skilld
All skills
jeffallan avatar

/terraform-engineer

@d0e7f4e
by jeffallanjeffallan/claude-skills12k stars
1,124

Use when implementing infrastructure as code with Terraform across AWS, Azure, or GCP. Invoke for module development (create reusable modules, manage module versioning), state management (migrate backends, import existing resources, resolve state conflicts), provider configuration, multi-environment workflows, and infrastructure testing.

Ask your Agent

Use this Skill: https://skilld.dev/gh/jeffallan/claude-skills/terraform-engineer

This session only. Nothing lands on disk.

referencesstate-management.md

≈2k tokens on demand. Your agent reads this file only when SKILL.md points to it.

Terraform State Management

Remote Backend - S3 (AWS)

Backend Configuration

# backend.tf
terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "production/vpc/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    dynamodb_table = "terraform-state-lock"

    # Optional: Enable versioning for state file history
    versioning = true
  }
}

S3 Bucket Setup

# State bucket with versioning and encryption
resource "aws_s3_bucket" "terraform_state" {
  bucket = "my-terraform-state"

  lifecycle {
    prevent_destroy = true
  }

  tags = {
    Name        = "Terraform State"
    Environment = "global"
  }
}

resource "aws_s3_bucket_versioning" "terraform_state" {
  bucket = aws_s3_bucket.terraform_state.id

  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "terraform_state" {
  bucket = aws_s3_bucket.terraform_state.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

resource "aws_s3_bucket_public_access_block" "terraform_state" {
  bucket = aws_s3_bucket.terraform_state.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# DynamoDB table for state locking
resource "aws_dynamodb_table" "terraform_lock" {
  name           = "terraform-state-lock"
  billing_mode   = "PAY_PER_REQUEST"
  hash_key       = "LockID"

  attribute {
    name = "LockID"
    type = "S"
  }

  tags = {
    Name        = "Terraform State Lock"
    Environment = "global"
  }
}

Remote Backend - Azure Blob

terraform {
  backend "azurerm" {
    resource_group_name  = "terraform-state-rg"
    storage_account_name = "tfstatestorage"
    container_name       = "tfstate"
    key                  = "production.terraform.tfstate"

    # State locking is automatic with Azure Blob
    use_azuread_auth = true
  }
}

Azure Storage Setup

resource "azurerm_resource_group" "terraform_state" {
  name     = "terraform-state-rg"
  location = "East US"
}

resource "azurerm_storage_account" "terraform_state" {
  name                     = "tfstatestorage"
  resource_group_name      = azurerm_resource_group.terraform_state.name
  location                 = azurerm_resource_group.terraform_state.location
  account_tier             = "Standard"
  account_replication_type = "GRS"

  enable_https_traffic_only = true
  min_tls_version          = "TLS1_2"

  blob_properties {
    versioning_enabled = true
  }

  tags = {
    environment = "global"
    purpose     = "terraform-state"
  }
}

resource "azurerm_storage_container" "terraform_state" {
  name                  = "tfstate"
  storage_account_name  = azurerm_storage_account.terraform_state.name
  container_access_type = "private"
}

Remote Backend - GCS (GCP)

terraform {
  backend "gcs" {
    bucket = "my-terraform-state"
    prefix = "production/vpc"

    # State locking is automatic with GCS
  }
}

Workspaces

Using Workspaces

# List workspaces
terraform workspace list

# Create new workspace
terraform workspace new staging

# Switch workspace
terraform workspace select production

# Show current workspace
terraform workspace show

# Delete workspace
terraform workspace delete dev

Workspace-Aware Configuration

locals {
  environment = terraform.workspace

  # Environment-specific configuration
  vpc_cidr = {
    production = "10.0.0.0/16"
    staging    = "10.1.0.0/16"
    dev        = "10.2.0.0/16"
  }

  instance_count = {
    production = 5
    staging    = 2
    dev        = 1
  }
}

resource "aws_vpc" "main" {
  cidr_block = local.vpc_cidr[local.environment]

  tags = {
    Name        = "${local.environment}-vpc"
    Environment = local.environment
  }
}

resource "aws_instance" "app" {
  count = local.instance_count[local.environment]

  ami           = var.ami_id
  instance_type = "t3.micro"

  tags = {
    Name        = "${local.environment}-app-${count.index + 1}"
    Environment = local.environment
  }
}

Partial Backend Configuration

Backend template

# backend.tf
terraform {
  backend "s3" {
    # Configuration provided via backend config file or CLI
  }
}

Environment-specific backend configs

# config/backend-prod.hcl
bucket         = "terraform-state-prod"
key            = "vpc/terraform.tfstate"
region         = "us-east-1"
encrypt        = true
dynamodb_table = "terraform-lock-prod"
# Initialize with backend config
terraform init -backend-config=config/backend-prod.hcl

State Operations

Import Existing Resources

# Import AWS VPC
terraform import aws_vpc.main vpc-12345678

# Import with module
terraform import module.network.aws_vpc.main vpc-12345678

State Manipulation

# List resources in state
terraform state list

# Show resource details
terraform state show aws_vpc.main

# Move resource in state
terraform state mv aws_instance.old aws_instance.new

# Remove resource from state (doesn't destroy)
terraform state rm aws_instance.example

# Pull remote state to local file
terraform state pull > terraform.tfstate.backup

# Push local state to remote
terraform state push terraform.tfstate

State Migration

# Migrate from local to remote backend
terraform init -migrate-state

# Change backend configuration
terraform init -reconfigure

# Copy state to new backend
terraform init -backend-config=new-backend.hcl -migrate-state

State Locking

Manual Lock Management

# Force unlock if lock is stuck (use carefully!)
terraform force-unlock LOCK_ID

# Example: terraform force-unlock a1b2c3d4-e5f6-7890-abcd-ef1234567890

Prevent Concurrent Modifications

# State locking happens automatically with supported backends
# DynamoDB for S3, automatic for Azure Blob and GCS

# Disable locking for specific operations (not recommended)
terraform apply -lock=false  # DON'T DO THIS IN PRODUCTION

State File Security

Encryption at Rest

# S3 bucket encryption
resource "aws_s3_bucket_server_side_encryption_configuration" "state" {
  bucket = aws_s3_bucket.terraform_state.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.terraform.arn
    }
    bucket_key_enabled = true
  }
}

Access Control

# S3 bucket policy - restrict access
resource "aws_s3_bucket_policy" "terraform_state" {
  bucket = aws_s3_bucket.terraform_state.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "RequireEncryptedTransport"
        Effect = "Deny"
        Principal = "*"
        Action = "s3:*"
        Resource = [
          aws_s3_bucket.terraform_state.arn,
          "${aws_s3_bucket.terraform_state.arn}/*"
        ]
        Condition = {
          Bool = {
            "aws:SecureTransport" = "false"
          }
        }
      }
    ]
  })
}

State File Organization

# Recommended structure for multiple environments
terraform-state-bucket/
├── production/
│   ├── vpc/terraform.tfstate
│   ├── eks/terraform.tfstate
│   └── rds/terraform.tfstate
├── staging/
│   ├── vpc/terraform.tfstate
│   └── eks/terraform.tfstate
└── dev/
    └── vpc/terraform.tfstate

Best Practices

  • Always use remote state for teams
  • Enable state locking to prevent conflicts
  • Encrypt state files at rest and in transit
  • Enable versioning for state file history
  • Use separate state files per environment
  • Restrict access to state buckets
  • Back up state files regularly
  • Never commit state files to git
  • Use workspaces for similar environments only
  • Document state migration procedures

Source: SKILL.md on GitHub

Third-party checks

1 alert16d5 checks · Risk CRITICAL
  • Gen Agent Trust Hub16d

    This skill is flagged as highly risky due to multiple confirmed detections by automated security scanners. The main skill definition file is classified as malware by file reputation services, and an included documentation link is blacklisted as malicious. Additionally, the skill's workflow involving the execution of Terraform commands on user-supplied code introduces an indirect prompt injection surface.

  • Socket16d

    No alerts

  • Snyk16d

    Risk: LOW · No issues

  • Runlayer6mo

    4/6 files flagged

  • ZeroLeaks5mo

    Score: 93/100 · 2 sections analyzed

Provenance

Signed by skilld at d0e7f4e. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub 2 months ago.

Steadyupdated 2 months ago

Capability

Other metadata
metadata
{
  "author": "https://github.com/Jeffallan",
  "version": "1.1.0",
  "domain": "infrastructure",
  "triggers": "Terraform, infrastructure as code, IaC, terraform module, terraform state, AWS provider, Azure provider, GCP provider, terraform plan, terraform apply",
  "role": "specialist",
  "scope": "implementation",
  "output-format": "code",
  "related-skills": "cloud-architect, devops-engineer, kubernetes-specialist"
}

Topics

  • Infrastructure
  • terraform
  • aws
  • azure
  • gcp
  • iac
  • modules
  • state-management
  • providers

README badge

README badge for jeffallan/claude-skills/terraform-engineer

What it does

Writes Terraform modules and state configurations for AWS, Azure, and GCP infrastructure. Handles module design, remote backend setup with locking, provider version pinning, and validation workflows using terraform fmt, terraform validate, and tflint.

Generated from the current SKILL.md.

Frequently asked

Does this skill support AWS, Azure, and GCP?
Yes. The skill covers provider configuration and patterns for all three cloud platforms, with examples for AWS S3 and references to provider-specific guidance.
What does this skill do if terraform plan fails?
The skill includes error recovery steps for state drift, provider auth errors, and dependency issues. It guides you through terraform refresh, terraform import, credential verification, and explicit depends_on fixes before re-planning.
Does this skill handle state management?
Yes. It covers remote backend setup with locking and encryption (S3 + DynamoDB example included), workspace management, state migrations, and resource import workflows.
Will this skill create modules for me?
Yes. The skill designs and implements reusable modules with input validation, clear outputs, semantic versioning, and documentation. It enforces module interface patterns and prevents circular dependencies.
Does this skill test Terraform code?
The skill runs terraform fmt and terraform validate before every plan, plus tflint for linting. It references detailed testing and policy-as-code guidance in bundled documentation.

Generated from the current SKILL.md. These answers refresh after source changes.