[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6C1SBKBH35S2WERT1WNHH54":3,"skill-same:01M6C1SBKBH35S2WERT1WNHH54":99},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":59,"commitSha":60,"skillDirectory":61,"forksCount":13,"repositoryHtmlUrl":62,"repositoryHomepageUrl":6,"ownerHtmlUrl":63,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":64,"install":65,"resources":78},"01M6C1SBKBH35S2WERT1WNHH54","terraform-patterns",null,"Terraform infrastructure-as-code agent skill and plugin for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw. Covers module design patterns, state management strategies, provider configuration, security hardening, policy-as-code with Sentinel\u002FOPA, and CI\u002FCD plan\u002Fapply workflows. Use when: user wants to design Terraform modules, manage state backends, review Terraform security, implement multi-region deployments, or follow IaC best practices.","mne20114-hash\u002Fgest35bi","mne20114-hash","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F224168109?v=4","01M6C0JCR7334CZ39YWTZXX2NG","01M6C0JCWN0NBWMQTW1CPG2Z4G",0,"MIT","https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fengineering\u002Fterraform-patterns\u002Fskills\u002Fterraform-patterns\u002FSKILL.md",[17,22,25],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":26,"categoryName":27,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"terraform patterns","terraform","opa","use","plan","sentinel","policy-as-code","infrastructure-as-code","ci","code","design","infrastructure","workflows","policy","security","gemini cli","gemini","cli","review","openclaw","2026-11-10 10:12:30",false,"---\nname: \"terraform-patterns\"\ndescription: \"Terraform infrastructure-as-code agent skill and plugin for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw. Covers module design patterns, state management strategies, provider configuration, security hardening, policy-as-code with Sentinel\u002FOPA, and CI\u002FCD plan\u002Fapply workflows. Use when: user wants to design Terraform modules, manage state backends, review Terraform security, implement multi-region deployments, or follow IaC best practices.\"\nlicense: MIT\nmetadata:\n  version: 1.0.0\n  author: Alireza Rezvani\n  category: engineering\n  updated: 2026-03-15\n---\n\n# Terraform Patterns\n\n> Predictable infrastructure. Secure state. Modules that compose. No drift.\n\nOpinionated Terraform workflow that turns sprawling HCL into well-structured, secure, production-grade infrastructure code. Covers module design, state management, provider patterns, security hardening, and CI\u002FCD integration.\n\nNot a Terraform tutorial — a set of concrete decisions about how to write infrastructure code that doesn't break at 3 AM.\n\n---\n\n## Slash Commands\n\n| Command | What it does |\n|---------|-------------|\n| `\u002Fterraform:review` | Analyze Terraform code for anti-patterns, security issues, and structure problems |\n| `\u002Fterraform:module` | Design or refactor a Terraform module with proper inputs, outputs, and composition |\n| `\u002Fterraform:security` | Audit Terraform code for security vulnerabilities, secrets exposure, and IAM misconfigurations |\n\n---\n\n## When This Skill Activates\n\nRecognize these patterns from the user:\n\n- \"Review this Terraform code\"\n- \"Design a Terraform module for...\"\n- \"My Terraform state is...\"\n- \"Set up remote state backend\"\n- \"Multi-region Terraform deployment\"\n- \"Terraform security review\"\n- \"Module structure best practices\"\n- \"Terraform CI\u002FCD pipeline\"\n- Any request involving: `.tf` files, HCL, Terraform modules, state management, provider configuration, infrastructure-as-code\n\nIf the user has `.tf` files or wants to provision infrastructure with Terraform → this skill applies.\n\n---\n\n## Workflow\n\n### `\u002Fterraform:review` — Terraform Code Review\n\n1. **Analyze current state**\n   - Read all `.tf` files in the target directory\n   - Identify module structure (flat vs nested)\n   - Count resources, data sources, variables, outputs\n   - Check naming conventions\n\n2. **Apply review checklist**\n\n   ```\n   MODULE STRUCTURE\n   ├── Variables have descriptions and type constraints\n   ├── Outputs expose only what consumers need\n   ├── Resources use consistent naming: {provider}_{type}_{purpose}\n   ├── Locals used for computed values and DRY expressions\n   └── No hardcoded values — everything parameterized or in locals\n\n   STATE & BACKEND\n   ├── Remote backend configured (S3, GCS, Azure Blob, Terraform Cloud)\n   ├── State locking enabled (DynamoDB for S3, native for others)\n   ├── State encryption at rest enabled\n   ├── No secrets stored in state (or state access is restricted)\n   └── Workspaces or directory isolation for environments\n\n   PROVIDERS\n   ├── Version constraints use pessimistic operator: ~> 5.0\n   ├── Required providers block in terraform {} block\n   ├── Provider aliases for multi-region or multi-account\n   └── No provider configuration in child modules\n\n   SECURITY\n   ├── No hardcoded secrets, keys, or passwords\n   ├── IAM follows least-privilege principle\n   ├── Encryption enabled for storage, databases, secrets\n   ├── Security groups are not overly permissive (no 0.0.0.0\u002F0 ingress on sensitive ports)\n   └── Sensitive variables marked with sensitive = true\n   ```\n\n3. **Generate report**\n   ```bash\n   python3 scripts\u002Ftf_module_analyzer.py .\u002Fterraform\n   ```\n\n4. **Run security scan**\n   ```bash\n   python3 scripts\u002Ftf_security_scanner.py .\u002Fterraform\n   ```\n\n### `\u002Fterraform:module` — Module Design\n\n1. **Identify module scope**\n   - Single responsibility: one module = one logical grouping\n   - Determine inputs (variables), outputs, and resource boundaries\n   - Decide: flat module (single directory) vs nested (calling child modules)\n\n2. **Apply module design checklist**\n\n   ```\n   STRUCTURE\n   ├── main.tf        — Primary resources\n   ├── variables.tf   — All input variables with descriptions and types\n   ├── outputs.tf     — All outputs with descriptions\n   ├── versions.tf    — terraform {} block with required_providers\n   ├── locals.tf      — Computed values and naming conventions\n   ├── data.tf        — Data sources (if any)\n   └── README.md      — Usage examples and variable documentation\n\n   VARIABLES\n   ├── Every variable has: description, type, validation (where applicable)\n   ├── Sensitive values marked: sensitive = true\n   ├── Defaults provided for optional settings\n   ├── Use object types for related settings: variable \"config\" { type = object({...}) }\n   └── Validate with: validation { condition = ... }\n\n   OUTPUTS\n   ├── Output IDs, ARNs, endpoints — things consumers need\n   ├── Include description on every output\n   ├── Mark sensitive outputs: sensitive = true\n   └── Don't output entire resources — only specific attributes\n\n   COMPOSITION\n   ├── Root module calls child modules\n   ├── Child modules never call other child modules\n   ├── Pass values explicitly — no hidden data source lookups in child modules\n   ├── Provider configuration only in root module\n   └── Use module \"name\" { source = \".\u002Fmodules\u002Fname\" }\n   ```\n\n3. **Generate module scaffold**\n   - Output file structure with boilerplate\n   - Include variable validation blocks\n   - Add lifecycle rules where appropriate\n\n### `\u002Fterraform:security` — Security Audit\n\n1. **Code-level audit**\n\n   | Check | Severity | Fix |\n   |-------|----------|-----|\n   | Hardcoded secrets in `.tf` files | Critical | Use variables with sensitive = true or vault |\n   | IAM policy with `*` actions | Critical | Scope to specific actions and resources |\n   | Security group with 0.0.0.0\u002F0 on port 22\u002F3389 | Critical | Restrict to known CIDR blocks or use SSM\u002Fbastion |\n   | S3 bucket without encryption | High | Add `server_side_encryption_configuration` block |\n   | S3 bucket with public access | High | Add `aws_s3_bucket_public_access_block` |\n   | RDS without encryption | High | Set `storage_encrypted = true` |\n   | RDS publicly accessible | High | Set `publicly_accessible = false` |\n   | CloudTrail not enabled | Medium | Add `aws_cloudtrail` resource |\n   | Missing `prevent_destroy` on stateful resources | Medium | Add `lifecycle { prevent_destroy = true }` |\n   | Variables without `sensitive = true` for secrets | Medium | Add `sensitive = true` to secret variables |\n\n2. **State security audit**\n\n   | Check | Severity | Fix |\n   |-------|----------|-----|\n   | Local state file | Critical | Migrate to remote backend with encryption |\n   | Remote state without encryption | High | Enable encryption on backend (SSE-S3, KMS) |\n   | No state locking | High | Enable DynamoDB for S3, native for TF Cloud |\n   | State accessible to all team members | Medium | Restrict via IAM policies or TF Cloud teams |\n\n3. **Generate security report**\n   ```bash\n   python3 scripts\u002Ftf_security_scanner.py .\u002Fterraform\n   python3 scripts\u002Ftf_security_scanner.py .\u002Fterraform --output json\n   ```\n\n---\n\n## Tooling\n\n### `scripts\u002Ftf_module_analyzer.py`\n\nCLI utility for analyzing Terraform directory structure and module quality.\n\n**Features:**\n- Resource and data source counting\n- Variable and output analysis (missing descriptions, types, validation)\n- Naming convention checks\n- Module composition detection\n- File structure validation\n- JSON and text output\n\n**Usage:**\n```bash\n# Analyze a Terraform directory\npython3 scripts\u002Ftf_module_analyzer.py .\u002Fterraform\n\n# JSON output\npython3 scripts\u002Ftf_module_analyzer.py .\u002Fterraform --output json\n\n# Analyze a specific module\npython3 scripts\u002Ftf_module_analyzer.py .\u002Fmodules\u002Fvpc\n```\n\n### `scripts\u002Ftf_security_scanner.py`\n\nCLI utility for scanning `.tf` files for common security issues.\n\n**Features:**\n- Hardcoded secret detection (AWS keys, passwords, tokens)\n- Overly permissive IAM policy detection\n- Open security group detection (0.0.0.0\u002F0 on sensitive ports)\n- Missing encryption checks (S3, RDS, EBS)\n- Public access detection (S3, RDS, EC2)\n- Sensitive variable audit\n- JSON and text output\n\n**Usage:**\n```bash\n# Scan a Terraform directory\npython3 scripts\u002Ftf_security_scanner.py .\u002Fterraform\n\n# JSON output\npython3 scripts\u002Ftf_security_scanner.py .\u002Fterraform --output json\n\n# Strict mode (elevate warnings)\npython3 scripts\u002Ftf_security_scanner.py .\u002Fterraform --strict\n```\n\n---\n\n## Module Design Patterns\n\n### Pattern 1: Flat Module (Small\u002FMedium Projects)\n\n```\ninfrastructure\u002F\n├── main.tf          # All resources\n├── variables.tf     # All inputs\n├── outputs.tf       # All outputs\n├── versions.tf      # Provider requirements\n├── terraform.tfvars # Environment values (not committed)\n└── backend.tf       # Remote state configuration\n```\n\nBest for: Single application, \u003C 20 resources, one team owns everything.\n\n### Pattern 2: Nested Modules (Medium\u002FLarge Projects)\n\n```\ninfrastructure\u002F\n├── environments\u002F\n│   ├── dev\u002F\n│   │   ├── main.tf          # Calls modules with dev params\n│   │   ├── backend.tf       # Dev state backend\n│   │   └── terraform.tfvars\n│   ├── staging\u002F\n│   │   └── ...\n│   └── prod\u002F\n│       └── ...\n├── modules\u002F\n│   ├── networking\u002F\n│   │   ├── main.tf\n│   │   ├── variables.tf\n│   │   └── outputs.tf\n│   ├── compute\u002F\n│   │   └── ...\n│   └── database\u002F\n│       └── ...\n└── versions.tf\n```\n\nBest for: Multiple environments, shared infrastructure patterns, team collaboration.\n\n### Pattern 3: Mono-Repo with Terragrunt\n\n```\ninfrastructure\u002F\n├── terragrunt.hcl           # Root config\n├── modules\u002F                  # Reusable modules\n│   ├── vpc\u002F\n│   ├── eks\u002F\n│   └── rds\u002F\n├── dev\u002F\n│   ├── terragrunt.hcl       # Dev overrides\n│   ├── vpc\u002F\n│   │   └── terragrunt.hcl   # Module invocation\n│   └── eks\u002F\n│       └── terragrunt.hcl\n└── prod\u002F\n    ├── terragrunt.hcl\n    └── ...\n```\n\nBest for: Large-scale, many environments, DRY configuration, team-level isolation.\n\n---\n\n## Provider Configuration Patterns\n\n### Version Pinning\n```hcl\nterraform {\n  required_version = \">= 1.5.0\"\n\n  required_providers {\n    aws = {\n      source  = \"hashicorp\u002Faws\"\n      version = \"~> 5.0\"    # Allow 5.x, block 6.0\n    }\n    random = {\n      source  = \"hashicorp\u002Frandom\"\n      version = \"~> 3.5\"\n    }\n  }\n}\n```\n\n### Multi-Region with Aliases\n```hcl\nprovider \"aws\" {\n  region = \"us-east-1\"\n}\n\nprovider \"aws\" {\n  alias  = \"west\"\n  region = \"us-west-2\"\n}\n\nresource \"aws_s3_bucket\" \"primary\" {\n  bucket = \"my-app-primary\"\n}\n\nresource \"aws_s3_bucket\" \"replica\" {\n  provider = aws.west\n  bucket   = \"my-app-replica\"\n}\n```\n\n### Multi-Account with Assume Role\n```hcl\nprovider \"aws\" {\n  alias  = \"production\"\n  region = \"us-east-1\"\n\n  assume_role {\n    role_arn = \"arn:aws:iam::PROD_ACCOUNT_ID:role\u002FTerraformRole\"\n  }\n}\n```\n\n---\n\n## State Management Decision Tree\n\n```\nSingle developer, small project?\n├── Yes → Local state (but migrate to remote ASAP)\n└── No\n    ├── Using Terraform Cloud\u002FEnterprise?\n    │   └── Yes → TF Cloud native backend (built-in locking, encryption, RBAC)\n    └── No\n        ├── AWS?\n        │   └── S3 + DynamoDB (encryption, locking, versioning)\n        ├── GCP?\n        │   └── GCS bucket (native locking, encryption)\n        ├── Azure?\n        │   └── Azure Blob Storage (native locking, encryption)\n        └── Other?\n            └── Consul or PostgreSQL backend\n\nEnvironment isolation strategy:\n├── Separate state files per environment (recommended)\n│   ├── Option A: Separate directories (dev\u002F, staging\u002F, prod\u002F)\n│   └── Option B: Terraform workspaces (simpler but less isolation)\n└── Single state file for all environments (never do this)\n```\n\n---\n\n## CI\u002FCD Integration Patterns\n\n### GitHub Actions Plan\u002FApply\n\n```yaml\n# .github\u002Fworkflows\u002Fterraform.yml\nname: Terraform\non:\n  pull_request:\n    paths: ['terraform\u002F**']\n  push:\n    branches: [main]\n    paths: ['terraform\u002F**']\n\njobs:\n  plan:\n    runs-on: ubuntu-latest\n    if: github.event_name == 'pull_request'\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: hashicorp\u002Fsetup-terraform@v3\n      - run: terraform init\n      - run: terraform validate\n      - run: terraform plan -out=tfplan\n      - run: terraform show -json tfplan > plan.json\n      # Post plan as PR comment\n\n  apply:\n    runs-on: ubuntu-latest\n    if: github.ref == 'refs\u002Fheads\u002Fmain' && github.event_name == 'push'\n    environment: production\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: hashicorp\u002Fsetup-terraform@v3\n      - run: terraform init\n      - run: terraform apply -auto-approve\n```\n\n### Drift Detection\n\n```yaml\n# Run on schedule to detect drift\nname: Drift Detection\non:\n  schedule:\n    - cron: '0 6 * * 1-5'  # Weekdays at 6 AM\n\njobs:\n  detect:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: hashicorp\u002Fsetup-terraform@v3\n      - run: terraform init\n      - run: |\n          terraform plan -detailed-exitcode -out=drift.tfplan 2>&1 | tee drift.log\n          EXIT_CODE=$?\n          if [ $EXIT_CODE -eq 2 ]; then\n            echo \"DRIFT DETECTED — review drift.log\"\n            # Send alert (Slack, PagerDuty, etc.)\n          fi\n```\n\n---\n\n## Proactive Triggers\n\nFlag these without being asked:\n\n- **No remote backend configured** → Migrate to S3\u002FGCS\u002FAzure Blob with locking and encryption.\n- **Provider without version constraint** → Add `version = \"~> X.0\"` to prevent breaking upgrades.\n- **Hardcoded secrets in .tf files** → Use variables with `sensitive = true`, or integrate Vault\u002FSSM.\n- **IAM policy with `\"Action\": \"*\"`** → Scope to specific actions. No wildcard actions in production.\n- **Security group open to 0.0.0.0\u002F0 on SSH\u002FRDP** → Restrict to bastion CIDR or use SSM Session Manager.\n- **No state locking** → Enable DynamoDB table for S3 backend, or use TF Cloud.\n- **Resources without tags** → Add default_tags in provider block. Tags are mandatory for cost tracking.\n- **Missing `prevent_destroy` on databases\u002Fstorage** → Add lifecycle block to prevent accidental deletion.\n\n---\n\n## Multi-Cloud Provider Configuration\n\nWhen a single root module must provision across AWS, Azure, and GCP simultaneously.\n\n### Provider Aliasing Pattern\n\n```hcl\nterraform {\n  required_providers {\n    aws = {\n      source  = \"hashicorp\u002Faws\"\n      version = \"~> 5.0\"\n    }\n    azurerm = {\n      source  = \"hashicorp\u002Fazurerm\"\n      version = \"~> 3.0\"\n    }\n    google = {\n      source  = \"hashicorp\u002Fgoogle\"\n      version = \"~> 5.0\"\n    }\n  }\n}\n\nprovider \"aws\" {\n  region = var.aws_region\n}\n\nprovider \"azurerm\" {\n  features {}\n  subscription_id = var.azure_subscription_id\n}\n\nprovider \"google\" {\n  project = var.gcp_project_id\n  region  = var.gcp_region\n}\n```\n\n### Shared Variables Across Providers\n\n```hcl\nvariable \"environment\" {\n  description = \"Environment name used across all providers\"\n  type        = string\n  validation {\n    condition     = contains([\"dev\", \"staging\", \"prod\"], var.environment)\n    error_message = \"Must be dev, staging, or prod.\"\n  }\n}\n\nlocals {\n  common_tags = {\n    environment = var.environment\n    managed_by  = \"terraform\"\n    project     = var.project_name\n  }\n}\n```\n\n### When to Use Multi-Cloud\n\n- **Yes**: Regulatory requirements mandate data residency across providers, or the org has existing workloads on multiple clouds.\n- **No**: \"Avoiding vendor lock-in\" alone is not sufficient justification. Multi-cloud doubles operational complexity. Prefer single-cloud unless there is a concrete business requirement.\n\n---\n\n## OpenTofu Compatibility\n\nOpenTofu is an open-source fork of Terraform maintained by the Linux Foundation under the MPL 2.0 license.\n\n### Migration from Terraform to OpenTofu\n\n```bash\n# 1. Install OpenTofu\nbrew install opentofu        # macOS\nsnap install --classic tofu  # Linux\n\n# 2. Replace the binary — state files are compatible\ntofu init                    # Re-initializes with OpenTofu\ntofu plan                    # Identical plan output\ntofu apply                   # Same apply workflow\n```\n\n### License Considerations\n\n| | Terraform (1.6+) | OpenTofu |\n|---|---|---|\n| **License** | BSL 1.1 (source-available) | MPL 2.0 (open-source) |\n| **Commercial use** | Restricted for competing products | Unrestricted |\n| **Community governance** | HashiCorp | Linux Foundation |\n\n### Feature Parity\n\nOpenTofu tracks Terraform 1.6.x features. Key additions unique to OpenTofu:\n- Client-side state encryption (`tofu init -encryption`)\n- Early variable\u002Flocals evaluation\n- Provider-defined functions\n\n### When to Choose OpenTofu\n\n- You need a fully open-source license for your supply chain.\n- You want client-side state encryption without Terraform Cloud.\n- Otherwise, either tool works — the HCL syntax and provider ecosystem are identical.\n\n---\n\n## Infracost Integration\n\nInfracost estimates cloud costs from Terraform code before resources are provisioned.\n\n### PR Workflow\n\n```bash\n# Show cost breakdown for current code\ninfracost breakdown --path .\n\n# Compare cost difference between current branch and main\ninfracost diff --path . --compare-to infracost-base.json\n```\n\n### GitHub Actions Cost Comment\n\n```yaml\n# .github\u002Fworkflows\u002Finfracost.yml\nname: Infracost\non: [pull_request]\n\njobs:\n  cost:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: infracost\u002Factions\u002Fsetup@v3\n        with:\n          api-key: ${{ secrets.INFRACOST_API_KEY }}\n      - run: infracost breakdown --path .\u002Fterraform --format json --out-file \u002Ftmp\u002Finfracost.json\n      - run: infracost comment github --path \u002Ftmp\u002Finfracost.json --repo $GITHUB_REPOSITORY --pull-request ${{ github.event.pull_request.number }} --github-token ${{ secrets.GITHUB_TOKEN }} --behavior update\n```\n\n### Budget Thresholds and Cost Policy\n\n```yaml\n# infracost.yml — policy file\nversion: 2.9.0\npolicies:\n  - path: \"*\"\n    max_monthly_cost: \"5000\"    # Fail PR if estimated cost exceeds $5,000\u002Fmonth\n    max_cost_increase: \"500\"    # Fail PR if cost increase exceeds $500\u002Fmonth\n```\n\n---\n\n## Import Existing Infrastructure\n\nBring manually-created resources under Terraform management.\n\n### terraform import Workflow\n\n```bash\n# 1. Write the resource block first (empty body is fine)\n# main.tf:\n# resource \"aws_s3_bucket\" \"legacy\" {}\n\n# 2. Import the resource into state\nterraform import aws_s3_bucket.legacy my-existing-bucket-name\n\n# 3. Run plan to see attribute diff\nterraform plan\n\n# 4. Fill in the resource block until plan shows no changes\n```\n\n### Bulk Import with Config Generation (Terraform 1.5+)\n\n```bash\n# Generate HCL for imported resources\nterraform plan -generate-config-out=generated.tf\n\n# Review generated.tf, then move resources into proper files\n```\n\n### Common Pitfalls\n\n- **Resource drift after import**: The imported resource may have attributes Terraform does not manage. Run `terraform plan` immediately and resolve every diff.\n- **State manipulation**: Use `terraform state mv` to rename or reorganize. Use `terraform state rm` to remove without destroying. Always back up state before manipulation: `terraform state pull > backup.tfstate`.\n- **Sensitive defaults**: Imported resources may expose secrets in state. Restrict state access and enable encryption.\n\n---\n\n## Terragrunt Patterns\n\nTerragrunt is a thin wrapper around Terraform that provides DRY configuration for multi-environment setups.\n\n### Root terragrunt.hcl (Shared Config)\n\n```hcl\n# terragrunt.hcl (root)\nremote_state {\n  backend = \"s3\"\n  generate = {\n    path      = \"backend.tf\"\n    if_exists = \"overwrite_terragrunt\"\n  }\n  config = {\n    bucket         = \"my-org-terraform-state\"\n    key            = \"${path_relative_to_include()}\u002Fterraform.tfstate\"\n    region         = \"us-east-1\"\n    encrypt        = true\n    dynamodb_table = \"terraform-locks\"\n  }\n}\n```\n\n### Child terragrunt.hcl (Environment Override)\n\n```hcl\n# prod\u002Fvpc\u002Fterragrunt.hcl\ninclude \"root\" {\n  path = find_in_parent_folders()\n}\n\nterraform {\n  source = \"..\u002F..\u002Fmodules\u002Fvpc\"\n}\n\ninputs = {\n  environment = \"prod\"\n  cidr_block  = \"10.0.0.0\u002F16\"\n}\n```\n\n### Dependencies Between Modules\n\n```hcl\n# prod\u002Feks\u002Fterragrunt.hcl\ndependency \"vpc\" {\n  config_path = \"..\u002Fvpc\"\n}\n\ninputs = {\n  vpc_id     = dependency.vpc.outputs.vpc_id\n  subnet_ids = dependency.vpc.outputs.private_subnet_ids\n}\n```\n\n### When Terragrunt Adds Value\n\n- **Yes**: 3+ environments with identical module structure, shared backend config, or cross-module dependencies.\n- **No**: Single environment, small team, or simple directory-based isolation already works. Terragrunt adds a learning curve and another binary to manage.\n\n---\n\n## Installation\n\n### One-liner (any tool)\n```bash\ngit clone https:\u002F\u002Fgithub.com\u002Falirezarezvani\u002Fclaude-skills.git\ncp -r claude-skills\u002Fengineering\u002Fterraform-patterns ~\u002F.claude\u002Fskills\u002F\n```\n\n### Multi-tool install\n```bash\n.\u002Fscripts\u002Fconvert.sh --skill terraform-patterns --tool codex|gemini|cursor|windsurf|openclaw\n```\n\n### OpenClaw\n```bash\nclawhub install terraform-patterns\n```\n\n---\n\n## Related Skills\n\n- **senior-devops** — Broader DevOps scope (CI\u002FCD, monitoring, containerization). Complementary — use terraform-patterns for IaC-specific work, senior-devops for pipeline and infrastructure operations.\n- **aws-solution-architect** — AWS architecture design. Complementary — terraform-patterns implements the infrastructure, aws-solution-architect designs it.\n- **senior-security** — Application security. Complementary — terraform-patterns covers infrastructure security posture, senior-security covers application-level threats.\n- **ci-cd-pipeline-builder** — Pipeline construction. Complementary — terraform-patterns defines infrastructure, ci-cd-pipeline-builder automates deployment.\n","# Terraform Patterns\n\n> Predictable infrastructure. Secure state. Modules that compose. No drift.\n\nOpinionated Terraform workflow that turns sprawling HCL into well-structured, secure, production-grade infrastructure code. Covers module design, state management, provider patterns, security hardening, and CI\u002FCD integration.\n\nNot a Terraform tutorial — a set of concrete decisions about how to write infrastructure code that doesn't break at 3 AM.\n\n---\n\n## Slash Commands\n\n| Command | What it does |\n|---------|-------------|\n| `\u002Fterraform:review` | Analyze Terraform code for anti-patterns, security issues, and structure problems |\n| `\u002Fterraform:module` | Design or refactor a Terraform module with proper inputs, outputs, and composition |\n| `\u002Fterraform:security` | Audit Terraform code for security vulnerabilities, secrets exposure, and IAM misconfigurations |\n\n---\n\n## When This Skill Activates\n\nRecognize these patterns from the user:\n\n- \"Review this Terraform code\"\n- \"Design a Terraform module for...\"\n- \"My Terraform state is...\"\n- \"Set up remote state backend\"\n- \"Multi-region Terraform deployment\"\n- \"Terraform security review\"\n- \"Module structure best practices\"\n- \"Terraform CI\u002FCD pipeline\"\n- Any request involving: `.tf` files, HCL, Terraform modules, state management, provider configuration, infrastructure-as-code\n\nIf the user has `.tf` files or wants to provision infrastructure with Terraform → this skill applies.\n\n---\n\n## Workflow\n\n### `\u002Fterraform:review` — Terraform Code Review\n\n1. **Analyze current state**\n   - Read all `.tf` files in the target directory\n   - Identify module structure (flat vs nested)\n   - Count resources, data sources, variables, outputs\n   - Check naming conventions\n\n2. **Apply review checklist**\n\n   ```\n   MODULE STRUCTURE\n   ├── Variables have descriptions and type constraints\n   ├── Outputs expose only what consumers need\n   ├── Resources use consistent naming: {provider}_{type}_{purpose}\n   ├── Locals used for computed values and DRY expressions\n   └── No hardcoded values — everything parameterized or in locals\n\n   STATE & BACKEND\n   ├── Remote backend configured (S3, GCS, Azure Blob, Terraform Cloud)\n   ├── State locking enabled (DynamoDB for S3, native for others)\n   ├── State encryption at rest enabled\n   ├── No secrets stored in state (or state access is restricted)\n   └── Workspaces or directory isolation for environments\n\n   PROVIDERS\n   ├── Version constraints use pessimistic operator: ~> 5.0\n   ├── Required providers block in terraform {} block\n   ├── Provider aliases for multi-region or multi-account\n   └── No provider configuration in child modules\n\n   SECURITY\n   ├── No hardcoded secrets, keys, or passwords\n   ├── IAM follows least-privilege principle\n   ├── Encryption enabled for storage, databases, secrets\n   ├── Security groups are not overly permissive (no 0.0.0.0\u002F0 ingress on sensitive ports)\n   └── Sensitive variables marked with sensitive = true\n   ```\n\n3. **Generate report**\n   ```bash\n   python3 scripts\u002Ftf_module_analyzer.py .\u002Fterraform\n   ```\n\n4. **Run security scan**\n   ```bash\n   python3 scripts\u002Ftf_security_scanner.py .\u002Fterraform\n   ```\n\n### `\u002Fterraform:module` — Module Design\n\n1. **Identify module scope**\n   - Single responsibility: one module = one logical grouping\n   - Determine inputs (variables), outputs, and resource boundaries\n   - Decide: flat module (single directory) vs nested (calling child modules)\n\n2. **Apply module design checklist**\n\n   ```\n   STRUCTURE\n   ├── main.tf        — Primary resources\n   ├── variables.tf   — All input variables with descriptions and types\n   ├── outputs.tf     — All outputs with descriptions\n   ├── versions.tf    — terraform {} block with required_providers\n   ├── locals.tf      — Computed values and naming conventions\n   ├── data.tf        — Data sources (if any)\n   └── README.md      — Usage examples and variable documentation\n\n   VARIABLES\n   ├── Every variable has: description, type, validation (where applicable)\n   ├── Sensitive values marked: sensitive = true\n   ├── Defaults provided for optional settings\n   ├── Use object types for related settings: variable \"config\" { type = object({...}) }\n   └── Validate with: validation { condition = ... }\n\n   OUTPUTS\n   ├── Output IDs, ARNs, endpoints — things consumers need\n   ├── Include description on every output\n   ├── Mark sensitive outputs: sensitive = true\n   └── Don't output entire resources — only specific attributes\n\n   COMPOSITION\n   ├── Root module calls child modules\n   ├── Child modules never call other child modules\n   ├── Pass values explicitly — no hidden data source lookups in child modules\n   ├── Provider configuration only in root module\n   └── Use module \"name\" { source = \".\u002Fmodules\u002Fname\" }\n   ```\n\n3. **Generate module scaffold**\n   - Output file structure with boilerplate\n   - Include variable validation blocks\n   - Add lifecycle rules where appropriate\n\n### `\u002Fterraform:security` — Security Audit\n\n1. **Code-level audit**\n\n   | Check | Severity | Fix |\n   |-------|----------|-----|\n   | Hardcoded secrets in `.tf` files | Critical | Use variables with sensitive = true or vault |\n   | IAM policy with `*` actions | Critical | Scope to specific actions and resources |\n   | Security group with 0.0.0.0\u002F0 on port 22\u002F3389 | Critical | Restrict to known CIDR blocks or use SSM\u002Fbastion |\n   | S3 bucket without encryption | High | Add `server_side_encryption_configuration` block |\n   | S3 bucket with public access | High | Add `aws_s3_bucket_public_access_block` |\n   | RDS without encryption | High | Set `storage_encrypted = true` |\n   | RDS publicly accessible | High | Set `publicly_accessible = false` |\n   | CloudTrail not enabled | Medium | Add `aws_cloudtrail` resource |\n   | Missing `prevent_destroy` on stateful resources | Medium | Add `lifecycle { prevent_destroy = true }` |\n   | Variables without `sensitive = true` for secrets | Medium | Add `sensitive = true` to secret variables |\n\n2. **State security audit**\n\n   | Check | Severity | Fix |\n   |-------|----------|-----|\n   | Local state file | Critical | Migrate to remote backend with encryption |\n   | Remote state without encryption | High | Enable encryption on backend (SSE-S3, KMS) |\n   | No state locking | High | Enable DynamoDB for S3, native for TF Cloud |\n   | State accessible to all team members | Medium | Restrict via IAM policies or TF Cloud teams |\n\n3. **Generate security report**\n   ```bash\n   python3 scripts\u002Ftf_security_scanner.py .\u002Fterraform\n   python3 scripts\u002Ftf_security_scanner.py .\u002Fterraform --output json\n   ```\n\n---\n\n## Tooling\n\n### `scripts\u002Ftf_module_analyzer.py`\n\nCLI utility for analyzing Terraform directory structure and module quality.\n\n**Features:**\n- Resource and data source counting\n- Variable and output analysis (missing descriptions, types, validation)\n- Naming convention checks\n- Module composition detection\n- File structure validation\n- JSON and text output\n\n**Usage:**\n```bash\n# Analyze a Terraform directory\npython3 scripts\u002Ftf_module_analyzer.py .\u002Fterraform\n\n# JSON output\npython3 scripts\u002Ftf_module_analyzer.py .\u002Fterraform --output json\n\n# Analyze a specific module\npython3 scripts\u002Ftf_module_analyzer.py .\u002Fmodules\u002Fvpc\n```\n\n### `scripts\u002Ftf_security_scanner.py`\n\nCLI utility for scanning `.tf` files for common security issues.\n\n**Features:**\n- Hardcoded secret detection (AWS keys, passwords, tokens)\n- Overly permissive IAM policy detection\n- Open security group detection (0.0.0.0\u002F0 on sensitive ports)\n- Missing encryption checks (S3, RDS, EBS)\n- Public access detection (S3, RDS, EC2)\n- Sensitive variable audit\n- JSON and text output\n\n**Usage:**\n```bash\n# Scan a Terraform directory\npython3 scripts\u002Ftf_security_scanner.py .\u002Fterraform\n\n# JSON output\npython3 scripts\u002Ftf_security_scanner.py .\u002Fterraform --output json\n\n# Strict mode (elevate warnings)\npython3 scripts\u002Ftf_security_scanner.py .\u002Fterraform --strict\n```\n\n---\n\n## Module Design Patterns\n\n### Pattern 1: Flat Module (Small\u002FMedium Projects)\n\n```\ninfrastructure\u002F\n├── main.tf          # All resources\n├── variables.tf     # All inputs\n├── outputs.tf       # All outputs\n├── versions.tf      # Provider requirements\n├── terraform.tfvars # Environment values (not committed)\n└── backend.tf       # Remote state configuration\n```\n\nBest for: Single application, \u003C 20 resources, one team owns everything.\n\n### Pattern 2: Nested Modules (Medium\u002FLarge Projects)\n\n```\ninfrastructure\u002F\n├── environments\u002F\n│   ├── dev\u002F\n│   │   ├── main.tf          # Calls modules with dev params\n│   │   ├── backend.tf       # Dev state backend\n│   │   └── terraform.tfvars\n│   ├── staging\u002F\n│   │   └── ...\n│   └── prod\u002F\n│       └── ...\n├── modules\u002F\n│   ├── networking\u002F\n│   │   ├── main.tf\n│   │   ├── variables.tf\n│   │   └── outputs.tf\n│   ├── compute\u002F\n│   │   └── ...\n│   └── database\u002F\n│       └── ...\n└── versions.tf\n```\n\nBest for: Multiple environments, shared infrastructure patterns, team collaboration.\n\n### Pattern 3: Mono-Repo with Terragrunt\n\n```\ninfrastructure\u002F\n├── terragrunt.hcl           # Root config\n├── modules\u002F                  # Reusable modules\n│   ├── vpc\u002F\n│   ├── eks\u002F\n│   └── rds\u002F\n├── dev\u002F\n│   ├── terragrunt.hcl       # Dev overrides\n│   ├── vpc\u002F\n│   │   └── terragrunt.hcl   # Module invocation\n│   └── eks\u002F\n│       └── terragrunt.hcl\n└── prod\u002F\n    ├── terragrunt.hcl\n    └── ...\n```\n\nBest for: Large-scale, many environments, DRY configuration, team-level isolation.\n\n---\n\n## Provider Configuration Patterns\n\n### Version Pinning\n```hcl\nterraform {\n  required_version = \">= 1.5.0\"\n\n  required_providers {\n    aws = {\n      source  = \"hashicorp\u002Faws\"\n      version = \"~> 5.0\"    # Allow 5.x, block 6.0\n    }\n    random = {\n      source  = \"hashicorp\u002Frandom\"\n      version = \"~> 3.5\"\n    }\n  }\n}\n```\n\n### Multi-Region with Aliases\n```hcl\nprovider \"aws\" {\n  region = \"us-east-1\"\n}\n\nprovider \"aws\" {\n  alias  = \"west\"\n  region = \"us-west-2\"\n}\n\nresource \"aws_s3_bucket\" \"primary\" {\n  bucket = \"my-app-primary\"\n}\n\nresource \"aws_s3_bucket\" \"replica\" {\n  provider = aws.west\n  bucket   = \"my-app-replica\"\n}\n```\n\n### Multi-Account with Assume Role\n```hcl\nprovider \"aws\" {\n  alias  = \"production\"\n  region = \"us-east-1\"\n\n  assume_role {\n    role_arn = \"arn:aws:iam::PROD_ACCOUNT_ID:role\u002FTerraformRole\"\n  }\n}\n```\n\n---\n\n## State Management Decision Tree\n\n```\nSingle developer, small project?\n├── Yes → Local state (but migrate to remote ASAP)\n└── No\n    ├── Using Terraform Cloud\u002FEnterprise?\n    │   └── Yes → TF Cloud native backend (built-in locking, encryption, RBAC)\n    └── No\n        ├── AWS?\n        │   └── S3 + DynamoDB (encryption, locking, versioning)\n        ├── GCP?\n        │   └── GCS bucket (native locking, encryption)\n        ├── Azure?\n        │   └── Azure Blob Storage (native locking, encryption)\n        └── Other?\n            └── Consul or PostgreSQL backend\n\nEnvironment isolation strategy:\n├── Separate state files per environment (recommended)\n│   ├── Option A: Separate directories (dev\u002F, staging\u002F, prod\u002F)\n│   └── Option B: Terraform workspaces (simpler but less isolation)\n└── Single state file for all environments (never do this)\n```\n\n---\n\n## CI\u002FCD Integration Patterns\n\n### GitHub Actions Plan\u002FApply\n\n```yaml\n# .github\u002Fworkflows\u002Fterraform.yml\nname: Terraform\non:\n  pull_request:\n    paths: ['terraform\u002F**']\n  push:\n    branches: [main]\n    paths: ['terraform\u002F**']\n\njobs:\n  plan:\n    runs-on: ubuntu-latest\n    if: github.event_name == 'pull_request'\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: hashicorp\u002Fsetup-terraform@v3\n      - run: terraform init\n      - run: terraform validate\n      - run: terraform plan -out=tfplan\n      - run: terraform show -json tfplan > plan.json\n      # Post plan as PR comment\n\n  apply:\n    runs-on: ubuntu-latest\n    if: github.ref == 'refs\u002Fheads\u002Fmain' && github.event_name == 'push'\n    environment: production\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: hashicorp\u002Fsetup-terraform@v3\n      - run: terraform init\n      - run: terraform apply -auto-approve\n```\n\n### Drift Detection\n\n```yaml\n# Run on schedule to detect drift\nname: Drift Detection\non:\n  schedule:\n    - cron: '0 6 * * 1-5'  # Weekdays at 6 AM\n\njobs:\n  detect:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: hashicorp\u002Fsetup-terraform@v3\n      - run: terraform init\n      - run: |\n          terraform plan -detailed-exitcode -out=drift.tfplan 2>&1 | tee drift.log\n          EXIT_CODE=$?\n          if [ $EXIT_CODE -eq 2 ]; then\n            echo \"DRIFT DETECTED — review drift.log\"\n            # Send alert (Slack, PagerDuty, etc.)\n          fi\n```\n\n---\n\n## Proactive Triggers\n\nFlag these without being asked:\n\n- **No remote backend configured** → Migrate to S3\u002FGCS\u002FAzure Blob with locking and encryption.\n- **Provider without version constraint** → Add `version = \"~> X.0\"` to prevent breaking upgrades.\n- **Hardcoded secrets in .tf files** → Use variables with `sensitive = true`, or integrate Vault\u002FSSM.\n- **IAM policy with `\"Action\": \"*\"`** → Scope to specific actions. No wildcard actions in production.\n- **Security group open to 0.0.0.0\u002F0 on SSH\u002FRDP** → Restrict to bastion CIDR or use SSM Session Manager.\n- **No state locking** → Enable DynamoDB table for S3 backend, or use TF Cloud.\n- **Resources without tags** → Add default_tags in provider block. Tags are mandatory for cost tracking.\n- **Missing `prevent_destroy` on databases\u002Fstorage** → Add lifecycle block to prevent accidental deletion.\n\n---\n\n## Multi-Cloud Provider Configuration\n\nWhen a single root module must provision across AWS, Azure, and GCP simultaneously.\n\n### Provider Aliasing Pattern\n\n```hcl\nterraform {\n  required_providers {\n    aws = {\n      source  = \"hashicorp\u002Faws\"\n      version = \"~> 5.0\"\n    }\n    azurerm = {\n      source  = \"hashicorp\u002Fazurerm\"\n      version = \"~> 3.0\"\n    }\n    google = {\n      source  = \"hashicorp\u002Fgoogle\"\n      version = \"~> 5.0\"\n    }\n  }\n}\n\nprovider \"aws\" {\n  region = var.aws_region\n}\n\nprovider \"azurerm\" {\n  features {}\n  subscription_id = var.azure_subscription_id\n}\n\nprovider \"google\" {\n  project = var.gcp_project_id\n  region  = var.gcp_region\n}\n```\n\n### Shared Variables Across Providers\n\n```hcl\nvariable \"environment\" {\n  description = \"Environment name used across all providers\"\n  type        = string\n  validation {\n    condition     = contains([\"dev\", \"staging\", \"prod\"], var.environment)\n    error_message = \"Must be dev, staging, or prod.\"\n  }\n}\n\nlocals {\n  common_tags = {\n    environment = var.environment\n    managed_by  = \"terraform\"\n    project     = var.project_name\n  }\n}\n```\n\n### When to Use Multi-Cloud\n\n- **Yes**: Regulatory requirements mandate data residency across providers, or the org has existing workloads on multiple clouds.\n- **No**: \"Avoiding vendor lock-in\" alone is not sufficient justification. Multi-cloud doubles operational complexity. Prefer single-cloud unless there is a concrete business requirement.\n\n---\n\n## OpenTofu Compatibility\n\nOpenTofu is an open-source fork of Terraform maintained by the Linux Foundation under the MPL 2.0 license.\n\n### Migration from Terraform to OpenTofu\n\n```bash\n# 1. Install OpenTofu\nbrew install opentofu        # macOS\nsnap install --classic tofu  # Linux\n\n# 2. Replace the binary — state files are compatible\ntofu init                    # Re-initializes with OpenTofu\ntofu plan                    # Identical plan output\ntofu apply                   # Same apply workflow\n```\n\n### License Considerations\n\n| | Terraform (1.6+) | OpenTofu |\n|---|---|---|\n| **License** | BSL 1.1 (source-available) | MPL 2.0 (open-source) |\n| **Commercial use** | Restricted for competing products | Unrestricted |\n| **Community governance** | HashiCorp | Linux Foundation |\n\n### Feature Parity\n\nOpenTofu tracks Terraform 1.6.x features. Key additions unique to OpenTofu:\n- Client-side state encryption (`tofu init -encryption`)\n- Early variable\u002Flocals evaluation\n- Provider-defined functions\n\n### When to Choose OpenTofu\n\n- You need a fully open-source license for your supply chain.\n- You want client-side state encryption without Terraform Cloud.\n- Otherwise, either tool works — the HCL syntax and provider ecosystem are identical.\n\n---\n\n## Infracost Integration\n\nInfracost estimates cloud costs from Terraform code before resources are provisioned.\n\n### PR Workflow\n\n```bash\n# Show cost breakdown for current code\ninfracost breakdown --path .\n\n# Compare cost difference between current branch and main\ninfracost diff --path . --compare-to infracost-base.json\n```\n\n### GitHub Actions Cost Comment\n\n```yaml\n# .github\u002Fworkflows\u002Finfracost.yml\nname: Infracost\non: [pull_request]\n\njobs:\n  cost:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: infracost\u002Factions\u002Fsetup@v3\n        with:\n          api-key: ${{ secrets.INFRACOST_API_KEY }}\n      - run: infracost breakdown --path .\u002Fterraform --format json --out-file \u002Ftmp\u002Finfracost.json\n      - run: infracost comment github --path \u002Ftmp\u002Finfracost.json --repo $GITHUB_REPOSITORY --pull-request ${{ github.event.pull_request.number }} --github-token ${{ secrets.GITHUB_TOKEN }} --behavior update\n```\n\n### Budget Thresholds and Cost Policy\n\n```yaml\n# infracost.yml — policy file\nversion: 2.9.0\npolicies:\n  - path: \"*\"\n    max_monthly_cost: \"5000\"    # Fail PR if estimated cost exceeds $5,000\u002Fmonth\n    max_cost_increase: \"500\"    # Fail PR if cost increase exceeds $500\u002Fmonth\n```\n\n---\n\n## Import Existing Infrastructure\n\nBring manually-created resources under Terraform management.\n\n### terraform import Workflow\n\n```bash\n# 1. Write the resource block first (empty body is fine)\n# main.tf:\n# resource \"aws_s3_bucket\" \"legacy\" {}\n\n# 2. Import the resource into state\nterraform import aws_s3_bucket.legacy my-existing-bucket-name\n\n# 3. Run plan to see attribute diff\nterraform plan\n\n# 4. Fill in the resource block until plan shows no changes\n```\n\n### Bulk Import with Config Generation (Terraform 1.5+)\n\n```bash\n# Generate HCL for imported resources\nterraform plan -generate-config-out=generated.tf\n\n# Review generated.tf, then move resources into proper files\n```\n\n### Common Pitfalls\n\n- **Resource drift after import**: The imported resource may have attributes Terraform does not manage. Run `terraform plan` immediately and resolve every diff.\n- **State manipulation**: Use `terraform state mv` to rename or reorganize. Use `terraform state rm` to remove without destroying. Always back up state before manipulation: `terraform state pull > backup.tfstate`.\n- **Sensitive defaults**: Imported resources may expose secrets in state. Restrict state access and enable encryption.\n\n---\n\n## Terragrunt Patterns\n\nTerragrunt is a thin wrapper around Terraform that provides DRY configuration for multi-environment setups.\n\n### Root terragrunt.hcl (Shared Config)\n\n```hcl\n# terragrunt.hcl (root)\nremote_state {\n  backend = \"s3\"\n  generate = {\n    path      = \"backend.tf\"\n    if_exists = \"overwrite_terragrunt\"\n  }\n  config = {\n    bucket         = \"my-org-terraform-state\"\n    key            = \"${path_relative_to_include()}\u002Fterraform.tfstate\"\n    region         = \"us-east-1\"\n    encrypt        = true\n    dynamodb_table = \"terraform-locks\"\n  }\n}\n```\n\n### Child terragrunt.hcl (Environment Override)\n\n```hcl\n# prod\u002Fvpc\u002Fterragrunt.hcl\ninclude \"root\" {\n  path = find_in_parent_folders()\n}\n\nterraform {\n  source = \"..\u002F..\u002Fmodules\u002Fvpc\"\n}\n\ninputs = {\n  environment = \"prod\"\n  cidr_block  = \"10.0.0.0\u002F16\"\n}\n```\n\n### Dependencies Between Modules\n\n```hcl\n# prod\u002Feks\u002Fterragrunt.hcl\ndependency \"vpc\" {\n  config_path = \"..\u002Fvpc\"\n}\n\ninputs = {\n  vpc_id     = dependency.vpc.outputs.vpc_id\n  subnet_ids = dependency.vpc.outputs.private_subnet_ids\n}\n```\n\n### When Terragrunt Adds Value\n\n- **Yes**: 3+ environments with identical module structure, shared backend config, or cross-module dependencies.\n- **No**: Single environment, small team, or simple directory-based isolation already works. Terragrunt adds a learning curve and another binary to manage.\n\n---\n\n## Installation\n\n### One-liner (any tool)\n```bash\ngit clone https:\u002F\u002Fgithub.com\u002Falirezarezvani\u002Fclaude-skills.git\ncp -r claude-skills\u002Fengineering\u002Fterraform-patterns ~\u002F.claude\u002Fskills\u002F\n```\n\n### Multi-tool install\n```bash\n.\u002Fscripts\u002Fconvert.sh --skill terraform-patterns --tool codex|gemini|cursor|windsurf|openclaw\n```\n\n### OpenClaw\n```bash\nclawhub install terraform-patterns\n```\n\n---\n\n## Related Skills\n\n- **senior-devops** — Broader DevOps scope (CI\u002FCD, monitoring, containerization). Complementary — use terraform-patterns for IaC-specific work, senior-devops for pipeline and infrastructure operations.\n- **aws-solution-architect** — AWS architecture design. Complementary — terraform-patterns implements the infrastructure, aws-solution-architect designs it.\n- **senior-security** — Application security. Complementary — terraform-patterns covers infrastructure security posture, senior-security covers application-level threats.\n- **ci-cd-pipeline-builder** — Pipeline construction. Complementary — terraform-patterns defines infrastructure, ci-cd-pipeline-builder automates deployment.\n",{"name":5,"license":14,"metadata":54,"description":7},{"author":55,"updated":56,"version":57,"category":58},"Alireza Rezvani",1773532800000,"1.0.0","engineering","main","510dd2917e051cc953dc55f56fd6ef442aa01b38","claude-skills\u002Fengineering\u002Fterraform-patterns\u002Fskills\u002Fterraform-patterns","https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi","https:\u002F\u002Fgithub.com\u002Fmne20114-hash","2026-10-28 07:50:31",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":77},[67,70,73],{"tool":68,"command":69},"npx","npx skills add mne20114-hash\u002Fgest35bi --skill terraform-patterns",{"tool":71,"command":72},"bunx","bunx skills add mne20114-hash\u002Fgest35bi --skill terraform-patterns",{"tool":74,"command":75},"pnpm","pnpm dlx skills add mne20114-hash\u002Fgest35bi --skill terraform-patterns","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fengineering\u002Fterraform-patterns\u002Fskills\u002Fterraform-patterns\u002FSKILL.md",true,[79,85,89,95],{"path":80,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"references\u002Fmodule-patterns.md","REFERENCE","参考文档",9900,"https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fengineering\u002Fterraform-patterns\u002Fskills\u002Fterraform-patterns\u002Freferences\u002Fmodule-patterns.md",{"path":86,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":87,"sourceHtmlUrl":88},"references\u002Fstate-management.md",12177,"https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fengineering\u002Fterraform-patterns\u002Fskills\u002Fterraform-patterns\u002Freferences\u002Fstate-management.md",{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"scripts\u002Ftf_module_analyzer.py","SCRIPT","脚本",13995,"https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fengineering\u002Fterraform-patterns\u002Fskills\u002Fterraform-patterns\u002Fscripts\u002Ftf_module_analyzer.py",{"path":96,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":97,"sourceHtmlUrl":98},"scripts\u002Ftf_security_scanner.py",18523,"https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fengineering\u002Fterraform-patterns\u002Fskills\u002Fterraform-patterns\u002Fscripts\u002Ftf_security_scanner.py",[100,134,156,179,204,222],{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":115,"publishedAt":49},"01M6C27N3H0F9RGG2KASPASH04","syllabus","Generates a curated supplementary reading list from any course syllabus using Consensus academic search. Grill-me intake (syllabus input format + course audience + year range) plus a grouping forcing-options checkpoint before any search runs — so the reading list matches the course's level and recency need. Parses the syllabus to extract topics and learning outcomes, searches Consensus for recent peer-reviewed papers per topic, and produces a professionally formatted .docx with clickable Consensus links, plain-language summaries calibrated to audience level, and Bloom-higher-order discussion questions tied to course learning goals. Use when the user uploads a syllabus, course outline, or curriculum document and wants supplementary readings (e.g., 'create a reading list from this syllabus', 'find recent papers for my course') — even casual mentions with a syllabus attached should trigger this skill.","https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fresearch\u002Fsyllabus\u002Fskills\u002Fsyllabus\u002FSKILL.md",[106,109,110],{"categoryNo":107,"categoryName":108,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":26,"categoryName":27,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":111,"categoryName":112,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[102,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,32,133],"docx","pr","create","intake","search","audit","integrity","checkpoint","learning","js","format","direct","Rules","find","consensus","list","extract","outcomes",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":144,"publishedAt":49},"01M6C27DMGZ4D6ERNHSVA8H8RJ","pulse","Multi-source recency research skill that takes the pulse of any topic across Reddit, Hacker News, the open web, and optionally X\u002FTwitter within a configurable recent window (default 30 days). Forcing intake clarifies topic specificity, angle (trend\u002Fsentiment\u002Fproblems\u002Fopportunities\u002Fcomparison), time window, and platform scope before searching. Returns a synthesized briefing with citations, engagement metrics, and cross-platform pattern analysis. Use when the user requests multi-source recency intelligence on a topic (e.g., 'pulse on [topic]', 'what's happening with [topic]', 'what are people saying about [topic]', 'current conversation about [topic]', 'take the pulse of [topic]', 'trending: [topic]', 'find me info on [topic]'), and for competitor research, trend discovery, tool comparisons, and audience sentiment analysis.","https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fresearch\u002Fpulse\u002Fskills\u002Fpulse\u002FSKILL.md",[140,143],{"categoryNo":141,"categoryName":142,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":26,"categoryName":27,"taxonomyType":20,"taxonomyTypeDesc":21},[136,145,146,117,147,119,121,148,149,122,150,151,152,153,127,128,154,129,155,32],"research","web","sentiment analysis","sentiment","Citations","analysis","discovery","open","tool","twitter","user",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":167,"publishedAt":49},"01M6C279M59X635VPD6Y9R616J","patent","Patent prior-art and landscape intelligence skill — not generic patent help. Commits to one of five sub-use-cases via forcing intake (novelty search \u002F freedom-to-operate \u002F competitive landscape \u002F acquisition diligence \u002F litigation prior-art) before any search runs. Searches Google Patents, Espacenet, USPTO, and optionally Lens.org for citation-graph signals. Output is an editable Word document (.docx) with verdict, ranked closest art (claim-text extracted), CPC-class-aware landscape, family-resolved hits, geographic coverage, FTO flags where applicable, strategy recommendations, and full audit log. Use when the user asks for patent searching or analysis (e.g., 'prior art search for [invention]', 'freedom to operate analysis for [product]'). Produces search signal, not legal advice — always recommends consulting a patent attorney before filing or licensing decisions. Trademark, copyright, and trade-secret questions are out of scope.","https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fresearch\u002Fpatent\u002Fskills\u002Fpatent\u002FSKILL.md",[162,163,164],{"categoryNo":107,"categoryName":108,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":26,"categoryName":27,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":165,"categoryName":166,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000037","律师与法务",[158,116,117,168,169,170,119,120,121,150,171,172,173,128,174,175,176,177,32,178],"competitive landscape","routing","product","commits","Word","text","acquisition","decisions","strategy","coverage","advice",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":189,"publishedAt":49},"01M6C275RZWNRB3CCB14QQM7ES","notebooklm","Browser automation skill for controlling Google's NotebookLM. Use when the user wants anything done in NotebookLM (e.g., 'open NotebookLM', 'check my [name] notebook', 'ask my notebook about X', 'add [source] to NotebookLM', 'generate a Video Overview from my notebook', 'use NotebookLM Studio'). Handles reading and querying notebooks, adding sources (URLs, text, files, YouTube links, synthesized content), generating Studio outputs (Audio\u002FVideo Overviews, Mind Maps, Reports incl. Briefing Doc\u002FStudy Guide\u002FFAQ, Flashcards, Quiz, slide decks, infographics — discover the exact set from the live Studio panel; the UI evolves fast), and creating new notebooks. Requires browser automation environment — fails gracefully when unavailable.","https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fresearch\u002Fnotebooklm\u002Fskills\u002Fnotebooklm\u002FSKILL.md",[185,188],{"categoryNo":186,"categoryName":187,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":26,"categoryName":27,"taxonomyType":20,"taxonomyTypeDesc":21},[181,190,191,145,192,193,194,195,196,197,198,199,152,173,127,200,201,202,203,32],"google","browser automation","automation","generate","browser","fast","SET","doc","Video","Audio","check","ask","environment","overview",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":214,"publishedAt":49},"01M6C2717B0QDJ3Y4PJP77BMW5","litreview","Academic literature orientation skill that searches papers via free keyless APIs (PubMed E-utilities + OpenAlex) by default — with the Consensus MCP as an optional enhancement lane when connected — builds a strategic search plan using PICO (default) or SPIDER \u002F Decomposition \u002F hybrid as fallbacks, and synthesizes findings into a formatted Word (.docx) research guide. Grill-me intake (research question specificity + framework hint + tentative depth) before the recon search; a second forcing checkpoint after Phase 2 confirms framework + sub-areas + depth before searches consume budget. Configurable depth (5\u002F10\u002F20 queries) controls coverage vs. speed. Output is a 'launching pad' — an orientation guide that lets a researcher dive in confidently, not a finished review. Use when the user starts literature-oriented research (e.g., 'litreview on [topic]', 'literature review on [topic]', 'I'm starting a literature review on X', 'I'm writing a paper on X', 'help me research X', 'I'm doing research on X', 'can you help me research X'). Do NOT use for single one-off paper searches wanting a quick list — that's a plain PubMed\u002FOpenAlex (or Consensus) query.","https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fresearch\u002Flitreview\u002Fskills\u002Flitreview\u002FSKILL.md",[210,211,212,213],{"categoryNo":107,"categoryName":108,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":141,"categoryName":142,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":26,"categoryName":27,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":111,"categoryName":112,"taxonomyType":113,"taxonomyTypeDesc":114},[206,116,215,216,47,117,119,120,217,218,219,123,33,172,220,128,130,221,177,32],"MCP","writing","lane","keyless","literature review","researcher","question",{"skillNo":223,"name":224,"nameZh":6,"description":225,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":226,"categories":227,"keywords":232,"publishedAt":49},"01M6C26X5G3WDVWQ40Y16ZS19F","grants","NIH grant research skill for clinical researchers. Grill-me intake (research idea + career stage + preliminary data + environment + submission posture + known institute targets) locks down the funding strategy before any search runs. Runs a 5-facet Consensus positioning analysis (with draft Significance\u002FInnovation language), maps the research to the right NIH institutes and study sections via RePORTER, finds NOSIs and funded overlap, and produces an editable Word document (.docx) with budget\u002Fscope-aware mechanism recommendations, submission timelines, and a mandatory program officer recommendation. Use when the user asks about research funding or makes any grant-related request (e.g., 'grants for [topic]', 'find grants for my research idea', 'what grants match my research', 'help me find NIH funding', 'grant opportunities for my research'). NIH-only scope — non-NIH funders (PCORI, DOD CDMRP, VA, foundations) are out of scope and flagged at intake.","https:\u002F\u002Fgithub.com\u002Fmne20114-hash\u002Fgest35bi\u002Fblob\u002Fmain\u002Fclaude-skills\u002Fresearch\u002Fgrants\u002Fskills\u002Fgrants\u002FSKILL.md",[228,229,230,231],{"categoryNo":107,"categoryName":108,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":141,"categoryName":142,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":26,"categoryName":27,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":111,"categoryName":112,"taxonomyType":113,"taxonomyTypeDesc":114},[224,116,145,117,233,119,120,121,234,235,122,150,172,128,129,130,176,202,32,236],"help","data","Budget","innovation"]