[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6QQT7KDTYRYKKY3KDYHYZFX":3,"skill-same:01M6QQT7KDTYRYKKY3KDYHYZFX":83},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":29,"publishedAt":50,"linkOnly":51,"markdownContent":52,"markdownBody":53,"frontMatter":54,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":14,"repositoryHtmlUrl":63,"repositoryHomepageUrl":64,"ownerHtmlUrl":65,"ownerBlogUrl":66,"ownerDescription":67,"updatedAt":68,"install":69,"resources":82},"01M6QQT7KDTYRYKKY3KDYHYZFX","terraform-patterns",null,"Terraform infrastructure-as-code agent skill and plugin for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw. Covers module design patterns, state management strategies, provider configuration, security hardening, policy-as-code with Sentinel\u002FOPA, and CI\u002FCD plan\u002Fapply workflows. Use when: user wants to design Terraform modules, manage state backends, review Terraform security, implement multi-region deployments, or follow IaC best practices.","Tashima-Tarsh\u002FDisha6.6","Tashima-Tarsh","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F269906498?v=4","01M6PBH98X03XERH0HFT4PFB1P","NITISH KUMAR","01M6PBH9DA0M6KM3Z12P848F0K",0,"MIT","https:\u002F\u002Fgithub.com\u002FTashima-Tarsh\u002FDisha6.6\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fterraform-patterns\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49],"patterns","terraform","terraform patterns","policy-as-code","infrastructure-as","as","terraform infrastructure","agent skill","strategies","modules","plan","design","infrastructure-as-code","ci","infrastructure","workflows","security","gemini cli","gemini","openclaw","2026-11-10 10:12:30",false,"---\nname: \"terraform-patterns\"\ndescription: \"Terraform infrastructure-as-code agent skill and plugin for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw. Covers module design patterns, state management strategies, provider configuration, security hardening, policy-as-code with Sentinel\u002FOPA, and CI\u002FCD plan\u002Fapply workflows. Use when: user wants to design Terraform modules, manage state backends, review Terraform security, implement multi-region deployments, or follow IaC best practices.\"\nlicense: MIT\nmetadata:\n  version: 1.0.0\n  author: Alireza Rezvani\n  category: engineering\n  updated: 2026-03-15\n---\n\n# Terraform Patterns\n\n> Predictable infrastructure. Secure state. Modules that compose. No drift.\n\nOpinionated Terraform workflow that turns sprawling HCL into well-structured, secure, production-grade infrastructure code. Covers module design, state management, provider patterns, security hardening, and CI\u002FCD integration.\n\nNot a Terraform tutorial — a set of concrete decisions about how to write infrastructure code that doesn't break at 3 AM.\n\n---\n\n## Slash Commands\n\n| Command | What it does |\n|---------|-------------|\n| `\u002Fterraform:review` | Analyze Terraform code for anti-patterns, security issues, and structure problems |\n| `\u002Fterraform:module` | Design or refactor a Terraform module with proper inputs, outputs, and composition |\n| `\u002Fterraform:security` | Audit Terraform code for security vulnerabilities, secrets exposure, and IAM misconfigurations |\n\n---\n\n## When This Skill Activates\n\nRecognize these patterns from the user:\n\n- \"Review this Terraform code\"\n- \"Design a Terraform module for...\"\n- \"My Terraform state is...\"\n- \"Set up remote state backend\"\n- \"Multi-region Terraform deployment\"\n- \"Terraform security review\"\n- \"Module structure best practices\"\n- \"Terraform CI\u002FCD pipeline\"\n- Any request involving: `.tf` files, HCL, Terraform modules, state management, provider configuration, infrastructure-as-code\n\nIf the user has `.tf` files or wants to provision infrastructure with Terraform → this skill applies.\n\n---\n\n## Workflow\n\n### `\u002Fterraform:review` — Terraform Code Review\n\n1. **Analyze current state**\n   - Read all `.tf` files in the target directory\n   - Identify module structure (flat vs nested)\n   - Count resources, data sources, variables, outputs\n   - Check naming conventions\n\n2. **Apply review checklist**\n\n   ```\n   MODULE STRUCTURE\n   ├── Variables have descriptions and type constraints\n   ├── Outputs expose only what consumers need\n   ├── Resources use consistent naming: {provider}_{type}_{purpose}\n   ├── Locals used for computed values and DRY expressions\n   └── No hardcoded values — everything parameterized or in locals\n\n   STATE & BACKEND\n   ├── Remote backend configured (S3, GCS, Azure Blob, Terraform Cloud)\n   ├── State locking enabled (DynamoDB for S3, native for others)\n   ├── State encryption at rest enabled\n   ├── No secrets stored in state (or state access is restricted)\n   └── Workspaces or directory isolation for environments\n\n   PROVIDERS\n   ├── Version constraints use pessimistic operator: ~> 5.0\n   ├── Required providers block in terraform {} block\n   ├── Provider aliases for multi-region or multi-account\n   └── No provider configuration in child modules\n\n   SECURITY\n   ├── No hardcoded secrets, keys, or passwords\n   ├── IAM follows least-privilege principle\n   ├── Encryption enabled for storage, databases, secrets\n   ├── Security groups are not overly permissive (no 0.0.0.0\u002F0 ingress on sensitive ports)\n   └── Sensitive variables marked with sensitive = true\n   ```\n\n3. **Generate report**\n   ```bash\n   python3 scripts\u002Ftf_module_analyzer.py .\u002Fterraform\n   ```\n\n4. **Run security scan**\n   ```bash\n   python3 scripts\u002Ftf_security_scanner.py .\u002Fterraform\n   ```\n\n### `\u002Fterraform:module` — Module Design\n\n1. **Identify module scope**\n   - Single responsibility: one module = one logical grouping\n   - Determine inputs (variables), outputs, and resource boundaries\n   - Decide: flat module (single directory) vs nested (calling child modules)\n\n2. **Apply module design checklist**\n\n   ```\n   STRUCTURE\n   ├── main.tf        — Primary resources\n   ├── variables.tf   — All input variables with descriptions and types\n   ├── outputs.tf     — All outputs with descriptions\n   ├── versions.tf    — terraform {} block with required_providers\n   ├── locals.tf      — Computed values and naming conventions\n   ├── data.tf        — Data sources (if any)\n   └── README.md      — Usage examples and variable documentation\n\n   VARIABLES\n   ├── Every variable has: description, type, validation (where applicable)\n   ├── Sensitive values marked: sensitive = true\n   ├── Defaults provided for optional settings\n   ├── Use object types for related settings: variable \"config\" { type = object({...}) }\n   └── Validate with: validation { condition = ... }\n\n   OUTPUTS\n   ├── Output IDs, ARNs, endpoints — things consumers need\n   ├── Include description on every output\n   ├── Mark sensitive outputs: sensitive = true\n   └── Don't output entire resources — only specific attributes\n\n   COMPOSITION\n   ├── Root module calls child modules\n   ├── Child modules never call other child modules\n   ├── Pass values explicitly — no hidden data source lookups in child modules\n   ├── Provider configuration only in root module\n   └── Use module \"name\" { source = \".\u002Fmodules\u002Fname\" }\n   ```\n\n3. **Generate module scaffold**\n   - Output file structure with boilerplate\n   - Include variable validation blocks\n   - Add lifecycle rules where appropriate\n\n### `\u002Fterraform:security` — Security Audit\n\n1. **Code-level audit**\n\n   | Check | Severity | Fix |\n   |-------|----------|-----|\n   | Hardcoded secrets in `.tf` files | Critical | Use variables with sensitive = true or vault |\n   | IAM policy with `*` actions | Critical | Scope to specific actions and resources |\n   | Security group with 0.0.0.0\u002F0 on port 22\u002F3389 | Critical | Restrict to known CIDR blocks or use SSM\u002Fbastion |\n   | S3 bucket without encryption | High | Add `server_side_encryption_configuration` block |\n   | S3 bucket with public access | High | Add `aws_s3_bucket_public_access_block` |\n   | RDS without encryption | High | Set `storage_encrypted = true` |\n   | RDS publicly accessible | High | Set `publicly_accessible = false` |\n   | CloudTrail not enabled | Medium | Add `aws_cloudtrail` resource |\n   | Missing `prevent_destroy` on stateful resources | Medium | Add `lifecycle { prevent_destroy = true }` |\n   | Variables without `sensitive = true` for secrets | Medium | Add `sensitive = true` to secret variables |\n\n2. **State security audit**\n\n   | Check | Severity | Fix |\n   |-------|----------|-----|\n   | Local state file | Critical | Migrate to remote backend with encryption |\n   | Remote state without encryption | High | Enable encryption on backend (SSE-S3, KMS) |\n   | No state locking | High | Enable DynamoDB for S3, native for TF Cloud |\n   | State accessible to all team members | Medium | Restrict via IAM policies or TF Cloud teams |\n\n3. **Generate security report**\n   ```bash\n   python3 scripts\u002Ftf_security_scanner.py .\u002Fterraform\n   python3 scripts\u002Ftf_security_scanner.py .\u002Fterraform --output json\n   ```\n\n---\n\n## Tooling\n\n### `scripts\u002Ftf_module_analyzer.py`\n\nCLI utility for analyzing Terraform directory structure and module quality.\n\n**Features:**\n- Resource and data source counting\n- Variable and output analysis (missing descriptions, types, validation)\n- Naming convention checks\n- Module composition detection\n- File structure validation\n- JSON and text output\n\n**Usage:**\n```bash\n# Analyze a Terraform directory\npython3 scripts\u002Ftf_module_analyzer.py .\u002Fterraform\n\n# JSON output\npython3 scripts\u002Ftf_module_analyzer.py .\u002Fterraform --output json\n\n# Analyze a specific module\npython3 scripts\u002Ftf_module_analyzer.py .\u002Fmodules\u002Fvpc\n```\n\n### `scripts\u002Ftf_security_scanner.py`\n\nCLI utility for scanning `.tf` files for common security issues.\n\n**Features:**\n- Hardcoded secret detection (AWS keys, passwords, tokens)\n- Overly permissive IAM policy detection\n- Open security group detection (0.0.0.0\u002F0 on sensitive ports)\n- Missing encryption checks (S3, RDS, EBS)\n- Public access detection (S3, RDS, EC2)\n- Sensitive variable audit\n- JSON and text output\n\n**Usage:**\n```bash\n# Scan a Terraform directory\npython3 scripts\u002Ftf_security_scanner.py .\u002Fterraform\n\n# JSON output\npython3 scripts\u002Ftf_security_scanner.py .\u002Fterraform --output json\n\n# Strict mode (elevate warnings)\npython3 scripts\u002Ftf_security_scanner.py .\u002Fterraform --strict\n```\n\n---\n\n## Module Design Patterns\n\n### Pattern 1: Flat Module (Small\u002FMedium Projects)\n\n```\ninfrastructure\u002F\n├── main.tf          # All resources\n├── variables.tf     # All inputs\n├── outputs.tf       # All outputs\n├── versions.tf      # Provider requirements\n├── terraform.tfvars # Environment values (not committed)\n└── backend.tf       # Remote state configuration\n```\n\nBest for: Single application, \u003C 20 resources, one team owns everything.\n\n### Pattern 2: Nested Modules (Medium\u002FLarge Projects)\n\n```\ninfrastructure\u002F\n├── environments\u002F\n│   ├── dev\u002F\n│   │   ├── main.tf          # Calls modules with dev params\n│   │   ├── backend.tf       # Dev state backend\n│   │   └── terraform.tfvars\n│   ├── staging\u002F\n│   │   └── ...\n│   └── prod\u002F\n│       └── ...\n├── modules\u002F\n│   ├── networking\u002F\n│   │   ├── main.tf\n│   │   ├── variables.tf\n│   │   └── outputs.tf\n│   ├── compute\u002F\n│   │   └── ...\n│   └── database\u002F\n│       └── ...\n└── versions.tf\n```\n\nBest for: Multiple environments, shared infrastructure patterns, team collaboration.\n\n### Pattern 3: Mono-Repo with Terragrunt\n\n```\ninfrastructure\u002F\n├── terragrunt.hcl           # Root config\n├── modules\u002F                  # Reusable modules\n│   ├── vpc\u002F\n│   ├── eks\u002F\n│   └── rds\u002F\n├── dev\u002F\n│   ├── terragrunt.hcl       # Dev overrides\n│   ├── vpc\u002F\n│   │   └── terragrunt.hcl   # Module invocation\n│   └── eks\u002F\n│       └── terragrunt.hcl\n└── prod\u002F\n    ├── terragrunt.hcl\n    └── ...\n```\n\nBest for: Large-scale, many environments, DRY configuration, team-level isolation.\n\n---\n\n## Provider Configuration Patterns\n\n### Version Pinning\n```hcl\nterraform {\n  required_version = \">= 1.5.0\"\n\n  required_providers {\n    aws = {\n      source  = \"hashicorp\u002Faws\"\n      version = \"~> 5.0\"    # Allow 5.x, block 6.0\n    }\n    random = {\n      source  = \"hashicorp\u002Frandom\"\n      version = \"~> 3.5\"\n    }\n  }\n}\n```\n\n### Multi-Region with Aliases\n```hcl\nprovider \"aws\" {\n  region = \"us-east-1\"\n}\n\nprovider \"aws\" {\n  alias  = \"west\"\n  region = \"us-west-2\"\n}\n\nresource \"aws_s3_bucket\" \"primary\" {\n  bucket = \"my-app-primary\"\n}\n\nresource \"aws_s3_bucket\" \"replica\" {\n  provider = aws.west\n  bucket   = \"my-app-replica\"\n}\n```\n\n### Multi-Account with Assume Role\n```hcl\nprovider \"aws\" {\n  alias  = \"production\"\n  region = \"us-east-1\"\n\n  assume_role {\n    role_arn = \"arn:aws:iam::PROD_ACCOUNT_ID:role\u002FTerraformRole\"\n  }\n}\n```\n\n---\n\n## State Management Decision Tree\n\n```\nSingle developer, small project?\n├── Yes → Local state (but migrate to remote ASAP)\n└── No\n    ├── Using Terraform Cloud\u002FEnterprise?\n    │   └── Yes → TF Cloud native backend (built-in locking, encryption, RBAC)\n    └── No\n        ├── AWS?\n        │   └── S3 + DynamoDB (encryption, locking, versioning)\n        ├── GCP?\n        │   └── GCS bucket (native locking, encryption)\n        ├── Azure?\n        │   └── Azure Blob Storage (native locking, encryption)\n        └── Other?\n            └── Consul or PostgreSQL backend\n\nEnvironment isolation strategy:\n├── Separate state files per environment (recommended)\n│   ├── Option A: Separate directories (dev\u002F, staging\u002F, prod\u002F)\n│   └── Option B: Terraform workspaces (simpler but less isolation)\n└── Single state file for all environments (never do this)\n```\n\n---\n\n## CI\u002FCD Integration Patterns\n\n### GitHub Actions Plan\u002FApply\n\n```yaml\n# .github\u002Fworkflows\u002Fterraform.yml\nname: Terraform\non:\n  pull_request:\n    paths: ['terraform\u002F**']\n  push:\n    branches: [main]\n    paths: ['terraform\u002F**']\n\njobs:\n  plan:\n    runs-on: ubuntu-latest\n    if: github.event_name == 'pull_request'\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: hashicorp\u002Fsetup-terraform@v3\n      - run: terraform init\n      - run: terraform validate\n      - run: terraform plan -out=tfplan\n      - run: terraform show -json tfplan > plan.json\n      # Post plan as PR comment\n\n  apply:\n    runs-on: ubuntu-latest\n    if: github.ref == 'refs\u002Fheads\u002Fmain' && github.event_name == 'push'\n    environment: production\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: hashicorp\u002Fsetup-terraform@v3\n      - run: terraform init\n      - run: terraform apply -auto-approve\n```\n\n### Drift Detection\n\n```yaml\n# Run on schedule to detect drift\nname: Drift Detection\non:\n  schedule:\n    - cron: '0 6 * * 1-5'  # Weekdays at 6 AM\n\njobs:\n  detect:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: hashicorp\u002Fsetup-terraform@v3\n      - run: terraform init\n      - run: |\n          terraform plan -detailed-exitcode -out=drift.tfplan 2>&1 | tee drift.log\n          EXIT_CODE=$?\n          if [ $EXIT_CODE -eq 2 ]; then\n            echo \"DRIFT DETECTED — review drift.log\"\n            # Send alert (Slack, PagerDuty, etc.)\n          fi\n```\n\n---\n\n## Proactive Triggers\n\nFlag these without being asked:\n\n- **No remote backend configured** → Migrate to S3\u002FGCS\u002FAzure Blob with locking and encryption.\n- **Provider without version constraint** → Add `version = \"~> X.0\"` to prevent breaking upgrades.\n- **Hardcoded secrets in .tf files** → Use variables with `sensitive = true`, or integrate Vault\u002FSSM.\n- **IAM policy with `\"Action\": \"*\"`** → Scope to specific actions. No wildcard actions in production.\n- **Security group open to 0.0.0.0\u002F0 on SSH\u002FRDP** → Restrict to bastion CIDR or use SSM Session Manager.\n- **No state locking** → Enable DynamoDB table for S3 backend, or use TF Cloud.\n- **Resources without tags** → Add default_tags in provider block. Tags are mandatory for cost tracking.\n- **Missing `prevent_destroy` on databases\u002Fstorage** → Add lifecycle block to prevent accidental deletion.\n\n---\n\n## Multi-Cloud Provider Configuration\n\nWhen a single root module must provision across AWS, Azure, and GCP simultaneously.\n\n### Provider Aliasing Pattern\n\n```hcl\nterraform {\n  required_providers {\n    aws = {\n      source  = \"hashicorp\u002Faws\"\n      version = \"~> 5.0\"\n    }\n    azurerm = {\n      source  = \"hashicorp\u002Fazurerm\"\n      version = \"~> 3.0\"\n    }\n    google = {\n      source  = \"hashicorp\u002Fgoogle\"\n      version = \"~> 5.0\"\n    }\n  }\n}\n\nprovider \"aws\" {\n  region = var.aws_region\n}\n\nprovider \"azurerm\" {\n  features {}\n  subscription_id = var.azure_subscription_id\n}\n\nprovider \"google\" {\n  project = var.gcp_project_id\n  region  = var.gcp_region\n}\n```\n\n### Shared Variables Across Providers\n\n```hcl\nvariable \"environment\" {\n  description = \"Environment name used across all providers\"\n  type        = string\n  validation {\n    condition     = contains([\"dev\", \"staging\", \"prod\"], var.environment)\n    error_message = \"Must be dev, staging, or prod.\"\n  }\n}\n\nlocals {\n  common_tags = {\n    environment = var.environment\n    managed_by  = \"terraform\"\n    project     = var.project_name\n  }\n}\n```\n\n### When to Use Multi-Cloud\n\n- **Yes**: Regulatory requirements mandate data residency across providers, or the org has existing workloads on multiple clouds.\n- **No**: \"Avoiding vendor lock-in\" alone is not sufficient justification. Multi-cloud doubles operational complexity. Prefer single-cloud unless there is a concrete business requirement.\n\n---\n\n## OpenTofu Compatibility\n\nOpenTofu is an open-source fork of Terraform maintained by the Linux Foundation under the MPL 2.0 license.\n\n### Migration from Terraform to OpenTofu\n\n```bash\n# 1. Install OpenTofu\nbrew install opentofu        # macOS\nsnap install --classic tofu  # Linux\n\n# 2. Replace the binary — state files are compatible\ntofu init                    # Re-initializes with OpenTofu\ntofu plan                    # Identical plan output\ntofu apply                   # Same apply workflow\n```\n\n### License Considerations\n\n| | Terraform (1.6+) | OpenTofu |\n|---|---|---|\n| **License** | BSL 1.1 (source-available) | MPL 2.0 (open-source) |\n| **Commercial use** | Restricted for competing products | Unrestricted |\n| **Community governance** | HashiCorp | Linux Foundation |\n\n### Feature Parity\n\nOpenTofu tracks Terraform 1.6.x features. Key additions unique to OpenTofu:\n- Client-side state encryption (`tofu init -encryption`)\n- Early variable\u002Flocals evaluation\n- Provider-defined functions\n\n### When to Choose OpenTofu\n\n- You need a fully open-source license for your supply chain.\n- You want client-side state encryption without Terraform Cloud.\n- Otherwise, either tool works — the HCL syntax and provider ecosystem are identical.\n\n---\n\n## Infracost Integration\n\nInfracost estimates cloud costs from Terraform code before resources are provisioned.\n\n### PR Workflow\n\n```bash\n# Show cost breakdown for current code\ninfracost breakdown --path .\n\n# Compare cost difference between current branch and main\ninfracost diff --path . --compare-to infracost-base.json\n```\n\n### GitHub Actions Cost Comment\n\n```yaml\n# .github\u002Fworkflows\u002Finfracost.yml\nname: Infracost\non: [pull_request]\n\njobs:\n  cost:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: infracost\u002Factions\u002Fsetup@v3\n        with:\n          api-key: ${{ secrets.INFRACOST_API_KEY }}\n      - run: infracost breakdown --path .\u002Fterraform --format json --out-file \u002Ftmp\u002Finfracost.json\n      - run: infracost comment github --path \u002Ftmp\u002Finfracost.json --repo $GITHUB_REPOSITORY --pull-request ${{ github.event.pull_request.number }} --github-token ${{ secrets.GITHUB_TOKEN }} --behavior update\n```\n\n### Budget Thresholds and Cost Policy\n\n```yaml\n# infracost.yml — policy file\nversion: 2.9.0\npolicies:\n  - path: \"*\"\n    max_monthly_cost: \"5000\"    # Fail PR if estimated cost exceeds $5,000\u002Fmonth\n    max_cost_increase: \"500\"    # Fail PR if cost increase exceeds $500\u002Fmonth\n```\n\n---\n\n## Import Existing Infrastructure\n\nBring manually-created resources under Terraform management.\n\n### terraform import Workflow\n\n```bash\n# 1. Write the resource block first (empty body is fine)\n# main.tf:\n# resource \"aws_s3_bucket\" \"legacy\" {}\n\n# 2. Import the resource into state\nterraform import aws_s3_bucket.legacy my-existing-bucket-name\n\n# 3. Run plan to see attribute diff\nterraform plan\n\n# 4. Fill in the resource block until plan shows no changes\n```\n\n### Bulk Import with Config Generation (Terraform 1.5+)\n\n```bash\n# Generate HCL for imported resources\nterraform plan -generate-config-out=generated.tf\n\n# Review generated.tf, then move resources into proper files\n```\n\n### Common Pitfalls\n\n- **Resource drift after import**: The imported resource may have attributes Terraform does not manage. Run `terraform plan` immediately and resolve every diff.\n- **State manipulation**: Use `terraform state mv` to rename or reorganize. Use `terraform state rm` to remove without destroying. Always back up state before manipulation: `terraform state pull > backup.tfstate`.\n- **Sensitive defaults**: Imported resources may expose secrets in state. Restrict state access and enable encryption.\n\n---\n\n## Terragrunt Patterns\n\nTerragrunt is a thin wrapper around Terraform that provides DRY configuration for multi-environment setups.\n\n### Root terragrunt.hcl (Shared Config)\n\n```hcl\n# terragrunt.hcl (root)\nremote_state {\n  backend = \"s3\"\n  generate = {\n    path      = \"backend.tf\"\n    if_exists = \"overwrite_terragrunt\"\n  }\n  config = {\n    bucket         = \"my-org-terraform-state\"\n    key            = \"${path_relative_to_include()}\u002Fterraform.tfstate\"\n    region         = \"us-east-1\"\n    encrypt        = true\n    dynamodb_table = \"terraform-locks\"\n  }\n}\n```\n\n### Child terragrunt.hcl (Environment Override)\n\n```hcl\n# prod\u002Fvpc\u002Fterragrunt.hcl\ninclude \"root\" {\n  path = find_in_parent_folders()\n}\n\nterraform {\n  source = \"..\u002F..\u002Fmodules\u002Fvpc\"\n}\n\ninputs = {\n  environment = \"prod\"\n  cidr_block  = \"10.0.0.0\u002F16\"\n}\n```\n\n### Dependencies Between Modules\n\n```hcl\n# prod\u002Feks\u002Fterragrunt.hcl\ndependency \"vpc\" {\n  config_path = \"..\u002Fvpc\"\n}\n\ninputs = {\n  vpc_id     = dependency.vpc.outputs.vpc_id\n  subnet_ids = dependency.vpc.outputs.private_subnet_ids\n}\n```\n\n### When Terragrunt Adds Value\n\n- **Yes**: 3+ environments with identical module structure, shared backend config, or cross-module dependencies.\n- **No**: Single environment, small team, or simple directory-based isolation already works. Terragrunt adds a learning curve and another binary to manage.\n\n---\n\n## Installation\n\n### One-liner (any tool)\n```bash\ngit clone https:\u002F\u002Fgithub.com\u002Falirezarezvani\u002Fclaude-skills.git\ncp -r claude-skills\u002Fengineering\u002Fterraform-patterns ~\u002F.claude\u002Fskills\u002F\n```\n\n### Multi-tool install\n```bash\n.\u002Fscripts\u002Fconvert.sh --skill terraform-patterns --tool codex|gemini|cursor|windsurf|openclaw\n```\n\n### OpenClaw\n```bash\nclawhub install terraform-patterns\n```\n\n---\n\n## Related Skills\n\n- **senior-devops** — Broader DevOps scope (CI\u002FCD, monitoring, containerization). Complementary — use terraform-patterns for IaC-specific work, senior-devops for pipeline and infrastructure operations.\n- **aws-solution-architect** — AWS architecture design. Complementary — terraform-patterns implements the infrastructure, aws-solution-architect designs it.\n- **senior-security** — Application security. Complementary — terraform-patterns covers infrastructure security posture, senior-security covers application-level threats.\n- **ci-cd-pipeline-builder** — Pipeline construction. Complementary — terraform-patterns defines infrastructure, ci-cd-pipeline-builder automates deployment.\n","# Terraform Patterns\n\n> Predictable infrastructure. Secure state. Modules that compose. No drift.\n\nOpinionated Terraform workflow that turns sprawling HCL into well-structured, secure, production-grade infrastructure code. Covers module design, state management, provider patterns, security hardening, and CI\u002FCD integration.\n\nNot a Terraform tutorial — a set of concrete decisions about how to write infrastructure code that doesn't break at 3 AM.\n\n---\n\n## Slash Commands\n\n| Command | What it does |\n|---------|-------------|\n| `\u002Fterraform:review` | Analyze Terraform code for anti-patterns, security issues, and structure problems |\n| `\u002Fterraform:module` | Design or refactor a Terraform module with proper inputs, outputs, and composition |\n| `\u002Fterraform:security` | Audit Terraform code for security vulnerabilities, secrets exposure, and IAM misconfigurations |\n\n---\n\n## When This Skill Activates\n\nRecognize these patterns from the user:\n\n- \"Review this Terraform code\"\n- \"Design a Terraform module for...\"\n- \"My Terraform state is...\"\n- \"Set up remote state backend\"\n- \"Multi-region Terraform deployment\"\n- \"Terraform security review\"\n- \"Module structure best practices\"\n- \"Terraform CI\u002FCD pipeline\"\n- Any request involving: `.tf` files, HCL, Terraform modules, state management, provider configuration, infrastructure-as-code\n\nIf the user has `.tf` files or wants to provision infrastructure with Terraform → this skill applies.\n\n---\n\n## Workflow\n\n### `\u002Fterraform:review` — Terraform Code Review\n\n1. **Analyze current state**\n   - Read all `.tf` files in the target directory\n   - Identify module structure (flat vs nested)\n   - Count resources, data sources, variables, outputs\n   - Check naming conventions\n\n2. **Apply review checklist**\n\n   ```\n   MODULE STRUCTURE\n   ├── Variables have descriptions and type constraints\n   ├── Outputs expose only what consumers need\n   ├── Resources use consistent naming: {provider}_{type}_{purpose}\n   ├── Locals used for computed values and DRY expressions\n   └── No hardcoded values — everything parameterized or in locals\n\n   STATE & BACKEND\n   ├── Remote backend configured (S3, GCS, Azure Blob, Terraform Cloud)\n   ├── State locking enabled (DynamoDB for S3, native for others)\n   ├── State encryption at rest enabled\n   ├── No secrets stored in state (or state access is restricted)\n   └── Workspaces or directory isolation for environments\n\n   PROVIDERS\n   ├── Version constraints use pessimistic operator: ~> 5.0\n   ├── Required providers block in terraform {} block\n   ├── Provider aliases for multi-region or multi-account\n   └── No provider configuration in child modules\n\n   SECURITY\n   ├── No hardcoded secrets, keys, or passwords\n   ├── IAM follows least-privilege principle\n   ├── Encryption enabled for storage, databases, secrets\n   ├── Security groups are not overly permissive (no 0.0.0.0\u002F0 ingress on sensitive ports)\n   └── Sensitive variables marked with sensitive = true\n   ```\n\n3. **Generate report**\n   ```bash\n   python3 scripts\u002Ftf_module_analyzer.py .\u002Fterraform\n   ```\n\n4. **Run security scan**\n   ```bash\n   python3 scripts\u002Ftf_security_scanner.py .\u002Fterraform\n   ```\n\n### `\u002Fterraform:module` — Module Design\n\n1. **Identify module scope**\n   - Single responsibility: one module = one logical grouping\n   - Determine inputs (variables), outputs, and resource boundaries\n   - Decide: flat module (single directory) vs nested (calling child modules)\n\n2. **Apply module design checklist**\n\n   ```\n   STRUCTURE\n   ├── main.tf        — Primary resources\n   ├── variables.tf   — All input variables with descriptions and types\n   ├── outputs.tf     — All outputs with descriptions\n   ├── versions.tf    — terraform {} block with required_providers\n   ├── locals.tf      — Computed values and naming conventions\n   ├── data.tf        — Data sources (if any)\n   └── README.md      — Usage examples and variable documentation\n\n   VARIABLES\n   ├── Every variable has: description, type, validation (where applicable)\n   ├── Sensitive values marked: sensitive = true\n   ├── Defaults provided for optional settings\n   ├── Use object types for related settings: variable \"config\" { type = object({...}) }\n   └── Validate with: validation { condition = ... }\n\n   OUTPUTS\n   ├── Output IDs, ARNs, endpoints — things consumers need\n   ├── Include description on every output\n   ├── Mark sensitive outputs: sensitive = true\n   └── Don't output entire resources — only specific attributes\n\n   COMPOSITION\n   ├── Root module calls child modules\n   ├── Child modules never call other child modules\n   ├── Pass values explicitly — no hidden data source lookups in child modules\n   ├── Provider configuration only in root module\n   └── Use module \"name\" { source = \".\u002Fmodules\u002Fname\" }\n   ```\n\n3. **Generate module scaffold**\n   - Output file structure with boilerplate\n   - Include variable validation blocks\n   - Add lifecycle rules where appropriate\n\n### `\u002Fterraform:security` — Security Audit\n\n1. **Code-level audit**\n\n   | Check | Severity | Fix |\n   |-------|----------|-----|\n   | Hardcoded secrets in `.tf` files | Critical | Use variables with sensitive = true or vault |\n   | IAM policy with `*` actions | Critical | Scope to specific actions and resources |\n   | Security group with 0.0.0.0\u002F0 on port 22\u002F3389 | Critical | Restrict to known CIDR blocks or use SSM\u002Fbastion |\n   | S3 bucket without encryption | High | Add `server_side_encryption_configuration` block |\n   | S3 bucket with public access | High | Add `aws_s3_bucket_public_access_block` |\n   | RDS without encryption | High | Set `storage_encrypted = true` |\n   | RDS publicly accessible | High | Set `publicly_accessible = false` |\n   | CloudTrail not enabled | Medium | Add `aws_cloudtrail` resource |\n   | Missing `prevent_destroy` on stateful resources | Medium | Add `lifecycle { prevent_destroy = true }` |\n   | Variables without `sensitive = true` for secrets | Medium | Add `sensitive = true` to secret variables |\n\n2. **State security audit**\n\n   | Check | Severity | Fix |\n   |-------|----------|-----|\n   | Local state file | Critical | Migrate to remote backend with encryption |\n   | Remote state without encryption | High | Enable encryption on backend (SSE-S3, KMS) |\n   | No state locking | High | Enable DynamoDB for S3, native for TF Cloud |\n   | State accessible to all team members | Medium | Restrict via IAM policies or TF Cloud teams |\n\n3. **Generate security report**\n   ```bash\n   python3 scripts\u002Ftf_security_scanner.py .\u002Fterraform\n   python3 scripts\u002Ftf_security_scanner.py .\u002Fterraform --output json\n   ```\n\n---\n\n## Tooling\n\n### `scripts\u002Ftf_module_analyzer.py`\n\nCLI utility for analyzing Terraform directory structure and module quality.\n\n**Features:**\n- Resource and data source counting\n- Variable and output analysis (missing descriptions, types, validation)\n- Naming convention checks\n- Module composition detection\n- File structure validation\n- JSON and text output\n\n**Usage:**\n```bash\n# Analyze a Terraform directory\npython3 scripts\u002Ftf_module_analyzer.py .\u002Fterraform\n\n# JSON output\npython3 scripts\u002Ftf_module_analyzer.py .\u002Fterraform --output json\n\n# Analyze a specific module\npython3 scripts\u002Ftf_module_analyzer.py .\u002Fmodules\u002Fvpc\n```\n\n### `scripts\u002Ftf_security_scanner.py`\n\nCLI utility for scanning `.tf` files for common security issues.\n\n**Features:**\n- Hardcoded secret detection (AWS keys, passwords, tokens)\n- Overly permissive IAM policy detection\n- Open security group detection (0.0.0.0\u002F0 on sensitive ports)\n- Missing encryption checks (S3, RDS, EBS)\n- Public access detection (S3, RDS, EC2)\n- Sensitive variable audit\n- JSON and text output\n\n**Usage:**\n```bash\n# Scan a Terraform directory\npython3 scripts\u002Ftf_security_scanner.py .\u002Fterraform\n\n# JSON output\npython3 scripts\u002Ftf_security_scanner.py .\u002Fterraform --output json\n\n# Strict mode (elevate warnings)\npython3 scripts\u002Ftf_security_scanner.py .\u002Fterraform --strict\n```\n\n---\n\n## Module Design Patterns\n\n### Pattern 1: Flat Module (Small\u002FMedium Projects)\n\n```\ninfrastructure\u002F\n├── main.tf          # All resources\n├── variables.tf     # All inputs\n├── outputs.tf       # All outputs\n├── versions.tf      # Provider requirements\n├── terraform.tfvars # Environment values (not committed)\n└── backend.tf       # Remote state configuration\n```\n\nBest for: Single application, \u003C 20 resources, one team owns everything.\n\n### Pattern 2: Nested Modules (Medium\u002FLarge Projects)\n\n```\ninfrastructure\u002F\n├── environments\u002F\n│   ├── dev\u002F\n│   │   ├── main.tf          # Calls modules with dev params\n│   │   ├── backend.tf       # Dev state backend\n│   │   └── terraform.tfvars\n│   ├── staging\u002F\n│   │   └── ...\n│   └── prod\u002F\n│       └── ...\n├── modules\u002F\n│   ├── networking\u002F\n│   │   ├── main.tf\n│   │   ├── variables.tf\n│   │   └── outputs.tf\n│   ├── compute\u002F\n│   │   └── ...\n│   └── database\u002F\n│       └── ...\n└── versions.tf\n```\n\nBest for: Multiple environments, shared infrastructure patterns, team collaboration.\n\n### Pattern 3: Mono-Repo with Terragrunt\n\n```\ninfrastructure\u002F\n├── terragrunt.hcl           # Root config\n├── modules\u002F                  # Reusable modules\n│   ├── vpc\u002F\n│   ├── eks\u002F\n│   └── rds\u002F\n├── dev\u002F\n│   ├── terragrunt.hcl       # Dev overrides\n│   ├── vpc\u002F\n│   │   └── terragrunt.hcl   # Module invocation\n│   └── eks\u002F\n│       └── terragrunt.hcl\n└── prod\u002F\n    ├── terragrunt.hcl\n    └── ...\n```\n\nBest for: Large-scale, many environments, DRY configuration, team-level isolation.\n\n---\n\n## Provider Configuration Patterns\n\n### Version Pinning\n```hcl\nterraform {\n  required_version = \">= 1.5.0\"\n\n  required_providers {\n    aws = {\n      source  = \"hashicorp\u002Faws\"\n      version = \"~> 5.0\"    # Allow 5.x, block 6.0\n    }\n    random = {\n      source  = \"hashicorp\u002Frandom\"\n      version = \"~> 3.5\"\n    }\n  }\n}\n```\n\n### Multi-Region with Aliases\n```hcl\nprovider \"aws\" {\n  region = \"us-east-1\"\n}\n\nprovider \"aws\" {\n  alias  = \"west\"\n  region = \"us-west-2\"\n}\n\nresource \"aws_s3_bucket\" \"primary\" {\n  bucket = \"my-app-primary\"\n}\n\nresource \"aws_s3_bucket\" \"replica\" {\n  provider = aws.west\n  bucket   = \"my-app-replica\"\n}\n```\n\n### Multi-Account with Assume Role\n```hcl\nprovider \"aws\" {\n  alias  = \"production\"\n  region = \"us-east-1\"\n\n  assume_role {\n    role_arn = \"arn:aws:iam::PROD_ACCOUNT_ID:role\u002FTerraformRole\"\n  }\n}\n```\n\n---\n\n## State Management Decision Tree\n\n```\nSingle developer, small project?\n├── Yes → Local state (but migrate to remote ASAP)\n└── No\n    ├── Using Terraform Cloud\u002FEnterprise?\n    │   └── Yes → TF Cloud native backend (built-in locking, encryption, RBAC)\n    └── No\n        ├── AWS?\n        │   └── S3 + DynamoDB (encryption, locking, versioning)\n        ├── GCP?\n        │   └── GCS bucket (native locking, encryption)\n        ├── Azure?\n        │   └── Azure Blob Storage (native locking, encryption)\n        └── Other?\n            └── Consul or PostgreSQL backend\n\nEnvironment isolation strategy:\n├── Separate state files per environment (recommended)\n│   ├── Option A: Separate directories (dev\u002F, staging\u002F, prod\u002F)\n│   └── Option B: Terraform workspaces (simpler but less isolation)\n└── Single state file for all environments (never do this)\n```\n\n---\n\n## CI\u002FCD Integration Patterns\n\n### GitHub Actions Plan\u002FApply\n\n```yaml\n# .github\u002Fworkflows\u002Fterraform.yml\nname: Terraform\non:\n  pull_request:\n    paths: ['terraform\u002F**']\n  push:\n    branches: [main]\n    paths: ['terraform\u002F**']\n\njobs:\n  plan:\n    runs-on: ubuntu-latest\n    if: github.event_name == 'pull_request'\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: hashicorp\u002Fsetup-terraform@v3\n      - run: terraform init\n      - run: terraform validate\n      - run: terraform plan -out=tfplan\n      - run: terraform show -json tfplan > plan.json\n      # Post plan as PR comment\n\n  apply:\n    runs-on: ubuntu-latest\n    if: github.ref == 'refs\u002Fheads\u002Fmain' && github.event_name == 'push'\n    environment: production\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: hashicorp\u002Fsetup-terraform@v3\n      - run: terraform init\n      - run: terraform apply -auto-approve\n```\n\n### Drift Detection\n\n```yaml\n# Run on schedule to detect drift\nname: Drift Detection\non:\n  schedule:\n    - cron: '0 6 * * 1-5'  # Weekdays at 6 AM\n\njobs:\n  detect:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: hashicorp\u002Fsetup-terraform@v3\n      - run: terraform init\n      - run: |\n          terraform plan -detailed-exitcode -out=drift.tfplan 2>&1 | tee drift.log\n          EXIT_CODE=$?\n          if [ $EXIT_CODE -eq 2 ]; then\n            echo \"DRIFT DETECTED — review drift.log\"\n            # Send alert (Slack, PagerDuty, etc.)\n          fi\n```\n\n---\n\n## Proactive Triggers\n\nFlag these without being asked:\n\n- **No remote backend configured** → Migrate to S3\u002FGCS\u002FAzure Blob with locking and encryption.\n- **Provider without version constraint** → Add `version = \"~> X.0\"` to prevent breaking upgrades.\n- **Hardcoded secrets in .tf files** → Use variables with `sensitive = true`, or integrate Vault\u002FSSM.\n- **IAM policy with `\"Action\": \"*\"`** → Scope to specific actions. No wildcard actions in production.\n- **Security group open to 0.0.0.0\u002F0 on SSH\u002FRDP** → Restrict to bastion CIDR or use SSM Session Manager.\n- **No state locking** → Enable DynamoDB table for S3 backend, or use TF Cloud.\n- **Resources without tags** → Add default_tags in provider block. Tags are mandatory for cost tracking.\n- **Missing `prevent_destroy` on databases\u002Fstorage** → Add lifecycle block to prevent accidental deletion.\n\n---\n\n## Multi-Cloud Provider Configuration\n\nWhen a single root module must provision across AWS, Azure, and GCP simultaneously.\n\n### Provider Aliasing Pattern\n\n```hcl\nterraform {\n  required_providers {\n    aws = {\n      source  = \"hashicorp\u002Faws\"\n      version = \"~> 5.0\"\n    }\n    azurerm = {\n      source  = \"hashicorp\u002Fazurerm\"\n      version = \"~> 3.0\"\n    }\n    google = {\n      source  = \"hashicorp\u002Fgoogle\"\n      version = \"~> 5.0\"\n    }\n  }\n}\n\nprovider \"aws\" {\n  region = var.aws_region\n}\n\nprovider \"azurerm\" {\n  features {}\n  subscription_id = var.azure_subscription_id\n}\n\nprovider \"google\" {\n  project = var.gcp_project_id\n  region  = var.gcp_region\n}\n```\n\n### Shared Variables Across Providers\n\n```hcl\nvariable \"environment\" {\n  description = \"Environment name used across all providers\"\n  type        = string\n  validation {\n    condition     = contains([\"dev\", \"staging\", \"prod\"], var.environment)\n    error_message = \"Must be dev, staging, or prod.\"\n  }\n}\n\nlocals {\n  common_tags = {\n    environment = var.environment\n    managed_by  = \"terraform\"\n    project     = var.project_name\n  }\n}\n```\n\n### When to Use Multi-Cloud\n\n- **Yes**: Regulatory requirements mandate data residency across providers, or the org has existing workloads on multiple clouds.\n- **No**: \"Avoiding vendor lock-in\" alone is not sufficient justification. Multi-cloud doubles operational complexity. Prefer single-cloud unless there is a concrete business requirement.\n\n---\n\n## OpenTofu Compatibility\n\nOpenTofu is an open-source fork of Terraform maintained by the Linux Foundation under the MPL 2.0 license.\n\n### Migration from Terraform to OpenTofu\n\n```bash\n# 1. Install OpenTofu\nbrew install opentofu        # macOS\nsnap install --classic tofu  # Linux\n\n# 2. Replace the binary — state files are compatible\ntofu init                    # Re-initializes with OpenTofu\ntofu plan                    # Identical plan output\ntofu apply                   # Same apply workflow\n```\n\n### License Considerations\n\n| | Terraform (1.6+) | OpenTofu |\n|---|---|---|\n| **License** | BSL 1.1 (source-available) | MPL 2.0 (open-source) |\n| **Commercial use** | Restricted for competing products | Unrestricted |\n| **Community governance** | HashiCorp | Linux Foundation |\n\n### Feature Parity\n\nOpenTofu tracks Terraform 1.6.x features. Key additions unique to OpenTofu:\n- Client-side state encryption (`tofu init -encryption`)\n- Early variable\u002Flocals evaluation\n- Provider-defined functions\n\n### When to Choose OpenTofu\n\n- You need a fully open-source license for your supply chain.\n- You want client-side state encryption without Terraform Cloud.\n- Otherwise, either tool works — the HCL syntax and provider ecosystem are identical.\n\n---\n\n## Infracost Integration\n\nInfracost estimates cloud costs from Terraform code before resources are provisioned.\n\n### PR Workflow\n\n```bash\n# Show cost breakdown for current code\ninfracost breakdown --path .\n\n# Compare cost difference between current branch and main\ninfracost diff --path . --compare-to infracost-base.json\n```\n\n### GitHub Actions Cost Comment\n\n```yaml\n# .github\u002Fworkflows\u002Finfracost.yml\nname: Infracost\non: [pull_request]\n\njobs:\n  cost:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: infracost\u002Factions\u002Fsetup@v3\n        with:\n          api-key: ${{ secrets.INFRACOST_API_KEY }}\n      - run: infracost breakdown --path .\u002Fterraform --format json --out-file \u002Ftmp\u002Finfracost.json\n      - run: infracost comment github --path \u002Ftmp\u002Finfracost.json --repo $GITHUB_REPOSITORY --pull-request ${{ github.event.pull_request.number }} --github-token ${{ secrets.GITHUB_TOKEN }} --behavior update\n```\n\n### Budget Thresholds and Cost Policy\n\n```yaml\n# infracost.yml — policy file\nversion: 2.9.0\npolicies:\n  - path: \"*\"\n    max_monthly_cost: \"5000\"    # Fail PR if estimated cost exceeds $5,000\u002Fmonth\n    max_cost_increase: \"500\"    # Fail PR if cost increase exceeds $500\u002Fmonth\n```\n\n---\n\n## Import Existing Infrastructure\n\nBring manually-created resources under Terraform management.\n\n### terraform import Workflow\n\n```bash\n# 1. Write the resource block first (empty body is fine)\n# main.tf:\n# resource \"aws_s3_bucket\" \"legacy\" {}\n\n# 2. Import the resource into state\nterraform import aws_s3_bucket.legacy my-existing-bucket-name\n\n# 3. Run plan to see attribute diff\nterraform plan\n\n# 4. Fill in the resource block until plan shows no changes\n```\n\n### Bulk Import with Config Generation (Terraform 1.5+)\n\n```bash\n# Generate HCL for imported resources\nterraform plan -generate-config-out=generated.tf\n\n# Review generated.tf, then move resources into proper files\n```\n\n### Common Pitfalls\n\n- **Resource drift after import**: The imported resource may have attributes Terraform does not manage. Run `terraform plan` immediately and resolve every diff.\n- **State manipulation**: Use `terraform state mv` to rename or reorganize. Use `terraform state rm` to remove without destroying. Always back up state before manipulation: `terraform state pull > backup.tfstate`.\n- **Sensitive defaults**: Imported resources may expose secrets in state. Restrict state access and enable encryption.\n\n---\n\n## Terragrunt Patterns\n\nTerragrunt is a thin wrapper around Terraform that provides DRY configuration for multi-environment setups.\n\n### Root terragrunt.hcl (Shared Config)\n\n```hcl\n# terragrunt.hcl (root)\nremote_state {\n  backend = \"s3\"\n  generate = {\n    path      = \"backend.tf\"\n    if_exists = \"overwrite_terragrunt\"\n  }\n  config = {\n    bucket         = \"my-org-terraform-state\"\n    key            = \"${path_relative_to_include()}\u002Fterraform.tfstate\"\n    region         = \"us-east-1\"\n    encrypt        = true\n    dynamodb_table = \"terraform-locks\"\n  }\n}\n```\n\n### Child terragrunt.hcl (Environment Override)\n\n```hcl\n# prod\u002Fvpc\u002Fterragrunt.hcl\ninclude \"root\" {\n  path = find_in_parent_folders()\n}\n\nterraform {\n  source = \"..\u002F..\u002Fmodules\u002Fvpc\"\n}\n\ninputs = {\n  environment = \"prod\"\n  cidr_block  = \"10.0.0.0\u002F16\"\n}\n```\n\n### Dependencies Between Modules\n\n```hcl\n# prod\u002Feks\u002Fterragrunt.hcl\ndependency \"vpc\" {\n  config_path = \"..\u002Fvpc\"\n}\n\ninputs = {\n  vpc_id     = dependency.vpc.outputs.vpc_id\n  subnet_ids = dependency.vpc.outputs.private_subnet_ids\n}\n```\n\n### When Terragrunt Adds Value\n\n- **Yes**: 3+ environments with identical module structure, shared backend config, or cross-module dependencies.\n- **No**: Single environment, small team, or simple directory-based isolation already works. Terragrunt adds a learning curve and another binary to manage.\n\n---\n\n## Installation\n\n### One-liner (any tool)\n```bash\ngit clone https:\u002F\u002Fgithub.com\u002Falirezarezvani\u002Fclaude-skills.git\ncp -r claude-skills\u002Fengineering\u002Fterraform-patterns ~\u002F.claude\u002Fskills\u002F\n```\n\n### Multi-tool install\n```bash\n.\u002Fscripts\u002Fconvert.sh --skill terraform-patterns --tool codex|gemini|cursor|windsurf|openclaw\n```\n\n### OpenClaw\n```bash\nclawhub install terraform-patterns\n```\n\n---\n\n## Related Skills\n\n- **senior-devops** — Broader DevOps scope (CI\u002FCD, monitoring, containerization). Complementary — use terraform-patterns for IaC-specific work, senior-devops for pipeline and infrastructure operations.\n- **aws-solution-architect** — AWS architecture design. Complementary — terraform-patterns implements the infrastructure, aws-solution-architect designs it.\n- **senior-security** — Application security. Complementary — terraform-patterns covers infrastructure security posture, senior-security covers application-level threats.\n- **ci-cd-pipeline-builder** — Pipeline construction. Complementary — terraform-patterns defines infrastructure, ci-cd-pipeline-builder automates deployment.\n",{"name":5,"license":15,"metadata":55,"description":7},{"author":56,"updated":57,"version":58,"category":59},"Alireza Rezvani",1773532800000,"1.0.0","engineering","main","0da4485785ee599388900be50db1635489d53056",".agents\u002Fskills\u002Fterraform-patterns","https:\u002F\u002Fgithub.com\u002FTashima-Tarsh\u002FDisha6.6","https:\u002F\u002Fdisha6.6.thenitishkr.in\u002F","https:\u002F\u002Fgithub.com\u002FTashima-Tarsh","www.thenitishkr","thenitishkr | AI • Cyber-security • Research\r\n","2026-11-08 03:33:25",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add Tashima-Tarsh\u002FDisha6.6 --skill terraform-patterns",{"tool":75,"command":76},"bunx","bunx skills add Tashima-Tarsh\u002FDisha6.6 --skill terraform-patterns",{"tool":78,"command":79},"pnpm","pnpm dlx skills add Tashima-Tarsh\u002FDisha6.6 --skill terraform-patterns","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FTashima-Tarsh\u002FDisha6.6\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fterraform-patterns\u002FSKILL.md",true,[],[84,114,137,162,186,208],{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":93,"publishedAt":50},"01M6QRD07D4TGNDK6VJ4EHF8BV","youtube-full","Use when the user needs YouTube transcripts, video search, channel browsing, playlist extraction, or content monitoring. Trigger phrases: 'get the transcript for', 'search YouTube for', 'what are the latest videos on', 'list this playlist', 'monitor this channel', or any request involving a YouTube URL, video ID, or @handle. Do NOT use for downloading video or audio files, YouTube engagement data (likes, comments), or private\u002Fage-restricted videos.","https:\u002F\u002Fgithub.com\u002FTashima-Tarsh\u002FDisha6.6\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fyoutube-full\u002FSKILL.md",[90],{"categoryNo":91,"categoryName":92,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体",[94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113],"youtube full","youtube","full","transcript","search","monitoring","data","Video","Audio","list","files","do","get","age","trigger","URL","for","browsing","request","youtube transcripts",{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":120,"publishedAt":50},"01M6QRCJ3112VYPA97YG7KGMC2","x-twitter-growth","X\u002FTwitter growth engine for building audience, crafting viral content, and analyzing engagement. Use when the user wants to grow on X\u002FTwitter, write tweets or threads, analyze their X profile, research competitors on X, plan a posting strategy, or optimize engagement. Complements social-content (generic multi-platform) with X-specific depth: algorithm mechanics, thread engineering, reply strategy, profile optimization, and competitive intelligence via web search.","https:\u002F\u002Fgithub.com\u002FTashima-Tarsh\u002FDisha6.6\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fx-twitter-growth\u002FSKILL.md",[],[121,122,123,124,98,125,59,40,126,127,128,129,130,131,132,133,134,135,136,110],"twitter","x twitter growth","growth","research","content","web search","competitors","analyze","engine","write","strategy","use","platform","grow","posting","competitive",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":144,"publishedAt":50},"01M6QRBN3EHQNJY42RERP7A149","write-a-skill","Create new agent skills with proper structure, progressive disclosure, and bundled resources. Use when user wants to create, write, build, or author a new skill.","https:\u002F\u002Fgithub.com\u002FTashima-Tarsh\u002FDisha6.6\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fwrite-a-skill\u002FSKILL.md",[143],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[145,130,146,147,148,149,150,151,132,152,153,60,154,155,156,157,158,159,160,161],"write a skill","github","create","https","productivity","matt pocock","direct","example","build","new skill","structure","new agent","resources","with","tree","progressive disclosure","author",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":168,"publishedAt":50},"01M6QRB6G8P33PNGAF9Y69EJ9T","wrap-up","Close out a launched Claude Managed Agent — recap every primitive the founder now owns, regenerate the single-file overview page, and suggest the next 1-2 upgrades. Use when the user says \"wrap up\", \"close this out\", \"what do I own now\", \"give me the summary\", \"recap the agent\", or when the orchestrator routes phase=wrap-up. primitives_inventory.py tables everything owned (agent, environment, session, memory, outcome, deployment); overview_page.py regenerates a self-contained .\u002Fmy-agent\u002Fagent-overview.html; upgrade_suggester.py ranks the next moves from recorded deferrals plus standing hardening steps. Companion to run-without-you; the last stop before phase=done.","https:\u002F\u002Fgithub.com\u002FTashima-Tarsh\u002FDisha6.6\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fwrap-up\u002FSKILL.md",[],[169,170,171,48,172,173,174,175,176,132,177,105,178,179,180,181,182,183,184,185],"wrap up","up","wrap","deployment","run","file","hardening","closeout","stop","upgrade","founder","close","companion","you","tables","directions","phase",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":193,"publishedAt":50},"01M6QRA5AYC1RBFZ39GTWGS3N8","workflow-builder","Design and write deterministic multi-agent workflow scripts (.js files in .claude\u002Fworkflows\u002F) for Claude Code's Workflow tool. Use when a user wants to build, create, author, scaffold, or run a custom Claude Code workflow, orchestrate sub-agents (fan-out, pipeline, loop, judge-panel), or automate a repeatable multi-step task across fresh-context agents.","https:\u002F\u002Fgithub.com\u002FTashima-Tarsh\u002FDisha6.6\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fworkflow-builder\u002FSKILL.md",[192],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[194,195,196,41,45,147,173,197,198,199,200,201,130,202,104,203,204,205,206,207],"workflow","workflow builder","builder","code","orchestrate","pipeline","loop","multi-agent","context","across","fresh","scripts","judge","claude code workflow",{"skillNo":209,"name":210,"nameZh":6,"description":211,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":212,"categories":213,"keywords":214,"publishedAt":50},"01M6QR7QMCZESKQA0ERW1E657M","weekly-review","Use when someone wants to run a weekly review, close open loops, audit stalled projects and commitments, get their system back to trusted, restart a lapsed review habit, or says \"\u002Fcs:weekly-review\". Walks David Allen's three-phase loop — GET CLEAR, GET CURRENT, GET CREATIVE — with deterministic scripts that inventory open loops, gate the checklist with named gaps, and score commitment health 0-100.","https:\u002F\u002Fgithub.com\u002FTashima-Tarsh\u002FDisha6.6\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fweekly-review\u002FSKILL.md",[],[215,216,217,218,219,220,221,222,223,200,224,225,226,227,228,229,106,230,231,185],"review","weekly review","weekly","deterministic scripts","reflect","feeds","inventory","open","team","projects","project-management","scanner","conversation","back","project","sprint","cadence"]