What problem does it solve? Managing cloud and on-prem infrastructure by hand leads to configuration drift, unreviewed changes, and corrupted state. This Skill encodes the discipline of Infrastructure as Code with Terraform or OpenTofu: declarative HCL2 configuration, mandatory remote state with locking, least-privilege short-lived auth, and a plan → human review → gated apply lifecycle where every mutation is reviewed before it touches infrastructure. ## Core Features & Use Cases - Module Authoring: Build reusable, versioned modules with typed variables, validation blocks, outputs, for_each/count/dynamic, and safe moved-block refactors instead of copy-pasted resource blocks. - State, Providers & Plan Review: Configure remote backends with locking (S3+DynamoDB, azurerm, gcs, Terraform Cloud), pin providers via a committed .terraform.lock.hcl, authenticate with OIDC/assume-role/workload identity, and gate every apply behind plan review plus policy-as-code (OPA/Conftest/Sentinel). - Testing & Drift Detection: Wire fmt/validate/tflint/tfsec/checkov and native terraform test (.tftest.hcl) or terratest into CI as merge-blocking gates, and detect drift with plan -refresh-only reconciled through Git. - Use Case: A plan shows an unexpected destroy on a production database. The Skill's doctrine treats this as a stop-the-line event: read the saved plan, confirm prevent_destroy guards, pass the OPA policy gate, and apply only the reviewed plan through a PR approval. ## Quick Start Ask the AI to review your Terraform module for state backend safety, provider pinning, and plan-review gates before your next apply.
