Agent skill · magnus919
terraform
Operate Terraform and OpenTofu across the whole infrastructure lifecycle: module structure, state backends and locking, plan/apply workflow, drift detection, remote state, upgrade and refactor flows, and evidence-based diagnostics. Use when running or inspecting terraform plans, applies, state files, imports, or state surgery, or when the bundled tfops script should handle the task. Do not use for IaC methodology or cloud design decisions - those route up to platform-engineering.
What it needs
About 6k tokens when loaded.
What this skill does
Terraform / OpenTofu Operations Use this skill to run, inspect, and repair Terraform and OpenTofu infrastructure safely: understand a module graph, verify state backends and locking, review plans before applies, find and fix drift, work with remote state, plan version upgrades and refactors, and diagnose failures with evidence. This is a tool skill for one named tool (Terraform and its drop-in OpenTofu fork share one agent workflow and one trigger). Design decisions and IaC methodology belong to platform-engineering and its references/infrastructure-as-code.md; this skill owns execution. Operating contract 1. Discover before assuming. Read the module layout, provider requirements, backend block, workspaces, terraform.lock.hcl, and CI invocation before running anything. Never infer state from a config file — the state file is the source of truth for what exists. 2. Plan first, apply after review. Every mutation goes through a visible plan (or tfops dry-run) and an explicit confirmation. Never run apply with unreviewed changes. 3. Lock and scope state. Confirm the backend supports locking and that the operator holds the lock before any state mutation. State surgery (state mv, state rm, state push) is a reviewed, scoped operation with a backup. 4. Verify at the boundary. A green apply is not proof of success: verify the external boundary (DNS, load balancer, API response) that the resource was supposed to satisfy, and check for drift on the next plan. 5. Keep evidence bounded. Never dump raw state files, backend credentials, or provider secrets into chat. tfops redacts nothing by itself but all outputs should be bounded summaries. The tfops script scripts/tfops is an agent-first wrapper around the terraform/tofu CLI. It works without a terraform binary for --help, doctor, and direct --state analysis, so an agent can inventory a state file anywhere. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills magnus919/terraform