terraform-generator

Generate Terraform HCL configurations with validation, security scanning, and provider documentation lookup.

Updated Jul 4, 2026
One-click install
npx skills add https://github.com/100Thieves-team/plady-expert-skills --skill terraform-generator-100thieves-team
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: terraform-generator
Source: https://github.com/100Thieves-team/plady-expert-skills/tree/main/.claude/skills/terraform-generator
Command: npx skills add https://github.com/100Thieves-team/plady-expert-skills --skill terraform-generator-100thieves-team

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) and assets (resource) components.

What problem does it solve? Writing Terraform configurations by hand is error-prone: wrong provider arguments, missing lifecycle safeguards, hardcoded values, and security misconfigurations often slip through until apply time. This Skill generates Terraform .tf files following current best practices and enforces a mandatory validate-fix-revalidate loop so broken or insecure configurations never reach the user. ## Core Features & Use Cases - Best-Practice HCL Generation: Produces organized main.tf, variables.tf, outputs.tf, and versions.tf files with data sources, lifecycle rules, dynamic blocks, and proper version constraints. - Custom Provider Documentation Lookup: Detects third-party providers and modules (e.g., Datadog, MongoDB Atlas) and fetches version-specific documentation before generating resources. - Mandatory Validation Loop: Invokes a terraform-validator skill running terraform fmt, init, validate, and Checkov security scans, then fixes and re-validates until all checks pass. - Use Case: Ask for an AWS RDS database with encryption and deletion protection; the Skill generates the configuration with prevent_destroy lifecycle rules, ephemeral password handling via write-only arguments, runs Checkov, fixes any flagged issues, and delivers ready-to-apply files with usage instructions. ## Quick Start Generate a Terraform configuration for an AWS S3 bucket with versioning, encryption, and lifecycle rules, then validate it.

Frequently Asked Questions about terraform-generator

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate Terraform configuration files with best practices?

Describe the infrastructure you need, including providers and resources. The Skill generates organized main.tf, variables.tf, outputs.tf, and versions.tf files with data sources, lifecycle rules, and pinned provider versions, then validates everything before delivery.

How to validate Terraform code and fix security issues automatically?

The Skill invokes a terraform-validator that runs terraform fmt, init, validate, and Checkov security scans. If any check fails, such as CKV_AWS_300 for missing multipart upload aborts, it fixes the issue and re-validates until all checks pass.

Does Terraform generation support custom or third-party providers?

Yes. When custom providers like Datadog or MongoDB Atlas are detected, the Skill performs web searches for version-specific documentation covering required arguments, attributes, and examples before generating resources. Standard HashiCorp providers need no lookup.

What Terraform version features does the generator support?

It supports features from Terraform 1.4 through 1.14, including import blocks, ephemeral resources, write-only arguments, S3 native state locking, actions, and the query command. The required_version constraint is set automatically based on which features the generated code uses.

Why does Terraform validation fail on generated configurations?

Common failures include missing abort_incomplete_multipart_upload rules on S3 lifecycle configurations, SSH open to 0.0.0.0/0, disabled RDS encryption, and invalid resource arguments. Each failure maps to a documented fix that is applied before re-validation.

Can generated Terraform handle secrets without storing them in state?

Yes. For Terraform 1.10+, the Skill uses ephemeral resources and variables so secrets never persist in state. For Terraform 1.11+, it uses write-only arguments with the _wo suffix and version attributes for secure password rotation.