools\n- [pre-commit-terraform](https://github.com/antonbabenko/pre-commit-terraform) - pre-commit hooks for Terraform\n- [terraform-docs](https://terraform-docs.io/) - generate documentation from modules\n- [terraform-switcher](https://github.com/warrensbox/terraform-switcher) - Terraform version manager\n- [TFLint](https://github.com/terraform-linters/tflint) - Terraform linter\n- [Trivy](https://github.com/aquasecurity/trivy) - IaC security scanner\n\n## License\n\nApache 2.0\n",
"bytes": 15549,
"sha": "ad850aef25fee23d406b02f1d47e3df0258e2e28e24c73f97297c1e77603ac7e",
"repo_slug": "antonbabenko/terraform-skill",
"fonte": "repo",
"truncated": false,
"api": "https://agentalog.com/api/listings/skl_antonbabenko_terraform_skill_terraform_s_623075c8/readme"
}