terraform

Diagnose and review Terraform plans, state locks, drift, and infrastructure changes safely.

Updated May 11, 2026
One-click install
npx skills add https://github.com/cloudofgeorge/AI-hands-Engineer --skill terraform-cloudofgeorge
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: terraform
Source: https://github.com/cloudofgeorge/AI-hands-Engineer/tree/main/skills/engineering/domains/infrastructure/terraform
Command: npx skills add https://github.com/cloudofgeorge/AI-hands-Engineer --skill terraform-cloudofgeorge

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Terraform operations can mutate live infrastructure and state, and a single unscoped apply, force-unlock, or targeted plan can cause outages or data loss. This Skill enforces a read-only-first diagnostic workflow with explicit approval gates before any infrastructure mutation. ## Core Features & Use Cases - Boundary confirmation: Verify repository revision, backend, workspace, cloud account, and region before running any command, so changes never land in the wrong environment. - Safe structural checks: Run terraform fmt, init -backend=false, and validate for offline validation, plus speculative and refresh-only plans for drift inspection without bypassing state locks. - Approval-gated mutations: Require a decision record covering target, evidence, risk, rollback, and verification before apply, destroy, import, state surgery, or force-unlock. - Use Case: During an incident, Terraform reports a state lock. Use this Skill to capture the lock ID and holder, verify ownership through the change process, and only force-unlock a demonstrably abandoned lock with explicit operator confirmation. ## Quick Start Use the terraform skill to review the plan output for the staging workspace and tell me which resources will be replaced before I approve anything.

Frequently Asked Questions about terraform

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely review a Terraform plan before applying?

Run terraform plan -input=false -no-color against a confirmed backend and workspace, then record creates, updates, replacements, and destroys. Treat the plan as a change artifact and regenerate it immediately before an approved apply, since a reviewed plan can go stale.

How do I handle a Terraform state lock during an incident?

Capture the lock ID, holder, operation, backend, and workspace, then verify with the change owner whether the lock is active. Use terraform force-unlock only for a demonstrably abandoned lock owned by your team, with explicit operator confirmation, and never bypass locking with -lock=false.

Does terraform validate check my cloud provider configuration?

No, terraform validate only checks configuration syntax and internal consistency, not provider APIs or remote state. Use terraform init -backend=false first for offline validation of modules that do not need a production backend.

Can I use this workflow with Terragrunt or OpenTofu?

Yes, the same safety contract applies to Terraform-compatible tooling. For Terragrunt, first identify its version, generated working directory, selected stack, and the exact Terraform command it will invoke before running anything.

Why is terraform plan -target or -refresh=false discouraged?

Flags like -target, -replace, -refresh=false, and -lock=false change the meaning or safety of a plan and can hide drift or unrelated changes. Each requires a documented reason and explicit approval, and a targeted plan never proves the rest of the configuration is safe.