OCI Terraform Hub
Use this skill as the canonical router for Terraform and OpenTofu-style OCI infrastructure work. Keep high-drift provider, backend, region, and cost facts in references and verify official docs before giving current claims.
When to Use
Load this skill for: the user asks to "Terraform state on OCI", "native OCI backend", "debug terraform-provider-oci", "Terraform import OCI", "OCI Terraform auth", "OCI module quality", "government cloud Terraform", "Terraform apply 403", or "build OCI IaC".
Also load it when Terraform touches an OCI sibling domain, then load the sibling skill only for that domain detail:
| Terraform task | Also load |
|---|---|
| Resource Manager stack, job, source provider, or private endpoint | oci/oci-resource-manager |
| ZPR policy, security attributes, or protected resources | oci/zpr-security |
| Bastion, Managed SSH, port forwarding, or allowlists | oci/managed-bastion-access |
| VCN, subnet, route table, DRG, Service Gateway, NAT Gateway | oci/networking-management |
| IAM policy, identity domain, dynamic group, 403/404 | oci/iam-identity-management |
| Vault secret, wallet, password, private key, sensitive output | oci/secrets-management |
| Capacity, quota, shape, boot volume, instance principal | oci/compute-management |
| Estimate, budget, Resource Scheduler, egress, quota cost | oci/finops-cost-optimization |
Do NOT load this skill when
Do not load this skill for unrelated general programming, non-Oracle cloud work, or pure Oracle service operations without Terraform. Use oci for OCI skill-pack routing and oci/best-practices for broad OCI architecture triage.
NEVER Do This
NEVER default new Terraform state on OCI to S3-compatible Object Storage.
For Terraform v1.12 and later, prefer the native backend "oci" with Object Storage, state locking, and bucket versioning. Use S3-compatible Object Storage only as a legacy fallback when the target Terraform runtime cannot use the native OCI backend.
NEVER put credentials, generated passwords, wallets, or private keys in durable state by accident.
sensitive = true redacts CLI/UI output but does not remove values from state or plan files. Prefer passing secret OCIDs, letting workloads retrieve secrets at runtime, and using Terraform ephemeral or write-only features only when the Terraform version and OCI provider/resource support them.
NEVER treat Resource Manager as just "Terraform in the console."
Resource Manager owns stack state, job execution, variables, provider retrieval, source providers, private endpoints, and IAM behavior. Route those cases to oci/oci-resource-manager.
NEVER diagnose Terraform apply gets 403 before identifying the caller.
Decide whether the caller is a local API key user, session-token profile, CI principal, instance principal, resource principal, Resource Manager job/user, or OKE workload identity. Then check policy location, principal type, verb, resource family, and compartment scope.
NEVER trust an Oracle-branded Terraform module just because it is official. Check release recency, provider constraints, issue activity, examples, supported resources, sensitive outputs, generated plan shape, and upgrade path before recommending any module.
NEVER automate ZPR or Bastion as a shortcut around rollout safety. ZPR can block traffic when attributes are applied before policy, and Bastion Terraform can widen client allowlists or leak keys into state. Load the focused references before writing HCL.
NEVER hardcode tenancy-specific values unless the deployment contract requires it. Avoid hardcoded availability-domain names, compartment OCIDs, subnet IDs, region domains, and provider endpoints. Query or inject them as variables/data sources and document the owning tenancy boundary.
Decision Rules
State backend
- Terraform v1.12+ and normal team collaboration: use native
backend "oci". - Resource Manager stack: let Resource Manager manage state; do not force a local backend into the stack.
- Terraform older than v1.12 or constrained runtime: use S3-compatible Object Storage only as a documented legacy fallback.
- Local state: use only for disposable experiments; never for team or production state.
Auth
Choose auth by execution context, not habit:
| Context | Default direction |
|---|---|
| Local laptop | API key profile or short-lived security token profile |
| GitHub Actions / external CI | Approved federation/OIDC if configured; otherwise tightly scoped API key secret |
| OCI DevOps | Service/resource principal with dynamic group policies |
| Resource Manager | Region-only provider block; stack/user/job IAM handled by Resource Manager |
| Compute instance | auth = "InstancePrincipal" with matching dynamic group and policies |
| Function or supported OCI service | auth = "ResourcePrincipal" |
| OKE workload | auth = "OKEWorkloadIdentity" when supported |
Adoption and drift
Prefer provider pinning, terraform import, import blocks, moved blocks, lifecycle review, and official import IDs. Treat delete/recreate as a last resort after confirming data-loss, replacement, and downtime risk.
Realms and regions
Verify region identifier, realm domain, service availability, Resource Manager availability, FIPS requirements, and dedicated endpoint settings before writing Terraform for government, defense, dedicated, or sovereign environments.
Reference Loading
Load only the narrow reference needed for the task:
references/oci-terraform-state-backends.mdfor native OCI backend, S3 fallback, locking, state versioning, and backend credential safety.references/oci-terraform-auth-matrix.mdfor local, CI, OCI DevOps, Resource Manager, Compute, Cloud Shell, resource principal, and OKE auth choices.references/oci-terraform-secrets-state.mdfor state leakage, sensitive values, generated passwords, wallets, private keys, Vault, and outputs.references/oci-terraform-import-drift.mdfor imports, moved blocks, provider pinning, eventual consistency, and adoption of existing resources.references/oci-terraform-module-quality.mdfor official-module review and stale-module detection.references/oci-terraform-realms-regions.mdfor government cloud, realms, FIPS, dedicated endpoints, and region availability.references/oci-terraform-zpr.mdfor ZPR policy, security attributes, provider support, imports, and lockout-safe sequencing.references/oci-terraform-bastion.mdfor Bastion resources, sessions, allowlists, IAM, key-state safety, and no-public-SSH guardrails.references/oci-terraform-patterns.mdonly for the official source map and compact cross-reference list.
Arguments
$ARGUMENTS: Optional user-provided target, path, environment, symptom, Terraform version, execution context, or constraint. When empty, infer the narrowest safe scope from the current repository context and ask only if multiple high-impact choices remain.