skills.rest
nguyenpv1980-wq
nguyenpv1980-wqCOMMUNITY
Explore all skills by this author →
GitHub

iac-reviewer

Review infrastructure-as-code diffs for destructive replacements, exposure, and privilege widening.

2|Updated Jul 6, 2026
Search Tags:#cloudformation#security review#terraform#iac#blast radius#bicep#deploy safety
One-click install
npx skills add https://github.com/nguyenpv1980-wq/Project-Aegis --skill iac-reviewer-nguyenpv1980-wq
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: iac-reviewer
Source: https://github.com/nguyenpv1980-wq/Project-Aegis/tree/main/.claude/skills/iac-reviewer
Command: npx skills add https://github.com/nguyenpv1980-wq/Project-Aegis --skill iac-reviewer-nguyenpv1980-wq

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill reviews infrastructure-as-code changes before deployment so you can catch destructive replacements, public exposure, privilege widening, secret leakage, and tenant-isolation regressions before they reach production.

Core Features & Use Cases

  • Blast-radius analysis: Identifies deletes, replacements, reindexing, and other changes that can destroy or recreate stateful infrastructure.
  • Security and access review: Checks for exposed networks, overly broad IAM/RBAC, missing encryption, secrets in code, and state-capture risks.
  • Drift and cost review: Flags mismatches with documented architecture, unpinned modules, missing tagging, and changes that increase ongoing spend.
  • Use Case: A Terraform PR renames a database module and widens a security group, and this Skill explains what will be destroyed, what exposure is created, and what corrections are needed before apply.

Quick Start

Ask me to review your IaC diff for deploy safety, blast radius, exposure, IAM width, and tenant-isolation impact before anyone applies it.

Frequently Asked Questions about iac-reviewer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review Terraform plan output for destructive changes before apply?▼

Security review for IaC diffs checks for exposed networks, overly broad IAM or RBAC permissions, missing encryption, secrets in code, and state-capture risks. This Skill assesses privilege widening and tenant-isolation regressions across Terraform, Bicep, CloudFormation, CDK, and Pulumi changes before apply.

Can I check Bicep and CloudFormation diffs for public exposure and IAM widening?▼

Yes, you can check Bicep and CloudFormation diffs for public exposure and IAM widening. This Skill reviews infrastructure-as-code changes across multiple IaC frameworks to identify exposed networks, overly broad access controls, and privilege escalation with file-line evidence and severity-ranked findings.

What is blast radius analysis in infrastructure-as-code deployments?▼

Blast radius analysis in infrastructure-as-code deployments is the process of identifying deletes, replacements, and reindexing operations that can destroy or recreate stateful infrastructure. It helps catch destructive changes by requiring file-line evidence and providing an explicit review-only verdict with proposed corrections.

Does this IaC review approach work with Pulumi and CDK plan output?▼

Yes, this IaC review approach works with Pulumi and CDK plan output. The Skill applies to Terraform, Bicep, CloudFormation, CDK, and Pulumi diffs, including drift checks and security posture audits, to flag mismatches with documented architecture and unpinned modules.

How do I flag unpinned modules and cost increases in IaC drift checks?▼

To flag unpinned modules and cost increases in IaC drift checks, you review diffs for mismatches with documented architecture, missing tagging, and changes that increase ongoing spend. This Skill performs drift and cost review to identify these issues alongside security and blast-radius findings.

Related Skills

Explore More Software Engineering Skills→
AraflyArafly

terraform-iac-review

Audit Infrastructure as Code repositories for risks before changes.

Community
Advanced
JaimeJunrJaimeJunr
2

run-tests

Execute unit and integration tests, analyze failures, and re-run to verify corrections.

Community
Advanced
shakhovskiya-createshakhovskiya-create

deploy-audit

Audit CI/CD pipelines and infrastructure configurations for security and reliability.

Community
Advanced
awslabsawslabs
15

security-review

Audit AWS IaC and configurations for security risks and misconfigurations.

Official
Advanced