skills.rest
y-miyazaki
y-miyazakiCOMMUNITY
Explore all skills by this author →
GitHub

terraform-review

Automate Terraform code review with structured checks for security, versioning, and module structure.

1|Updated Dec 8, 2025
Search Tags:#security#terraform#best-practices#infrastructure-as-code#ci-cd#code-review
One-click install
npx skills add https://github.com/y-miyazaki/arc --skill terraform-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: terraform-review
Source: https://github.com/y-miyazaki/arc/tree/main/.github/skills/terraform-review
Command: npx skills add https://github.com/y-miyazaki/arc --skill terraform-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Terraform configurations often suffer from inconsistent review quality, leading to misconfigurations, security gaps, and maintainability issues. This Skill provides a structured, repeatable framework to audit infrastructure-as-code across projects, ensuring consistency and reliability.

Core Features & Use Cases

  • Global / Base checks: validate variables/outputs definitions, module interfaces, and documentation quality.
  • Module structure guidance: enforce clear separation of concerns for locals/variables/outputs, and consistent naming.
  • Security & compliance focus: identify hardcoded secrets, insecure defaults, unrefined IAM policies, and misconfigurations that violate best practices.
  • Versioning & observability alignment: enforce provider/version pinning, output of meaningful metadata, and alignment with CI/CD reviews.
  • Review workflow: outline a step-by-step process from initial assessment to remediation, with a prioritized issues report.

Quick Start

Run a Terraform code review on your repository by applying the checks in this guide to a module or set of modules.

Frequently Asked Questions about terraform-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review Terraform code for security and best practices?▼

Reviewing Terraform code for security involves applying a systematic checklist that identifies hardcoded secrets, insecure defaults, unrefined IAM policies, and misconfigurations to ensure infrastructure-as-code maintainability and compliance.

What is included in an infrastructure as code audit?▼

An infrastructure as code audit includes validating module interfaces, ensuring clear separation of concerns for variables and outputs, enforcing naming conventions, checking documentation quality, and verifying provider and version pinning across Terraform configurations.

How do I integrate Terraform code review into a CI/CD pipeline?▼

Integrating Terraform code review into a CI/CD pipeline requires applying a reproducible checklist for versioning and observability alignment, enabling automated detection of infrastructure misconfigurations before deployment.

Does this Terraform review guidance cover module structure and naming conventions?▼

Yes, this Terraform review guidance covers module structure by enforcing clear separation of concerns for locals, variables, and outputs, alongside validating consistent naming conventions across your infrastructure configurations.

What is the best way to check Terraform configurations for misconfigurations?▼

The best way to check Terraform configurations for misconfigurations is executing a structured review workflow that assesses module structure, variables, and security, producing a prioritized remediation report.

Related Skills

Explore More Software Engineering Skills→
htlin222htlin222
77

terraform

Create and manage cloud infrastructure with Terraform modules and state files.

Community
Advanced
chapzinchapzin
1

Security Audit

Audit code and infrastructure for security vulnerabilities and compliance gaps.

Community
Intermediate
takumi12311123takumi12311123
1

infra-terraform

Enforce Terraform infrastructure as code best practices across environments.

Community
Advanced
lidge-junlidge-jun
5

insecure-defaults

Detect fail-open insecure default configurations in applications and IaC templates.

Community
Advanced