[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DRZNT8MHPXK0HDPWGCQPCD":3,"skill-same:01M6DRZNT8MHPXK0HDPWGCQPCD":119},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":31,"linkOnly":32,"markdownContent":33,"markdownBody":34,"frontMatter":35,"refName":36,"commitSha":37,"skillDirectory":38,"forksCount":39,"repositoryHtmlUrl":40,"repositoryHomepageUrl":6,"ownerHtmlUrl":41,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":42,"install":43,"resources":56},"01M6DRZNT8MHPXK0HDPWGCQPCD","terraform-generator",null,"Create, generate, write, or scaffold Terraform .tf HCL — resources, modules, providers, variables, outputs.","AntifragileTech\u002Fantifragile-claude-code","AntifragileTech","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F174357194?v=4","01M6DQCYMK4CDSQQAN0ZC72NTV","01M6DQCYS9YPW1WKMQ5TJMPQ43",9,"MIT","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-generator\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[23,24,25,26,27,28,29,30],"terraform","terraform generator","scaffold","create","generate","Providers","write","modules","2026-11-10 10:12:30",false,"---\nname: terraform-generator\ndescription: Create, generate, write, or scaffold Terraform .tf HCL — resources, modules, providers, variables, outputs.\n---\n\n# Terraform Generator\n\n## Overview\n\nThis skill enables the generation of production-ready Terraform configurations following best practices and current standards. Automatically integrates validation and documentation lookup for custom providers and modules.\n\n## Critical Requirements Checklist\n\n**STOP: You MUST complete ALL steps in order. Do NOT skip any REQUIRED step.**\n\n| Step | Action | Required |\n|------|--------|----------|\n| 1 | Understand requirements (providers, resources, modules) | ✅ REQUIRED |\n| 2 | Check for custom providers\u002Fmodules and lookup documentation | ✅ REQUIRED |\n| 3 | Consult reference files before generation | ✅ REQUIRED |\n| 4 | Generate Terraform files with ALL best practices | ✅ REQUIRED |\n| 5 | Include data sources for dynamic values (region, account, AMIs) | ✅ REQUIRED |\n| 6 | Add lifecycle rules on critical resources (KMS, databases) | ✅ REQUIRED |\n| 7 | Invoke `Skill(devops-skills:terraform-validator)` | ✅ REQUIRED |\n| 8 | **FIX all validation\u002Fsecurity failures and RE-VALIDATE** | ✅ REQUIRED |\n| 9 | Provide usage instructions (files, next steps, security) | ✅ REQUIRED |\n\n> **IMPORTANT:** If validation fails (terraform validate OR security scan), you MUST fix the issues and re-run validation until ALL checks pass. Do NOT proceed to Step 9 with failing checks.\n\n## Core Workflow\n\nWhen generating Terraform configurations, follow this workflow:\n\n### Step 1: Understand Requirements\n\nAnalyze the user's request to determine:\n- What infrastructure resources need to be created\n- Which Terraform providers are required (AWS, Azure, GCP, custom, etc.)\n- Whether any modules are being used (official, community, or custom)\n- Version constraints for providers and modules\n- Variable inputs and outputs needed\n- State backend configuration (local, S3, remote, etc.)\n\n### Step 2: Check for Custom Providers\u002FModules\n\nBefore generating configurations, identify if custom or third-party providers\u002Fmodules are involved:\n\n**Standard providers** (no lookup needed):\n- hashicorp\u002Faws\n- hashicorp\u002Fazurerm\n- hashicorp\u002Fgoogle\n- hashicorp\u002Fkubernetes\n- Other official HashiCorp providers\n\n**Custom\u002Fthird-party providers\u002Fmodules** (require documentation lookup):\n- Third-party providers (e.g., datadog\u002Fdatadog, mongodb\u002Fmongodbatlas)\n- Custom modules from Terraform Registry\n- Private or company-specific modules\n- Community modules\n\n**When custom providers\u002Fmodules are detected:**\n\n1. Use WebSearch to find version-specific documentation:\n   ```\n   Search query format: \"[provider\u002Fmodule name] terraform [version] documentation [specific resource]\"\n   Example: \"datadog terraform provider v3.30 monitor resource documentation\"\n   Example: \"terraform-aws-modules vpc version 5.0 documentation\"\n   ```\n\n2. Focus searches on:\n   - Official documentation (registry.terraform.io, provider websites)\n   - Required and optional arguments\n   - Attribute references\n   - Example usage\n   - Version compatibility notes\n\n3. If Context7 MCP is available and the provider\u002Fmodule is supported, use it as an alternative:\n   ```\n   mcp__context7__resolve-library-id → mcp__context7__query-docs\n   ```\n\n### Step 2.5: Consult Reference Files (REQUIRED)\n\nBefore generating configuration, you MUST consult reference files using this matrix:\n\n| Reference | Requirement | Read When |\n|-----------|-------------|-----------|\n| `terraform_best_practices.md` | REQUIRED | Always - contains baseline required patterns |\n| `provider_examples.md` | REQUIRED | Any AWS, Azure, GCP, or Kubernetes resource generation |\n| `common_patterns.md` | OPTIONAL by default, REQUIRED for complex requests | Multi-environment, workspace, composition, DR, or conditional patterns |\n\nOpen references by path:\n\n```\ndevops-skills-plugin\u002Fskills\u002Fterraform-generator\u002Freferences\u002Fterraform_best_practices.md\ndevops-skills-plugin\u002Fskills\u002Fterraform-generator\u002Freferences\u002Fprovider_examples.md\ndevops-skills-plugin\u002Fskills\u002Fterraform-generator\u002Freferences\u002Fcommon_patterns.md\n```\n\n### Step 3: Generate Terraform Configuration\n\nGenerate HCL files following best practices:\n\n**File Organization:**\n```\nterraform-project\u002F\n├── main.tf           # Primary resource definitions\n├── variables.tf      # Input variable declarations\n├── outputs.tf        # Output value declarations\n├── versions.tf       # Provider version constraints\n├── terraform.tfvars  # Variable values (optional, for examples)\n└── backend.tf        # Backend configuration (optional)\n```\n\n**Best Practices to Follow:**\n\n1. **Provider Configuration:**\n   ```hcl\n   terraform {\n     required_version = \">= 1.10, \u003C 2.0\"\n\n     required_providers {\n       aws = {\n         source  = \"hashicorp\u002Faws\"\n         version = \"~> 6.0\"  # Major pin; verify exact current version when needed\n       }\n     }\n   }\n\n   provider \"aws\" {\n     region = var.aws_region\n   }\n   ```\n\n2. **Resource Naming:**\n   - Use descriptive resource names\n   - Follow snake_case convention\n   - Include resource type in name when helpful\n   ```hcl\n   resource \"aws_instance\" \"web_server\" {\n     # ...\n   }\n   ```\n\n3. **Variable Declarations:**\n   ```hcl\n   variable \"instance_type\" {\n     description = \"EC2 instance type for web servers\"\n     type        = string\n     default     = \"t3.micro\"\n\n     validation {\n       condition     = contains([\"t3.micro\", \"t3.small\", \"t3.medium\"], var.instance_type)\n       error_message = \"Instance type must be t3.micro, t3.small, or t3.medium.\"\n     }\n   }\n   ```\n\n4. **Output Values:**\n   ```hcl\n   output \"instance_public_ip\" {\n     description = \"Public IP address of the web server\"\n     value       = aws_instance.web_server.public_ip\n   }\n   ```\n\n5. **Use Data Sources for References:**\n   ```hcl\n   data \"aws_ami\" \"ubuntu\" {\n     most_recent = true\n     owners      = [\"099720109477\"] # Canonical\n\n     filter {\n       name   = \"name\"\n       values = [\"ubuntu\u002Fimages\u002Fhvm-ssd\u002Fubuntu-jammy-22.04-amd64-server-*\"]\n     }\n   }\n   ```\n\n6. **Module Usage:**\n   ```hcl\n   module \"vpc\" {\n     source  = \"terraform-aws-modules\u002Fvpc\u002Faws\"\n     version = \"5.0.0\"\n\n     name = \"my-vpc\"\n     cidr = \"10.0.0.0\u002F16\"\n\n     azs             = [\"us-east-1a\", \"us-east-1b\"]\n     private_subnets = [\"10.0.1.0\u002F24\", \"10.0.2.0\u002F24\"]\n     public_subnets  = [\"10.0.101.0\u002F24\", \"10.0.102.0\u002F24\"]\n   }\n   ```\n\n7. **Use locals for Computed Values:**\n   ```hcl\n   locals {\n     common_tags = {\n       Environment = var.environment\n       ManagedBy   = \"Terraform\"\n       Project     = var.project_name\n     }\n   }\n   ```\n\n8. **Lifecycle Rules When Appropriate:**\n   ```hcl\n   resource \"aws_instance\" \"example\" {\n     # ...\n\n     lifecycle {\n       create_before_destroy = true\n       prevent_destroy       = true\n       ignore_changes        = [tags]\n     }\n   }\n   ```\n\n9. **Dynamic Blocks for Repeated Configuration:**\n   ```hcl\n   resource \"aws_security_group\" \"example\" {\n     # ...\n\n     dynamic \"ingress\" {\n       for_each = var.ingress_rules\n       content {\n         from_port   = ingress.value.from_port\n         to_port     = ingress.value.to_port\n         protocol    = ingress.value.protocol\n         cidr_blocks = ingress.value.cidr_blocks\n       }\n     }\n   }\n   ```\n\n10. **Comments and Documentation:**\n    - Add comments explaining complex logic\n    - Document why certain values are used\n    - Include examples in variable descriptions\n\n**Security Best Practices:**\n- Never hardcode sensitive values (use variables)\n- Use data sources for AMIs and other dynamic values\n- Implement least-privilege IAM policies\n- Enable encryption by default\n- Use secure backend configurations\n\n### Required: Data Sources for Dynamic Values (Provider-Aware)\n\nYou MUST include provider-appropriate data lookups for dynamic infrastructure values. Do NOT hardcode cloud\u002Faccount\u002Fregion\u002Fimage IDs.\n\n| Provider | Required Dynamic Context | Typical Data Sources |\n|----------|--------------------------|----------------------|\n| AWS | Region\u002Faccount\u002FAZ\u002Fimage IDs | `aws_region`, `aws_caller_identity`, `aws_availability_zones`, `aws_ami` |\n| Azure | Tenant\u002Fsubscription\u002Fclient context | `azurerm_client_config`, `azurerm_subscription` |\n| GCP | Project\u002Fclient context\u002Fzone discovery | `google_client_config`, `google_compute_zones`, `google_compute_image` |\n| Kubernetes | Cluster endpoint\u002Fauth from trusted source | Use module outputs or cloud data sources; avoid hardcoded tokens\u002Fendpoints |\n\n```hcl\n# AWS dynamic context\ndata \"aws_region\" \"current\" {}\ndata \"aws_caller_identity\" \"current\" {}\n\n# Azure dynamic context\ndata \"azurerm_client_config\" \"current\" {}\ndata \"azurerm_subscription\" \"current\" {}\n\n# GCP dynamic context\ndata \"google_client_config\" \"current\" {}\n```\n\n### Required: Lifecycle and Deletion Safeguards (Provider-Aware)\n\nYou MUST protect stateful and critical resources from accidental destruction\u002Fdeletion using both Terraform lifecycle and provider-native safeguards.\n\n| Provider | Critical Resource Classes | Required Protection Mechanism |\n|----------|---------------------------|-------------------------------|\n| AWS | KMS, RDS, S3 data buckets, DynamoDB, ElastiCache, secrets | `lifecycle { prevent_destroy = true }` and service-specific deletion protection where supported |\n| Azure | Key Vaults, SQL, Storage, stateful compute | `prevent_destroy` where appropriate plus provider feature flags\u002Fresource deletion protection |\n| GCP | Cloud SQL, GKE, storage, stateful compute | `prevent_destroy` and resource-level `deletion_protection = true` where supported |\n| Kubernetes | Stateful workloads and persistent data | Avoid destructive replacement patterns and protect backing cloud resources |\n\n```hcl\nresource \"aws_db_instance\" \"main\" {\n  # ...\n  deletion_protection = true\n  lifecycle {\n    prevent_destroy = true\n  }\n}\n\nresource \"google_sql_database_instance\" \"main\" {\n  # ...\n  deletion_protection = true\n}\n```\n\n### Required: Object Storage Lifecycle Safeguards\n\nWhen using AWS S3 lifecycle configuration, ALWAYS include a rule to abort incomplete multipart uploads:\n\n```hcl\nresource \"aws_s3_bucket_lifecycle_configuration\" \"main\" {\n  bucket = aws_s3_bucket.main.id\n\n  # REQUIRED: Abort incomplete multipart uploads to prevent storage costs\n  rule {\n    id     = \"abort-incomplete-uploads\"\n    status = \"Enabled\"\n\n    # Filter applies to all objects (empty filter = all objects)\n    filter {}\n\n    abort_incomplete_multipart_upload {\n      days_after_initiation = 7\n    }\n  }\n\n  # Other lifecycle rules (e.g., transition to IA)\n  rule {\n    id     = \"transition-to-ia\"\n    status = \"Enabled\"\n\n    filter {\n      prefix = \"\"  # Apply to all objects\n    }\n\n    transition {\n      days          = 90\n      storage_class = \"STANDARD_IA\"\n    }\n\n    noncurrent_version_transition {\n      noncurrent_days = 30\n      storage_class   = \"STANDARD_IA\"\n    }\n\n    noncurrent_version_expiration {\n      noncurrent_days = 365\n    }\n  }\n}\n```\n\n> **Why?** Incomplete multipart uploads consume storage and incur costs. Checkov check `CKV_AWS_300` enforces this for AWS.\n>\n> For Azure\u002FGCP object storage, add equivalent lifecycle\u002Fretention rules for stale objects and old versions.\n\n### Step 4: Validate Generated Configuration (REQUIRED)\n\nAfter generating Terraform files, ALWAYS validate them using the devops-skills:terraform-validator skill:\n\n```\nInvoke: Skill(devops-skills:terraform-validator)\n```\n\nThe devops-skills:terraform-validator skill will:\n1. Check HCL syntax with `terraform fmt -check`\n2. Initialize the configuration with `terraform init`\n3. Validate the configuration with `terraform validate`\n4. Run security scan with Checkov\n5. Perform dry-run testing (if requested) with `terraform plan`\n\n**CRITICAL: Fix-and-Revalidate Loop**\n\nIf ANY validation or security check fails, you MUST:\n\n1. **Review the error** - Understand what failed and why\n2. **Fix the issue** - Edit the generated file to resolve the problem\n3. **Re-run validation** - Invoke `Skill(devops-skills:terraform-validator)` again\n4. **Repeat until ALL checks pass** - Do NOT proceed with failing checks\n\n```\n┌─────────────────────────────────────────────────────────┐\n│  VALIDATION FAILED?                                      │\n│                                                          │\n│  ┌─────────┐    ┌─────────┐    ┌─────────────────────┐  │\n│  │  Fix    │───▶│ Re-run  │───▶│ All checks pass?    │  │\n│  │  Issue  │    │ Skill   │    │ YES → Step 5        │  │\n│  └─────────┘    └─────────┘    │ NO  → Loop back     │  │\n│       ▲                         └─────────────────────┘  │\n│       │                                    │             │\n│       └────────────────────────────────────┘             │\n└─────────────────────────────────────────────────────────┘\n```\n\n**Common validation failures to fix:**\n| Check | Issue | Fix |\n|-------|-------|-----|\n| `CKV_AWS_300` | Missing abort multipart upload | Add `abort_incomplete_multipart_upload` rule |\n| `CKV_AWS_24` | SSH open to 0.0.0.0\u002F0 | Restrict to specific CIDR |\n| `CKV_AWS_16` | RDS encryption disabled | Add `storage_encrypted = true` |\n| `terraform validate` | Invalid resource argument | Check provider documentation |\n\n**If custom providers are detected during validation:**\n- The devops-skills:terraform-validator skill will automatically fetch documentation\n- Use the fetched documentation to fix any issues\n\n### Step 5: Provide Usage Instructions (REQUIRED)\n\nAfter successful generation and validation with ALL checks passing, you MUST provide the user with:\n\n**Required Output Format:**\n\n```markdown\n## Generated Files\n\n| File | Description |\n|------|-------------|\n| `\u003Cactual-file-path>` | What was generated in that file |\n\nOnly list files that were actually generated for this request. Do not include placeholder paths or files that do not exist.\n\n## Next Steps\n\n1. Review and customize `terraform.tfvars` with your values\n2. Initialize Terraform:\n   ```bash\n   terraform init\n   ```\n3. Review the execution plan:\n   ```bash\n   terraform plan\n   ```\n4. Apply the configuration:\n   ```bash\n   terraform apply\n   ```\n\n## Customization Notes\n\n- [ ] Update `variable_name` in terraform.tfvars\n- [ ] Configure backend in backend.tf for remote state\n- [ ] Adjust resource names\u002Ftags as needed\n\n## Security Reminders\n\n⚠️ Before applying:\n- Review IAM policies and permissions\n- Ensure sensitive values are NOT committed to version control\n- Configure state backend with encryption enabled\n- Set up state locking for team collaboration\n```\n\n> **IMPORTANT:** Do NOT skip Step 5. The user needs actionable guidance on how to use the generated configuration.\n\n## Common Generation Patterns\n\n### Pattern 1: Simple Resource Creation\n\nUser request: \"Create an AWS S3 bucket with versioning\"\n\nGenerated files:\n- `main.tf` - S3 bucket resource with versioning enabled\n- `variables.tf` - Bucket name, tags variables\n- `outputs.tf` - Bucket ARN and name outputs\n- `versions.tf` - AWS provider version constraints\n\n### Pattern 2: Module-Based Infrastructure\n\nUser request: \"Set up a VPC using the official AWS VPC module\"\n\nActions:\n1. Identify module: terraform-aws-modules\u002Fvpc\u002Faws\n2. Web search for latest version and documentation\n3. Generate configuration using module with appropriate inputs\n4. Validate with devops-skills:terraform-validator\n\n### Pattern 3: Multi-Provider Configuration\n\nUser request: \"Create infrastructure across AWS and Datadog\"\n\nActions:\n1. Identify standard provider (AWS) and custom provider (Datadog)\n2. Web search for Datadog provider documentation with version\n3. Generate configuration with both providers properly configured\n4. Ensure provider aliases if needed\n5. Validate with devops-skills:terraform-validator\n\n### Pattern 4: Complex Resource with Dependencies\n\nUser request: \"Create an ECS cluster with ALB and auto-scaling\"\n\nGenerated structure:\n- Multiple resource blocks with proper dependencies\n- Data sources for AMIs, availability zones, etc.\n- Local values for computed configurations\n- Comprehensive variables and outputs\n- Proper dependency management using implicit references\n\n## Error Handling\n\n**Common Issues and Solutions:**\n\n1. **Provider Not Found:**\n   - Ensure provider is listed in `required_providers` block\n   - Verify source address format: `namespace\u002Fname`\n   - Check version constraint syntax\n\n2. **Invalid Resource Arguments:**\n   - Refer to web search results for custom providers\n   - Check for required vs optional arguments\n   - Verify attribute value types (string, number, bool, list, map)\n\n3. **Circular Dependencies:**\n   - Review resource references\n   - Use `depends_on` explicit dependencies if needed\n   - Consider breaking into separate modules\n\n4. **Validation Failures:**\n   - Run devops-skills:terraform-validator skill to get detailed errors\n   - Fix issues one at a time\n   - Re-validate after each fix\n\n## Version Awareness\n\nAlways consider version compatibility:\n\n1. **Terraform Version:**\n   - Use `required_version` constraint with both lower and upper bounds\n   - If generated configuration includes write-only arguments (`*_wo`): use `required_version = \">= 1.11, \u003C 2.0\"`.\n   - Else if it uses ephemeral constructs (`ephemeral` blocks, ephemeral variables\u002Foutputs) without write-only arguments: use `required_version = \">= 1.10, \u003C 2.0\"`.\n   - Else use the project baseline (default `>= 1.8, \u003C 2.0` unless repository policy requires newer).\n   - Use `>= 1.14, \u003C 2.0` for latest features (actions, query command)\n   - Document any version-specific features used (see below)\n\n2. **Provider Version Policy (canonical):**\n   - Pin provider major versions with `~>` constraints (for example `~> 6.0`, `~> 4.0`, `~> 7.0`).\n   - Do not claim \"latest\" version unless verified online during the current run.\n   - Keep cross-provider guidance consistent:\n     - AWS family: major-pin policy (for example `~> 6.0`)\n     - AzureRM: major-pin policy (for example `~> 4.0`)\n     - Google: major-pin policy (for example `~> 7.0`)\n     - Kubernetes: major\u002Fminor pin based on target cluster\u002Fprovider compatibility\n   - Use the same provider\u002Fversion language in `SKILL.md`, `references\u002Fterraform_best_practices.md`, and template `assets\u002Fminimal-project\u002Fversions.tf`.\n\n3. **Module Versions:**\n   - Always pin module versions\n   - Review module documentation for version compatibility\n   - Test module updates in non-production first\n\n### Required Version Decision Table\n\n| Generated Output Contains | Required Version to Emit |\n|---------------------------|--------------------------|\n| Any write-only argument (`*_wo`) | `>= 1.11, \u003C 2.0` |\n| Ephemeral constructs only (no write-only) | `>= 1.10, \u003C 2.0` |\n| Neither write-only nor ephemeral | Project baseline (default `>= 1.8, \u003C 2.0`) |\n\n#### Feature-Gating Examples\n\n```hcl\n# Positive: write-only usage requires Terraform 1.11+\nterraform {\n  required_version = \">= 1.11, \u003C 2.0\"\n}\n\nephemeral \"random_password\" \"db_password\" {\n  length = 16\n}\n\nresource \"aws_db_instance\" \"main\" {\n  identifier          = \"mydb\"\n  instance_class      = \"db.t3.micro\"\n  allocated_storage   = 20\n  engine              = \"postgres\"\n  username            = \"admin\"\n  skip_final_snapshot = true\n\n  password_wo         = ephemeral.random_password.db_password.result\n  password_wo_version = 1\n}\n```\n\n```hcl\n# Negative: reject this pattern (write-only with Terraform 1.10)\nterraform {\n  required_version = \">= 1.10, \u003C 2.0\"\n}\n\nresource \"aws_db_instance\" \"invalid\" {\n  password_wo = \"do-not-generate-this\"\n}\n```\n\n### Terraform Version Feature Matrix\n\n| Feature | Minimum Version |\n|---------|-----------------|\n| `terraform_data` resource | 1.4+ |\n| `import {}` blocks | 1.5+ |\n| `check {}` blocks | 1.5+ |\n| Native testing (`.tftest.hcl`) | 1.6+ |\n| Test mocking | 1.7+ |\n| `removed {}` blocks | 1.7+ |\n| Provider-defined functions | 1.8+ |\n| Cross-type refactoring | 1.8+ |\n| Enhanced variable validations | 1.9+ |\n| `templatestring` function | 1.9+ |\n| Ephemeral resources | 1.10+ |\n| Write-only arguments | 1.11+ |\n| S3 native state locking | 1.11+ |\n| Import blocks with `for_each` | 1.12+ |\n| Actions block | 1.14+ |\n| List resources (`tfquery.hcl`) | 1.14+ |\n| `terraform query` command | 1.14+ |\n\n## Modern Terraform Features (1.8+)\n\n### Provider-Defined Functions (Terraform 1.8+)\n\nProvider-defined functions extend Terraform's built-in functions with provider-specific logic.\n\n**Syntax:** `provider::\u003Cprovider_name>::\u003Cfunction_name>(arguments)`\n\n```hcl\n# AWS Provider Functions (v5.40+)\nlocals {\n  # Parse an ARN into components\n  parsed_arn = provider::aws::arn_parse(aws_instance.web.arn)\n  account_id = local.parsed_arn.account\n  region     = local.parsed_arn.region\n\n  # Build an ARN from components\n  custom_arn = provider::aws::arn_build({\n    partition = \"aws\"\n    service   = \"s3\"\n    region    = \"\"\n    account   = \"\"\n    resource  = \"my-bucket\u002Fmy-key\"\n  })\n}\n\n# Google Cloud Provider Functions (v5.23+)\nlocals {\n  # Extract region from zone\n  region = provider::google::region_from_zone(var.zone)  # \"us-west1-a\" → \"us-west1\"\n}\n\n# Kubernetes Provider Functions (v2.28+)\nlocals {\n  # Encode HCL to Kubernetes manifest YAML\n  manifest_yaml = provider::kubernetes::manifest_encode(local.deployment_config)\n}\n```\n\n### Ephemeral Resources (Terraform 1.10+)\n\nEphemeral resources provide temporary values that are **never persisted** in state or plan files. Critical for handling secrets securely.\n\n```hcl\n# Generate a password that never touches state\nephemeral \"random_password\" \"db_password\" {\n  length           = 16\n  special          = true\n  override_special = \"!#$%&*()-_=+[]{}\u003C>:?\"\n}\n\n# Fetch secrets ephemerally from AWS Secrets Manager\nephemeral \"aws_secretsmanager_secret_version\" \"api_key\" {\n  secret_id = aws_secretsmanager_secret.api_key.id\n}\n\n# Ephemeral variables (declare with ephemeral = true)\nvariable \"temporary_token\" {\n  type      = string\n  ephemeral = true  # Value won't be stored in state\n}\n\n# Ephemeral outputs\noutput \"session_token\" {\n  value     = ephemeral.aws_secretsmanager_secret_version.api_key.secret_string\n  ephemeral = true  # Won't be stored in state\n}\n```\n\n### Write-Only Arguments (Terraform 1.11+)\n\nWrite-only arguments accept ephemeral values and are never persisted. They use `_wo` suffix and require a version attribute.\n\n```hcl\nterraform {\n  required_version = \">= 1.11, \u003C 2.0\"\n}\n\n# Secure database password handling\nephemeral \"random_password\" \"db_password\" {\n  length = 16\n}\n\nresource \"aws_db_instance\" \"main\" {\n  identifier        = \"mydb\"\n  instance_class    = \"db.t3.micro\"\n  allocated_storage = 20\n  engine            = \"postgres\"\n  username          = \"admin\"\n\n  # Write-only password - never stored in state!\n  password_wo         = ephemeral.random_password.db_password.result\n  password_wo_version = 1  # Increment to trigger password rotation\n\n  skip_final_snapshot = true\n}\n\n# Secrets Manager with write-only\nresource \"aws_secretsmanager_secret_version\" \"db_password\" {\n  secret_id = aws_secretsmanager_secret.db_password.id\n\n  # Write-only secret string\n  secret_string_wo         = ephemeral.random_password.db_password.result\n  secret_string_wo_version = 1\n}\n```\n\n### Enhanced Variable Validations (Terraform 1.9+)\n\nValidation conditions can now reference other variables, data sources, and local values.\n\n```hcl\n# Reference data sources in validation\ndata \"aws_ec2_instance_type_offerings\" \"available\" {\n  filter {\n    name   = \"location\"\n    values = [var.availability_zone]\n  }\n}\n\nvariable \"instance_type\" {\n  type        = string\n  description = \"EC2 instance type\"\n\n  validation {\n    # NEW: Can reference data sources\n    condition = contains(\n      data.aws_ec2_instance_type_offerings.available.instance_types,\n      var.instance_type\n    )\n    error_message = \"Instance type ${var.instance_type} is not available in the selected AZ.\"\n  }\n}\n\n# Cross-variable validation\nvariable \"min_instances\" {\n  type    = number\n  default = 1\n}\n\nvariable \"max_instances\" {\n  type    = number\n  default = 10\n\n  validation {\n    # NEW: Can reference other variables\n    condition     = var.max_instances >= var.min_instances\n    error_message = \"max_instances must be >= min_instances\"\n  }\n}\n```\n\n### S3 Native State Locking (Terraform 1.11+)\n\nS3 now supports native state locking without DynamoDB.\n\n```hcl\nterraform {\n  backend \"s3\" {\n    bucket       = \"my-terraform-state\"\n    key          = \"project\u002Fterraform.tfstate\"\n    region       = \"us-east-1\"\n    encrypt      = true\n\n    # NEW: S3-native locking (Terraform 1.11+)\n    use_lockfile = true\n\n    # DEPRECATED: DynamoDB locking (still works but no longer required)\n    # dynamodb_table = \"terraform-locks\"\n  }\n}\n```\n\n### Import Blocks (Terraform 1.5+)\n\nDeclarative resource imports without command-line operations.\n\n```hcl\n# Import existing resources declaratively\nimport {\n  to = aws_instance.web\n  id = \"i-1234567890abcdef0\"\n}\n\nresource \"aws_instance\" \"web\" {\n  ami           = \"ami-0c55b159cbfafe1f0\"\n  instance_type = \"t3.micro\"\n  # ... configuration must match existing resource\n}\n\n# Import with for_each\nimport {\n  for_each = var.existing_bucket_names\n  to       = aws_s3_bucket.imported[each.key]\n  id       = each.value\n}\n```\n\n### Moved and Removed Blocks\n\nSafely refactor resources without destroying them.\n\n```hcl\n# Rename a resource\nmoved {\n  from = aws_instance.old_name\n  to   = aws_instance.new_name\n}\n\n# Move to a module\nmoved {\n  from = aws_vpc.main\n  to   = module.networking.aws_vpc.main\n}\n\n# Cross-type refactoring (1.8+)\nmoved {\n  from = null_resource.example\n  to   = terraform_data.example\n}\n\n# Remove resource from state without destroying (1.7+)\nremoved {\n  from = aws_instance.legacy\n\n  lifecycle {\n    destroy = false  # Keep the actual resource, just remove from state\n  }\n}\n```\n\n### Import Blocks with for_each (Terraform 1.12+)\n\nImport multiple resources using `for_each` meta-argument.\n\n```hcl\n# Import multiple S3 buckets using a map\nlocals {\n  buckets = {\n    \"staging\" = \"bucket1\"\n    \"uat\"     = \"bucket2\"\n    \"prod\"    = \"bucket3\"\n  }\n}\n\nimport {\n  for_each = local.buckets\n  to       = aws_s3_bucket.this[each.key]\n  id       = each.value\n}\n\nresource \"aws_s3_bucket\" \"this\" {\n  for_each = local.buckets\n}\n\n# Import across module instances using list of objects\nlocals {\n  module_buckets = [\n    { group = \"one\", key = \"bucket1\", id = \"one_1\" },\n    { group = \"one\", key = \"bucket2\", id = \"one_2\" },\n    { group = \"two\", key = \"bucket1\", id = \"two_1\" },\n  ]\n}\n\nimport {\n  for_each = local.module_buckets\n  id       = each.value.id\n  to       = module.group[each.value.group].aws_s3_bucket.this[each.value.key]\n}\n```\n\n### Actions Block (Terraform 1.14+)\n\nActions enable provider-defined operations outside the standard CRUD model. Use for operations like Lambda invocations, cache invalidations, or database backups.\n\n```hcl\n# Invoke a Lambda function (example syntax)\naction \"aws_lambda_invoke\" \"process_data\" {\n  function_name = aws_lambda_function.processor.function_name\n  payload       = jsonencode({ action = \"process\" })\n}\n\n# Create CloudFront invalidation\naction \"aws_cloudfront_create_invalidation\" \"invalidate_cache\" {\n  distribution_id = aws_cloudfront_distribution.main.id\n  paths           = [\"\u002F*\"]\n}\n\n# Actions support for_each\naction \"aws_lambda_invoke\" \"batch_process\" {\n  for_each = toset([\"task1\", \"task2\", \"task3\"])\n\n  function_name = aws_lambda_function.processor.function_name\n  payload       = jsonencode({ task = each.value })\n}\n```\n\n**Triggering Actions via Lifecycle:**\n\nUse `action_trigger` within a resource's lifecycle block to automatically invoke actions:\n\n```hcl\nresource \"aws_lambda_function\" \"example\" {\n  function_name = \"my-function\"\n  # ... other config ...\n\n  lifecycle {\n    action_trigger {\n      events  = [after_create, after_update]\n      actions = [action.aws_lambda_invoke.process_data]\n    }\n  }\n}\n\naction \"aws_lambda_invoke\" \"process_data\" {\n  function_name = aws_lambda_function.example.function_name\n  payload       = jsonencode({ action = \"initialize\" })\n}\n```\n\n**Manual Invocation:**\n\nActions can also be invoked manually via CLI:\n\n```bash\nterraform apply -invoke action.aws_lambda_invoke.process_data\n```\n\n### List Resources and Query Command (Terraform 1.14+)\n\nQuery and filter existing infrastructure using `.tfquery.hcl` files and the `terraform query` command.\n\n```hcl\n# my-resources.tfquery.hcl\n# Define list resources to query existing infrastructure\n\nlist \"aws_instance\" \"web_servers\" {\n  filter {\n    name   = \"tag:Environment\"\n    values = [var.environment]\n  }\n\n  include_resource = true  # Include full resource details\n}\n\nlist \"aws_s3_bucket\" \"data_buckets\" {\n  filter {\n    name   = \"tag:Purpose\"\n    values = [\"data-storage\"]\n  }\n}\n```\n\n```bash\n# Query infrastructure and output results\nterraform query\n\n# Generate import configuration from query results\nterraform query -generate-config-out=\"import_config.tf\"\n\n# Output in JSON format\nterraform query -json\n\n# Use with variables\nterraform query -var 'environment=prod'\n```\n\n### Preconditions and Postconditions (Terraform 1.5+)\n\nAdd custom validation within resource lifecycle.\n\n```hcl\nresource \"aws_instance\" \"example\" {\n  instance_type = \"t3.micro\"\n  ami           = data.aws_ami.example.id\n\n  lifecycle {\n    # Check before creation\n    precondition {\n      condition     = data.aws_ami.example.architecture == \"x86_64\"\n      error_message = \"The selected AMI must be for the x86_64 architecture.\"\n    }\n\n    # Verify after creation\n    postcondition {\n      condition     = self.public_dns != \"\"\n      error_message = \"EC2 instance must be in a VPC that has public DNS hostnames enabled.\"\n    }\n  }\n}\n\n# Preconditions on outputs\noutput \"web_url\" {\n  value = \"https:\u002F\u002F${aws_instance.web.public_dns}\"\n\n  precondition {\n    condition     = aws_instance.web.public_dns != \"\"\n    error_message = \"Instance must have a public DNS name.\"\n  }\n}\n```\n\n## Resources\n\n### references\u002F\n\nThe `references\u002F` directory contains detailed documentation for reference:\n\n- `terraform_best_practices.md` - Comprehensive best practices guide\n- `common_patterns.md` - Common Terraform patterns and examples\n- `provider_examples.md` - Example configurations for popular providers\n\nOpen a reference directly by relative path:\n```\ndevops-skills-plugin\u002Fskills\u002Fterraform-generator\u002Freferences\u002F[filename].md\n```\n\n### assets\u002F\n\nThe `assets\u002F` directory contains template files:\n\n- `minimal-project\u002F` - Minimal Terraform project template\n\nTemplates can be copied and customized for the user's specific needs.\n\n## Notes\n\n- Always run devops-skills:terraform-validator after generation\n- For feature\u002Fversion drift checks in CI, run `bash scripts\u002Frun_ci_checks.sh`\n- Web search is essential for custom providers\u002Fmodules\n- Follow the principle of least surprise in configurations\n- Make configurations readable and maintainable\n- Include helpful comments and documentation\n- Generate realistic examples in terraform.tfvars when helpful\n","# Terraform Generator\n\n## Overview\n\nThis skill enables the generation of production-ready Terraform configurations following best practices and current standards. Automatically integrates validation and documentation lookup for custom providers and modules.\n\n## Critical Requirements Checklist\n\n**STOP: You MUST complete ALL steps in order. Do NOT skip any REQUIRED step.**\n\n| Step | Action | Required |\n|------|--------|----------|\n| 1 | Understand requirements (providers, resources, modules) | ✅ REQUIRED |\n| 2 | Check for custom providers\u002Fmodules and lookup documentation | ✅ REQUIRED |\n| 3 | Consult reference files before generation | ✅ REQUIRED |\n| 4 | Generate Terraform files with ALL best practices | ✅ REQUIRED |\n| 5 | Include data sources for dynamic values (region, account, AMIs) | ✅ REQUIRED |\n| 6 | Add lifecycle rules on critical resources (KMS, databases) | ✅ REQUIRED |\n| 7 | Invoke `Skill(devops-skills:terraform-validator)` | ✅ REQUIRED |\n| 8 | **FIX all validation\u002Fsecurity failures and RE-VALIDATE** | ✅ REQUIRED |\n| 9 | Provide usage instructions (files, next steps, security) | ✅ REQUIRED |\n\n> **IMPORTANT:** If validation fails (terraform validate OR security scan), you MUST fix the issues and re-run validation until ALL checks pass. Do NOT proceed to Step 9 with failing checks.\n\n## Core Workflow\n\nWhen generating Terraform configurations, follow this workflow:\n\n### Step 1: Understand Requirements\n\nAnalyze the user's request to determine:\n- What infrastructure resources need to be created\n- Which Terraform providers are required (AWS, Azure, GCP, custom, etc.)\n- Whether any modules are being used (official, community, or custom)\n- Version constraints for providers and modules\n- Variable inputs and outputs needed\n- State backend configuration (local, S3, remote, etc.)\n\n### Step 2: Check for Custom Providers\u002FModules\n\nBefore generating configurations, identify if custom or third-party providers\u002Fmodules are involved:\n\n**Standard providers** (no lookup needed):\n- hashicorp\u002Faws\n- hashicorp\u002Fazurerm\n- hashicorp\u002Fgoogle\n- hashicorp\u002Fkubernetes\n- Other official HashiCorp providers\n\n**Custom\u002Fthird-party providers\u002Fmodules** (require documentation lookup):\n- Third-party providers (e.g., datadog\u002Fdatadog, mongodb\u002Fmongodbatlas)\n- Custom modules from Terraform Registry\n- Private or company-specific modules\n- Community modules\n\n**When custom providers\u002Fmodules are detected:**\n\n1. Use WebSearch to find version-specific documentation:\n   ```\n   Search query format: \"[provider\u002Fmodule name] terraform [version] documentation [specific resource]\"\n   Example: \"datadog terraform provider v3.30 monitor resource documentation\"\n   Example: \"terraform-aws-modules vpc version 5.0 documentation\"\n   ```\n\n2. Focus searches on:\n   - Official documentation (registry.terraform.io, provider websites)\n   - Required and optional arguments\n   - Attribute references\n   - Example usage\n   - Version compatibility notes\n\n3. If Context7 MCP is available and the provider\u002Fmodule is supported, use it as an alternative:\n   ```\n   mcp__context7__resolve-library-id → mcp__context7__query-docs\n   ```\n\n### Step 2.5: Consult Reference Files (REQUIRED)\n\nBefore generating configuration, you MUST consult reference files using this matrix:\n\n| Reference | Requirement | Read When |\n|-----------|-------------|-----------|\n| `terraform_best_practices.md` | REQUIRED | Always - contains baseline required patterns |\n| `provider_examples.md` | REQUIRED | Any AWS, Azure, GCP, or Kubernetes resource generation |\n| `common_patterns.md` | OPTIONAL by default, REQUIRED for complex requests | Multi-environment, workspace, composition, DR, or conditional patterns |\n\nOpen references by path:\n\n```\ndevops-skills-plugin\u002Fskills\u002Fterraform-generator\u002Freferences\u002Fterraform_best_practices.md\ndevops-skills-plugin\u002Fskills\u002Fterraform-generator\u002Freferences\u002Fprovider_examples.md\ndevops-skills-plugin\u002Fskills\u002Fterraform-generator\u002Freferences\u002Fcommon_patterns.md\n```\n\n### Step 3: Generate Terraform Configuration\n\nGenerate HCL files following best practices:\n\n**File Organization:**\n```\nterraform-project\u002F\n├── main.tf           # Primary resource definitions\n├── variables.tf      # Input variable declarations\n├── outputs.tf        # Output value declarations\n├── versions.tf       # Provider version constraints\n├── terraform.tfvars  # Variable values (optional, for examples)\n└── backend.tf        # Backend configuration (optional)\n```\n\n**Best Practices to Follow:**\n\n1. **Provider Configuration:**\n   ```hcl\n   terraform {\n     required_version = \">= 1.10, \u003C 2.0\"\n\n     required_providers {\n       aws = {\n         source  = \"hashicorp\u002Faws\"\n         version = \"~> 6.0\"  # Major pin; verify exact current version when needed\n       }\n     }\n   }\n\n   provider \"aws\" {\n     region = var.aws_region\n   }\n   ```\n\n2. **Resource Naming:**\n   - Use descriptive resource names\n   - Follow snake_case convention\n   - Include resource type in name when helpful\n   ```hcl\n   resource \"aws_instance\" \"web_server\" {\n     # ...\n   }\n   ```\n\n3. **Variable Declarations:**\n   ```hcl\n   variable \"instance_type\" {\n     description = \"EC2 instance type for web servers\"\n     type        = string\n     default     = \"t3.micro\"\n\n     validation {\n       condition     = contains([\"t3.micro\", \"t3.small\", \"t3.medium\"], var.instance_type)\n       error_message = \"Instance type must be t3.micro, t3.small, or t3.medium.\"\n     }\n   }\n   ```\n\n4. **Output Values:**\n   ```hcl\n   output \"instance_public_ip\" {\n     description = \"Public IP address of the web server\"\n     value       = aws_instance.web_server.public_ip\n   }\n   ```\n\n5. **Use Data Sources for References:**\n   ```hcl\n   data \"aws_ami\" \"ubuntu\" {\n     most_recent = true\n     owners      = [\"099720109477\"] # Canonical\n\n     filter {\n       name   = \"name\"\n       values = [\"ubuntu\u002Fimages\u002Fhvm-ssd\u002Fubuntu-jammy-22.04-amd64-server-*\"]\n     }\n   }\n   ```\n\n6. **Module Usage:**\n   ```hcl\n   module \"vpc\" {\n     source  = \"terraform-aws-modules\u002Fvpc\u002Faws\"\n     version = \"5.0.0\"\n\n     name = \"my-vpc\"\n     cidr = \"10.0.0.0\u002F16\"\n\n     azs             = [\"us-east-1a\", \"us-east-1b\"]\n     private_subnets = [\"10.0.1.0\u002F24\", \"10.0.2.0\u002F24\"]\n     public_subnets  = [\"10.0.101.0\u002F24\", \"10.0.102.0\u002F24\"]\n   }\n   ```\n\n7. **Use locals for Computed Values:**\n   ```hcl\n   locals {\n     common_tags = {\n       Environment = var.environment\n       ManagedBy   = \"Terraform\"\n       Project     = var.project_name\n     }\n   }\n   ```\n\n8. **Lifecycle Rules When Appropriate:**\n   ```hcl\n   resource \"aws_instance\" \"example\" {\n     # ...\n\n     lifecycle {\n       create_before_destroy = true\n       prevent_destroy       = true\n       ignore_changes        = [tags]\n     }\n   }\n   ```\n\n9. **Dynamic Blocks for Repeated Configuration:**\n   ```hcl\n   resource \"aws_security_group\" \"example\" {\n     # ...\n\n     dynamic \"ingress\" {\n       for_each = var.ingress_rules\n       content {\n         from_port   = ingress.value.from_port\n         to_port     = ingress.value.to_port\n         protocol    = ingress.value.protocol\n         cidr_blocks = ingress.value.cidr_blocks\n       }\n     }\n   }\n   ```\n\n10. **Comments and Documentation:**\n    - Add comments explaining complex logic\n    - Document why certain values are used\n    - Include examples in variable descriptions\n\n**Security Best Practices:**\n- Never hardcode sensitive values (use variables)\n- Use data sources for AMIs and other dynamic values\n- Implement least-privilege IAM policies\n- Enable encryption by default\n- Use secure backend configurations\n\n### Required: Data Sources for Dynamic Values (Provider-Aware)\n\nYou MUST include provider-appropriate data lookups for dynamic infrastructure values. Do NOT hardcode cloud\u002Faccount\u002Fregion\u002Fimage IDs.\n\n| Provider | Required Dynamic Context | Typical Data Sources |\n|----------|--------------------------|----------------------|\n| AWS | Region\u002Faccount\u002FAZ\u002Fimage IDs | `aws_region`, `aws_caller_identity`, `aws_availability_zones`, `aws_ami` |\n| Azure | Tenant\u002Fsubscription\u002Fclient context | `azurerm_client_config`, `azurerm_subscription` |\n| GCP | Project\u002Fclient context\u002Fzone discovery | `google_client_config`, `google_compute_zones`, `google_compute_image` |\n| Kubernetes | Cluster endpoint\u002Fauth from trusted source | Use module outputs or cloud data sources; avoid hardcoded tokens\u002Fendpoints |\n\n```hcl\n# AWS dynamic context\ndata \"aws_region\" \"current\" {}\ndata \"aws_caller_identity\" \"current\" {}\n\n# Azure dynamic context\ndata \"azurerm_client_config\" \"current\" {}\ndata \"azurerm_subscription\" \"current\" {}\n\n# GCP dynamic context\ndata \"google_client_config\" \"current\" {}\n```\n\n### Required: Lifecycle and Deletion Safeguards (Provider-Aware)\n\nYou MUST protect stateful and critical resources from accidental destruction\u002Fdeletion using both Terraform lifecycle and provider-native safeguards.\n\n| Provider | Critical Resource Classes | Required Protection Mechanism |\n|----------|---------------------------|-------------------------------|\n| AWS | KMS, RDS, S3 data buckets, DynamoDB, ElastiCache, secrets | `lifecycle { prevent_destroy = true }` and service-specific deletion protection where supported |\n| Azure | Key Vaults, SQL, Storage, stateful compute | `prevent_destroy` where appropriate plus provider feature flags\u002Fresource deletion protection |\n| GCP | Cloud SQL, GKE, storage, stateful compute | `prevent_destroy` and resource-level `deletion_protection = true` where supported |\n| Kubernetes | Stateful workloads and persistent data | Avoid destructive replacement patterns and protect backing cloud resources |\n\n```hcl\nresource \"aws_db_instance\" \"main\" {\n  # ...\n  deletion_protection = true\n  lifecycle {\n    prevent_destroy = true\n  }\n}\n\nresource \"google_sql_database_instance\" \"main\" {\n  # ...\n  deletion_protection = true\n}\n```\n\n### Required: Object Storage Lifecycle Safeguards\n\nWhen using AWS S3 lifecycle configuration, ALWAYS include a rule to abort incomplete multipart uploads:\n\n```hcl\nresource \"aws_s3_bucket_lifecycle_configuration\" \"main\" {\n  bucket = aws_s3_bucket.main.id\n\n  # REQUIRED: Abort incomplete multipart uploads to prevent storage costs\n  rule {\n    id     = \"abort-incomplete-uploads\"\n    status = \"Enabled\"\n\n    # Filter applies to all objects (empty filter = all objects)\n    filter {}\n\n    abort_incomplete_multipart_upload {\n      days_after_initiation = 7\n    }\n  }\n\n  # Other lifecycle rules (e.g., transition to IA)\n  rule {\n    id     = \"transition-to-ia\"\n    status = \"Enabled\"\n\n    filter {\n      prefix = \"\"  # Apply to all objects\n    }\n\n    transition {\n      days          = 90\n      storage_class = \"STANDARD_IA\"\n    }\n\n    noncurrent_version_transition {\n      noncurrent_days = 30\n      storage_class   = \"STANDARD_IA\"\n    }\n\n    noncurrent_version_expiration {\n      noncurrent_days = 365\n    }\n  }\n}\n```\n\n> **Why?** Incomplete multipart uploads consume storage and incur costs. Checkov check `CKV_AWS_300` enforces this for AWS.\n>\n> For Azure\u002FGCP object storage, add equivalent lifecycle\u002Fretention rules for stale objects and old versions.\n\n### Step 4: Validate Generated Configuration (REQUIRED)\n\nAfter generating Terraform files, ALWAYS validate them using the devops-skills:terraform-validator skill:\n\n```\nInvoke: Skill(devops-skills:terraform-validator)\n```\n\nThe devops-skills:terraform-validator skill will:\n1. Check HCL syntax with `terraform fmt -check`\n2. Initialize the configuration with `terraform init`\n3. Validate the configuration with `terraform validate`\n4. Run security scan with Checkov\n5. Perform dry-run testing (if requested) with `terraform plan`\n\n**CRITICAL: Fix-and-Revalidate Loop**\n\nIf ANY validation or security check fails, you MUST:\n\n1. **Review the error** - Understand what failed and why\n2. **Fix the issue** - Edit the generated file to resolve the problem\n3. **Re-run validation** - Invoke `Skill(devops-skills:terraform-validator)` again\n4. **Repeat until ALL checks pass** - Do NOT proceed with failing checks\n\n```\n┌─────────────────────────────────────────────────────────┐\n│  VALIDATION FAILED?                                      │\n│                                                          │\n│  ┌─────────┐    ┌─────────┐    ┌─────────────────────┐  │\n│  │  Fix    │───▶│ Re-run  │───▶│ All checks pass?    │  │\n│  │  Issue  │    │ Skill   │    │ YES → Step 5        │  │\n│  └─────────┘    └─────────┘    │ NO  → Loop back     │  │\n│       ▲                         └─────────────────────┘  │\n│       │                                    │             │\n│       └────────────────────────────────────┘             │\n└─────────────────────────────────────────────────────────┘\n```\n\n**Common validation failures to fix:**\n| Check | Issue | Fix |\n|-------|-------|-----|\n| `CKV_AWS_300` | Missing abort multipart upload | Add `abort_incomplete_multipart_upload` rule |\n| `CKV_AWS_24` | SSH open to 0.0.0.0\u002F0 | Restrict to specific CIDR |\n| `CKV_AWS_16` | RDS encryption disabled | Add `storage_encrypted = true` |\n| `terraform validate` | Invalid resource argument | Check provider documentation |\n\n**If custom providers are detected during validation:**\n- The devops-skills:terraform-validator skill will automatically fetch documentation\n- Use the fetched documentation to fix any issues\n\n### Step 5: Provide Usage Instructions (REQUIRED)\n\nAfter successful generation and validation with ALL checks passing, you MUST provide the user with:\n\n**Required Output Format:**\n\n```markdown\n## Generated Files\n\n| File | Description |\n|------|-------------|\n| `\u003Cactual-file-path>` | What was generated in that file |\n\nOnly list files that were actually generated for this request. Do not include placeholder paths or files that do not exist.\n\n## Next Steps\n\n1. Review and customize `terraform.tfvars` with your values\n2. Initialize Terraform:\n   ```bash\n   terraform init\n   ```\n3. Review the execution plan:\n   ```bash\n   terraform plan\n   ```\n4. Apply the configuration:\n   ```bash\n   terraform apply\n   ```\n\n## Customization Notes\n\n- [ ] Update `variable_name` in terraform.tfvars\n- [ ] Configure backend in backend.tf for remote state\n- [ ] Adjust resource names\u002Ftags as needed\n\n## Security Reminders\n\n⚠️ Before applying:\n- Review IAM policies and permissions\n- Ensure sensitive values are NOT committed to version control\n- Configure state backend with encryption enabled\n- Set up state locking for team collaboration\n```\n\n> **IMPORTANT:** Do NOT skip Step 5. The user needs actionable guidance on how to use the generated configuration.\n\n## Common Generation Patterns\n\n### Pattern 1: Simple Resource Creation\n\nUser request: \"Create an AWS S3 bucket with versioning\"\n\nGenerated files:\n- `main.tf` - S3 bucket resource with versioning enabled\n- `variables.tf` - Bucket name, tags variables\n- `outputs.tf` - Bucket ARN and name outputs\n- `versions.tf` - AWS provider version constraints\n\n### Pattern 2: Module-Based Infrastructure\n\nUser request: \"Set up a VPC using the official AWS VPC module\"\n\nActions:\n1. Identify module: terraform-aws-modules\u002Fvpc\u002Faws\n2. Web search for latest version and documentation\n3. Generate configuration using module with appropriate inputs\n4. Validate with devops-skills:terraform-validator\n\n### Pattern 3: Multi-Provider Configuration\n\nUser request: \"Create infrastructure across AWS and Datadog\"\n\nActions:\n1. Identify standard provider (AWS) and custom provider (Datadog)\n2. Web search for Datadog provider documentation with version\n3. Generate configuration with both providers properly configured\n4. Ensure provider aliases if needed\n5. Validate with devops-skills:terraform-validator\n\n### Pattern 4: Complex Resource with Dependencies\n\nUser request: \"Create an ECS cluster with ALB and auto-scaling\"\n\nGenerated structure:\n- Multiple resource blocks with proper dependencies\n- Data sources for AMIs, availability zones, etc.\n- Local values for computed configurations\n- Comprehensive variables and outputs\n- Proper dependency management using implicit references\n\n## Error Handling\n\n**Common Issues and Solutions:**\n\n1. **Provider Not Found:**\n   - Ensure provider is listed in `required_providers` block\n   - Verify source address format: `namespace\u002Fname`\n   - Check version constraint syntax\n\n2. **Invalid Resource Arguments:**\n   - Refer to web search results for custom providers\n   - Check for required vs optional arguments\n   - Verify attribute value types (string, number, bool, list, map)\n\n3. **Circular Dependencies:**\n   - Review resource references\n   - Use `depends_on` explicit dependencies if needed\n   - Consider breaking into separate modules\n\n4. **Validation Failures:**\n   - Run devops-skills:terraform-validator skill to get detailed errors\n   - Fix issues one at a time\n   - Re-validate after each fix\n\n## Version Awareness\n\nAlways consider version compatibility:\n\n1. **Terraform Version:**\n   - Use `required_version` constraint with both lower and upper bounds\n   - If generated configuration includes write-only arguments (`*_wo`): use `required_version = \">= 1.11, \u003C 2.0\"`.\n   - Else if it uses ephemeral constructs (`ephemeral` blocks, ephemeral variables\u002Foutputs) without write-only arguments: use `required_version = \">= 1.10, \u003C 2.0\"`.\n   - Else use the project baseline (default `>= 1.8, \u003C 2.0` unless repository policy requires newer).\n   - Use `>= 1.14, \u003C 2.0` for latest features (actions, query command)\n   - Document any version-specific features used (see below)\n\n2. **Provider Version Policy (canonical):**\n   - Pin provider major versions with `~>` constraints (for example `~> 6.0`, `~> 4.0`, `~> 7.0`).\n   - Do not claim \"latest\" version unless verified online during the current run.\n   - Keep cross-provider guidance consistent:\n     - AWS family: major-pin policy (for example `~> 6.0`)\n     - AzureRM: major-pin policy (for example `~> 4.0`)\n     - Google: major-pin policy (for example `~> 7.0`)\n     - Kubernetes: major\u002Fminor pin based on target cluster\u002Fprovider compatibility\n   - Use the same provider\u002Fversion language in `SKILL.md`, `references\u002Fterraform_best_practices.md`, and template `assets\u002Fminimal-project\u002Fversions.tf`.\n\n3. **Module Versions:**\n   - Always pin module versions\n   - Review module documentation for version compatibility\n   - Test module updates in non-production first\n\n### Required Version Decision Table\n\n| Generated Output Contains | Required Version to Emit |\n|---------------------------|--------------------------|\n| Any write-only argument (`*_wo`) | `>= 1.11, \u003C 2.0` |\n| Ephemeral constructs only (no write-only) | `>= 1.10, \u003C 2.0` |\n| Neither write-only nor ephemeral | Project baseline (default `>= 1.8, \u003C 2.0`) |\n\n#### Feature-Gating Examples\n\n```hcl\n# Positive: write-only usage requires Terraform 1.11+\nterraform {\n  required_version = \">= 1.11, \u003C 2.0\"\n}\n\nephemeral \"random_password\" \"db_password\" {\n  length = 16\n}\n\nresource \"aws_db_instance\" \"main\" {\n  identifier          = \"mydb\"\n  instance_class      = \"db.t3.micro\"\n  allocated_storage   = 20\n  engine              = \"postgres\"\n  username            = \"admin\"\n  skip_final_snapshot = true\n\n  password_wo         = ephemeral.random_password.db_password.result\n  password_wo_version = 1\n}\n```\n\n```hcl\n# Negative: reject this pattern (write-only with Terraform 1.10)\nterraform {\n  required_version = \">= 1.10, \u003C 2.0\"\n}\n\nresource \"aws_db_instance\" \"invalid\" {\n  password_wo = \"do-not-generate-this\"\n}\n```\n\n### Terraform Version Feature Matrix\n\n| Feature | Minimum Version |\n|---------|-----------------|\n| `terraform_data` resource | 1.4+ |\n| `import {}` blocks | 1.5+ |\n| `check {}` blocks | 1.5+ |\n| Native testing (`.tftest.hcl`) | 1.6+ |\n| Test mocking | 1.7+ |\n| `removed {}` blocks | 1.7+ |\n| Provider-defined functions | 1.8+ |\n| Cross-type refactoring | 1.8+ |\n| Enhanced variable validations | 1.9+ |\n| `templatestring` function | 1.9+ |\n| Ephemeral resources | 1.10+ |\n| Write-only arguments | 1.11+ |\n| S3 native state locking | 1.11+ |\n| Import blocks with `for_each` | 1.12+ |\n| Actions block | 1.14+ |\n| List resources (`tfquery.hcl`) | 1.14+ |\n| `terraform query` command | 1.14+ |\n\n## Modern Terraform Features (1.8+)\n\n### Provider-Defined Functions (Terraform 1.8+)\n\nProvider-defined functions extend Terraform's built-in functions with provider-specific logic.\n\n**Syntax:** `provider::\u003Cprovider_name>::\u003Cfunction_name>(arguments)`\n\n```hcl\n# AWS Provider Functions (v5.40+)\nlocals {\n  # Parse an ARN into components\n  parsed_arn = provider::aws::arn_parse(aws_instance.web.arn)\n  account_id = local.parsed_arn.account\n  region     = local.parsed_arn.region\n\n  # Build an ARN from components\n  custom_arn = provider::aws::arn_build({\n    partition = \"aws\"\n    service   = \"s3\"\n    region    = \"\"\n    account   = \"\"\n    resource  = \"my-bucket\u002Fmy-key\"\n  })\n}\n\n# Google Cloud Provider Functions (v5.23+)\nlocals {\n  # Extract region from zone\n  region = provider::google::region_from_zone(var.zone)  # \"us-west1-a\" → \"us-west1\"\n}\n\n# Kubernetes Provider Functions (v2.28+)\nlocals {\n  # Encode HCL to Kubernetes manifest YAML\n  manifest_yaml = provider::kubernetes::manifest_encode(local.deployment_config)\n}\n```\n\n### Ephemeral Resources (Terraform 1.10+)\n\nEphemeral resources provide temporary values that are **never persisted** in state or plan files. Critical for handling secrets securely.\n\n```hcl\n# Generate a password that never touches state\nephemeral \"random_password\" \"db_password\" {\n  length           = 16\n  special          = true\n  override_special = \"!#$%&*()-_=+[]{}\u003C>:?\"\n}\n\n# Fetch secrets ephemerally from AWS Secrets Manager\nephemeral \"aws_secretsmanager_secret_version\" \"api_key\" {\n  secret_id = aws_secretsmanager_secret.api_key.id\n}\n\n# Ephemeral variables (declare with ephemeral = true)\nvariable \"temporary_token\" {\n  type      = string\n  ephemeral = true  # Value won't be stored in state\n}\n\n# Ephemeral outputs\noutput \"session_token\" {\n  value     = ephemeral.aws_secretsmanager_secret_version.api_key.secret_string\n  ephemeral = true  # Won't be stored in state\n}\n```\n\n### Write-Only Arguments (Terraform 1.11+)\n\nWrite-only arguments accept ephemeral values and are never persisted. They use `_wo` suffix and require a version attribute.\n\n```hcl\nterraform {\n  required_version = \">= 1.11, \u003C 2.0\"\n}\n\n# Secure database password handling\nephemeral \"random_password\" \"db_password\" {\n  length = 16\n}\n\nresource \"aws_db_instance\" \"main\" {\n  identifier        = \"mydb\"\n  instance_class    = \"db.t3.micro\"\n  allocated_storage = 20\n  engine            = \"postgres\"\n  username          = \"admin\"\n\n  # Write-only password - never stored in state!\n  password_wo         = ephemeral.random_password.db_password.result\n  password_wo_version = 1  # Increment to trigger password rotation\n\n  skip_final_snapshot = true\n}\n\n# Secrets Manager with write-only\nresource \"aws_secretsmanager_secret_version\" \"db_password\" {\n  secret_id = aws_secretsmanager_secret.db_password.id\n\n  # Write-only secret string\n  secret_string_wo         = ephemeral.random_password.db_password.result\n  secret_string_wo_version = 1\n}\n```\n\n### Enhanced Variable Validations (Terraform 1.9+)\n\nValidation conditions can now reference other variables, data sources, and local values.\n\n```hcl\n# Reference data sources in validation\ndata \"aws_ec2_instance_type_offerings\" \"available\" {\n  filter {\n    name   = \"location\"\n    values = [var.availability_zone]\n  }\n}\n\nvariable \"instance_type\" {\n  type        = string\n  description = \"EC2 instance type\"\n\n  validation {\n    # NEW: Can reference data sources\n    condition = contains(\n      data.aws_ec2_instance_type_offerings.available.instance_types,\n      var.instance_type\n    )\n    error_message = \"Instance type ${var.instance_type} is not available in the selected AZ.\"\n  }\n}\n\n# Cross-variable validation\nvariable \"min_instances\" {\n  type    = number\n  default = 1\n}\n\nvariable \"max_instances\" {\n  type    = number\n  default = 10\n\n  validation {\n    # NEW: Can reference other variables\n    condition     = var.max_instances >= var.min_instances\n    error_message = \"max_instances must be >= min_instances\"\n  }\n}\n```\n\n### S3 Native State Locking (Terraform 1.11+)\n\nS3 now supports native state locking without DynamoDB.\n\n```hcl\nterraform {\n  backend \"s3\" {\n    bucket       = \"my-terraform-state\"\n    key          = \"project\u002Fterraform.tfstate\"\n    region       = \"us-east-1\"\n    encrypt      = true\n\n    # NEW: S3-native locking (Terraform 1.11+)\n    use_lockfile = true\n\n    # DEPRECATED: DynamoDB locking (still works but no longer required)\n    # dynamodb_table = \"terraform-locks\"\n  }\n}\n```\n\n### Import Blocks (Terraform 1.5+)\n\nDeclarative resource imports without command-line operations.\n\n```hcl\n# Import existing resources declaratively\nimport {\n  to = aws_instance.web\n  id = \"i-1234567890abcdef0\"\n}\n\nresource \"aws_instance\" \"web\" {\n  ami           = \"ami-0c55b159cbfafe1f0\"\n  instance_type = \"t3.micro\"\n  # ... configuration must match existing resource\n}\n\n# Import with for_each\nimport {\n  for_each = var.existing_bucket_names\n  to       = aws_s3_bucket.imported[each.key]\n  id       = each.value\n}\n```\n\n### Moved and Removed Blocks\n\nSafely refactor resources without destroying them.\n\n```hcl\n# Rename a resource\nmoved {\n  from = aws_instance.old_name\n  to   = aws_instance.new_name\n}\n\n# Move to a module\nmoved {\n  from = aws_vpc.main\n  to   = module.networking.aws_vpc.main\n}\n\n# Cross-type refactoring (1.8+)\nmoved {\n  from = null_resource.example\n  to   = terraform_data.example\n}\n\n# Remove resource from state without destroying (1.7+)\nremoved {\n  from = aws_instance.legacy\n\n  lifecycle {\n    destroy = false  # Keep the actual resource, just remove from state\n  }\n}\n```\n\n### Import Blocks with for_each (Terraform 1.12+)\n\nImport multiple resources using `for_each` meta-argument.\n\n```hcl\n# Import multiple S3 buckets using a map\nlocals {\n  buckets = {\n    \"staging\" = \"bucket1\"\n    \"uat\"     = \"bucket2\"\n    \"prod\"    = \"bucket3\"\n  }\n}\n\nimport {\n  for_each = local.buckets\n  to       = aws_s3_bucket.this[each.key]\n  id       = each.value\n}\n\nresource \"aws_s3_bucket\" \"this\" {\n  for_each = local.buckets\n}\n\n# Import across module instances using list of objects\nlocals {\n  module_buckets = [\n    { group = \"one\", key = \"bucket1\", id = \"one_1\" },\n    { group = \"one\", key = \"bucket2\", id = \"one_2\" },\n    { group = \"two\", key = \"bucket1\", id = \"two_1\" },\n  ]\n}\n\nimport {\n  for_each = local.module_buckets\n  id       = each.value.id\n  to       = module.group[each.value.group].aws_s3_bucket.this[each.value.key]\n}\n```\n\n### Actions Block (Terraform 1.14+)\n\nActions enable provider-defined operations outside the standard CRUD model. Use for operations like Lambda invocations, cache invalidations, or database backups.\n\n```hcl\n# Invoke a Lambda function (example syntax)\naction \"aws_lambda_invoke\" \"process_data\" {\n  function_name = aws_lambda_function.processor.function_name\n  payload       = jsonencode({ action = \"process\" })\n}\n\n# Create CloudFront invalidation\naction \"aws_cloudfront_create_invalidation\" \"invalidate_cache\" {\n  distribution_id = aws_cloudfront_distribution.main.id\n  paths           = [\"\u002F*\"]\n}\n\n# Actions support for_each\naction \"aws_lambda_invoke\" \"batch_process\" {\n  for_each = toset([\"task1\", \"task2\", \"task3\"])\n\n  function_name = aws_lambda_function.processor.function_name\n  payload       = jsonencode({ task = each.value })\n}\n```\n\n**Triggering Actions via Lifecycle:**\n\nUse `action_trigger` within a resource's lifecycle block to automatically invoke actions:\n\n```hcl\nresource \"aws_lambda_function\" \"example\" {\n  function_name = \"my-function\"\n  # ... other config ...\n\n  lifecycle {\n    action_trigger {\n      events  = [after_create, after_update]\n      actions = [action.aws_lambda_invoke.process_data]\n    }\n  }\n}\n\naction \"aws_lambda_invoke\" \"process_data\" {\n  function_name = aws_lambda_function.example.function_name\n  payload       = jsonencode({ action = \"initialize\" })\n}\n```\n\n**Manual Invocation:**\n\nActions can also be invoked manually via CLI:\n\n```bash\nterraform apply -invoke action.aws_lambda_invoke.process_data\n```\n\n### List Resources and Query Command (Terraform 1.14+)\n\nQuery and filter existing infrastructure using `.tfquery.hcl` files and the `terraform query` command.\n\n```hcl\n# my-resources.tfquery.hcl\n# Define list resources to query existing infrastructure\n\nlist \"aws_instance\" \"web_servers\" {\n  filter {\n    name   = \"tag:Environment\"\n    values = [var.environment]\n  }\n\n  include_resource = true  # Include full resource details\n}\n\nlist \"aws_s3_bucket\" \"data_buckets\" {\n  filter {\n    name   = \"tag:Purpose\"\n    values = [\"data-storage\"]\n  }\n}\n```\n\n```bash\n# Query infrastructure and output results\nterraform query\n\n# Generate import configuration from query results\nterraform query -generate-config-out=\"import_config.tf\"\n\n# Output in JSON format\nterraform query -json\n\n# Use with variables\nterraform query -var 'environment=prod'\n```\n\n### Preconditions and Postconditions (Terraform 1.5+)\n\nAdd custom validation within resource lifecycle.\n\n```hcl\nresource \"aws_instance\" \"example\" {\n  instance_type = \"t3.micro\"\n  ami           = data.aws_ami.example.id\n\n  lifecycle {\n    # Check before creation\n    precondition {\n      condition     = data.aws_ami.example.architecture == \"x86_64\"\n      error_message = \"The selected AMI must be for the x86_64 architecture.\"\n    }\n\n    # Verify after creation\n    postcondition {\n      condition     = self.public_dns != \"\"\n      error_message = \"EC2 instance must be in a VPC that has public DNS hostnames enabled.\"\n    }\n  }\n}\n\n# Preconditions on outputs\noutput \"web_url\" {\n  value = \"https:\u002F\u002F${aws_instance.web.public_dns}\"\n\n  precondition {\n    condition     = aws_instance.web.public_dns != \"\"\n    error_message = \"Instance must have a public DNS name.\"\n  }\n}\n```\n\n## Resources\n\n### references\u002F\n\nThe `references\u002F` directory contains detailed documentation for reference:\n\n- `terraform_best_practices.md` - Comprehensive best practices guide\n- `common_patterns.md` - Common Terraform patterns and examples\n- `provider_examples.md` - Example configurations for popular providers\n\nOpen a reference directly by relative path:\n```\ndevops-skills-plugin\u002Fskills\u002Fterraform-generator\u002Freferences\u002F[filename].md\n```\n\n### assets\u002F\n\nThe `assets\u002F` directory contains template files:\n\n- `minimal-project\u002F` - Minimal Terraform project template\n\nTemplates can be copied and customized for the user's specific needs.\n\n## Notes\n\n- Always run devops-skills:terraform-validator after generation\n- For feature\u002Fversion drift checks in CI, run `bash scripts\u002Frun_ci_checks.sh`\n- Web search is essential for custom providers\u002Fmodules\n- Follow the principle of least surprise in configurations\n- Make configurations readable and maintainable\n- Include helpful comments and documentation\n- Generate realistic examples in terraform.tfvars when helpful\n",{"name":5,"description":7},"master","c73386b305dec167db7654e0e6feacb462d4f9dc","assets\u002Fskills\u002Fdevops\u002Fterraform-generator",1,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code","https:\u002F\u002Fgithub.com\u002FAntifragileTech","2026-10-02 14:22:14",{"source":8,"skillName":5,"commands":44,"prompt":54,"zipAvailable":55},[45,48,51],{"tool":46,"command":47},"npx","npx skills add AntifragileTech\u002Fantifragile-claude-code --skill terraform-generator",{"tool":49,"command":50},"bunx","bunx skills add AntifragileTech\u002Fantifragile-claude-code --skill terraform-generator",{"tool":52,"command":53},"pnpm","pnpm dlx skills add AntifragileTech\u002Fantifragile-claude-code --skill terraform-generator","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-generator\u002FSKILL.md",true,[57,63,67,71,75,79,83,87,93,97,101,105,111,115],{"path":58,"resourceType":59,"resourceTypeDesc":60,"sizeBytes":61,"sourceHtmlUrl":62},"assets\u002Fminimal-project\u002Fmain.tf","ASSET","资产文件",263,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-generator\u002Fassets\u002Fminimal-project\u002Fmain.tf",{"path":64,"resourceType":59,"resourceTypeDesc":60,"sizeBytes":65,"sourceHtmlUrl":66},"assets\u002Fminimal-project\u002Foutputs.tf",257,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-generator\u002Fassets\u002Fminimal-project\u002Foutputs.tf",{"path":68,"resourceType":59,"resourceTypeDesc":60,"sizeBytes":69,"sourceHtmlUrl":70},"assets\u002Fminimal-project\u002FREADME.md",723,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-generator\u002Fassets\u002Fminimal-project\u002FREADME.md",{"path":72,"resourceType":59,"resourceTypeDesc":60,"sizeBytes":73,"sourceHtmlUrl":74},"assets\u002Fminimal-project\u002Fterraform.tfvars.example",245,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-generator\u002Fassets\u002Fminimal-project\u002Fterraform.tfvars.example",{"path":76,"resourceType":59,"resourceTypeDesc":60,"sizeBytes":77,"sourceHtmlUrl":78},"assets\u002Fminimal-project\u002Fvariables.tf",534,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-generator\u002Fassets\u002Fminimal-project\u002Fvariables.tf",{"path":80,"resourceType":59,"resourceTypeDesc":60,"sizeBytes":81,"sourceHtmlUrl":82},"assets\u002Fminimal-project\u002Fversions.tf",728,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-generator\u002Fassets\u002Fminimal-project\u002Fversions.tf",{"path":84,"resourceType":59,"resourceTypeDesc":60,"sizeBytes":85,"sourceHtmlUrl":86},"assets\u002FREADME.md",1329,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-generator\u002Fassets\u002FREADME.md",{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"index.json","REFERENCE","参考文档",543,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux-fs-ntfs-usnjrnl-analyze\u002Findex.json",{"path":94,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fcommon_patterns.md",20391,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-generator\u002Freferences\u002Fcommon_patterns.md",{"path":98,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fprovider_examples.md",20108,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-generator\u002Freferences\u002Fprovider_examples.md",{"path":102,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fterraform_best_practices.md",17356,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-generator\u002Freferences\u002Fterraform_best_practices.md",{"path":106,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":109,"sourceHtmlUrl":110},"scripts\u002Fcheck_feature_version_consistency.sh","SCRIPT","脚本",4636,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-generator\u002Fscripts\u002Fcheck_feature_version_consistency.sh",{"path":112,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":113,"sourceHtmlUrl":114},"scripts\u002Frun_ci_checks.sh",1651,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-generator\u002Fscripts\u002Frun_ci_checks.sh",{"path":116,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":117,"sourceHtmlUrl":118},"tests\u002Ftest_feature_version_consistency.sh",4218,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fdevops\u002Fterraform-generator\u002Ftests\u002Ftest_feature_version_consistency.sh",[120,144,159,173,186,199],{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":137,"publishedAt":31},"01M6DT9Q6VYA615SCXR757TZZ7","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwriting-skills\u002FSKILL.md",[126,129,132],{"categoryNo":127,"categoryName":128,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":130,"categoryName":131,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":133,"categoryName":134,"taxonomyType":135,"taxonomyTypeDesc":136},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[138,139,140,141,142,143],"writing skills","writing","use","editing","work","deployment",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":152,"publishedAt":31},"01M6DT9GFHDNY90P41WGAE1TV0","writing-plans","Use when you have a spec or requirements for a multi-step task, before touching code","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwriting-plans\u002FSKILL.md",[150,151],{"categoryNo":130,"categoryName":131,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":133,"categoryName":134,"taxonomyType":135,"taxonomyTypeDesc":136},[153,154,139,155,156,140,157,158],"plans","writing plans","requirements","task","code","spec",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":167,"publishedAt":31},"01M6DT9C6PFGD86WS3HY7YE3XG","docs:write-concisely","Apply writing rules to any documentation that humans will read. Makes your writing clearer, stronger, and more professional.","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwrite-concisely\u002FSKILL.md",[165,166],{"categoryNo":130,"categoryName":131,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":133,"categoryName":134,"taxonomyType":135,"taxonomyTypeDesc":136},[168,29,169,170,171,172,139],"docs:write concisely","docs","read","Rules","documentation",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":179,"publishedAt":31},"01M6DT98AWQ27P0N1CG97WAG66","kaizen:why","Iterative Five Whys root cause analysis drilling from symptoms to fundamentals","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwhy\u002FSKILL.md",[],[175,180,181,182,183,184,185],"why","kaizen","issue","five whys","analysis","root cause analysis",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":192,"publishedAt":31},"01M6DT93EH25NAX19R3WGE1P53","verification-loop","A comprehensive verification system for Claude Code sessions.","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fverification-loop\u002FSKILL.md",[],[193,194,195,196,157,197,198],"verification loop","verification","loop","sessions","claude code sessions","system",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":205,"publishedAt":31},"01M6DT90GW7Z7VCN98P9DVYSNC","verification-before-completion","Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fverification-before-completion\u002FSKILL.md",[],[206,194,207,142,140,208,209,210],"verification before completion","commands","evidence","claim","complete"]