Terraform & OpenTofu Agent Skill
Best-practice skill for AI agents to write, test, and deploy Terraform/OpenTofu infrastructure.
Evidence shows: README emphasizes OIDC and write_only parameters to avoid static keys, reflecting least privilege; but no user confirmation mechanism or data flow transparency is provided. Sensitive data handling is mentioned (e.g., Secrets Manager) but lacks implementation details. Dependency security references Trivy/Checkov but no lock files or mitigation evidence. External effects suggest remote backends and CI/CD but do not clarify impact scope. Rollback mentions state migration and recovery but no concrete rollback mechanism. Source attribution lists sources but no verifiable links or versions. Deductions: missing user confirmation, data flow transparency, and concrete security implementation details.
Evidence shows: README content is self-consistent, chapters align without contradiction. Dependency availability relies on external tools (e.g., terraform-ls, MCP server) but no version pinning or mirrors. Failure messages: no error handling or diagnostics provided. Deductions: dependencies not pinned, failure handling not described.
Evidence shows: README targets multiple AI agents and cloud providers, provides multi-scenario examples, strong adaptability. Capability boundaries mention optional dependencies (e.g., terraform-ls) and fallback, but no explicit limits. Trigger precision mentions keyword matching but no precise trigger rules. Environment fit provides multiple installation methods but no version compatibility details. Deductions: trigger rules unclear, capability boundaries incomplete.
Evidence shows: Information architecture is clear with table of contents and sections. Installation notes are detailed covering multiple hosts. Naming stability mentions naming conventions but no version stability guarantee. Examples and FAQ are rich but FAQ section missing. Known limitations not explicitly listed. License is Apache 2.0 but metadata is NOASSERTION. Versioning changelog exists (CHANGELOG.md) but no detailed content. Maintenance responsibility mentions contribution guide but no explicit maintainers. Deductions: missing known limitations and explicit maintenance responsibility.
Evidence shows: Output usability provides many examples and patterns directly usable. Marginal value provides best practices and decision frameworks, incremental value. Cost benefit: no performance or cost data. Deductions: missing cost-benefit analysis.
Evidence shows: Claims sources (e.g., terraform-best-practices.com) but no verifiable links or versions. Cross-source corroboration references multiple community resources but no cross-validation. Fact-inference separation not explicitly distinguished. Deductions: sources not verifiable, facts and inferences not separated.
- Publisher identity unverified, sources not traceable, handle with caution.
- Dependencies not pinned, potential supply chain risk.
- Lack of user confirmation mechanism, may auto-execute high-risk operations.
- Data flow not transparent, sensitive data handling details insufficient.
What does this agent do, and when should you use it?
This repository provides a skill for AI coding agents (Claude Code, Cursor, Copilot, Gemini CLI, OpenCode, Codex, Kiro, etc.) to follow best practices when working with Terraform and OpenTofu. It covers testing frameworks (native tests vs Terratest), module development conventions, state management with remote backends, CI/CD integration (GitHub Actions, GitLab CI), security scanning (Trivy, Checkov), and policy-as-code. It includes decision matrices, DO vs DON'T examples, and cheat sheets. The skill is cloud-agnostic, with first-class support for AWS, Azure, and GCP, and provides cross-cloud mappings. It is based on the author's experience with terraform-aws-modules and other community resources. Installation is available via npx or per-host instructions, and it integrates with various agent ecosystems. The skill is Apache 2.0 licensed.
Provides structured guidance to AI agents for Terraform/OpenTofu tasks: 1) Selects appropriate testing approach based on context (native tests or Terratest) and generates test code; 2) Suggests module naming conventions (e.g., terraform-<provider>-<name>), directory structure, and versioning; 3) Recommends remote state backends (S3, Azure Blob, GCS) with locking and encryption; 4) Generates CI/CD workflows (GitHub Actions, GitLab CI) with cost estimation and security scans; 5) Integrates security tools like Trivy and Checkov for compliance scanning; 6) Provides side-by-side examples of good and bad practices. It is implemented as a set of markdown files, primarily SKILL.md, which agents load on demand.
- A developer using Claude Code wants to create a Terraform module for an S3 bucket with tests, and the skill guides the agent to include best practices.
- A platform engineer needs to set up remote state for multiple teams, and the skill advises on backend choice, locking, and state isolation.
- A DevOps engineer wants to add cost estimation to their Terraform CI/CD pipeline, and the skill generates a GitHub Actions workflow with Infracost.
- A team migrating from Terraform to OpenTofu uses the skill to ensure compatibility and follow OpenTofu-specific guidance.
- A multi-cloud team standardizes IaC patterns across AWS, Azure, and GCP, using the skill's cross-cloud mappings.
- A code reviewer uses the skill to audit existing Terraform configurations for compliance with best practices.
What are this agent's strengths and limitations?
- Based on real-world best practices and community contributions, not just theory.
- Supports multiple cloud providers (AWS, Azure, GCP) with cross-cloud mappings, beneficial for multi-cloud teams.
- Provides concrete testing strategies and decision matrices to choose between native tests and Terratest.
- Includes numerous DO vs DON'T examples for easy understanding.
- Flexible installation across many AI agent platforms.
- Requires an Agent Skills-compatible host; some tools need extra setup (e.g., Codex plugin marketplace).
- Might not keep up with the latest Terraform features; users should verify current versions.
- Recommended companion code-intelligence skill is suggested for full functionality, adding an extra dependency.
- May be overkill for simple tasks; requires the agent to trigger appropriately.
- Some advanced features (like cross-cloud mapping) assume a certain level of multi-cloud knowledge.
How do you install or deploy this agent?
For Claude Code: use plugin marketplace: /plugin marketplace add antonbabenko/agent-plugins and /plugin install terraform-skill@antonbabenko. For other agents: run npx skills add https://github.com/antonbabenko/terraform-skill or clone the repo to the appropriate skills directory (e.g., ~/.cursor/skills/).
How do you use this agent?
After installation, ask your agent something like 'Create a Terraform module with tests for an S3 bucket'. The agent will automatically load the skill when working with Terraform/OpenTofu. Ensure you have Terraform 1.0+ or OpenTofu 1.6+ and have run terraform init in your workspace. You can also refer to the README's example prompts for more specific requests.
How does this agent compare with similar options?
Compared to Terratest, the skill provides guidance on when to use native tests vs Terratest, but it is not a test framework itself. Compared to Hashicorp's official documentation, it is tailored for AI agent interaction.
FAQ
Is the skill free?
Do I need Terraform pre-installed?
terraform init.