[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F7TZJSVJ6YZ2DJCKWNMD9J":3,"skill-same:01M6F7TZJSVJ6YZ2DJCKWNMD9J":69},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":28,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":13,"repositoryHtmlUrl":51,"repositoryHomepageUrl":52,"ownerHtmlUrl":53,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":54,"install":55,"resources":68},"01M6F7TZJSVJ6YZ2DJCKWNMD9J","terraform-skill",null,"Terraform infrastructure as code best practices","Alexsander532\u002FAtlas","Alexsander532","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82379968?v=4","01M6CG7JYPV0YXD98QNPA9J15G","01M6CG7K3NPSKD4A9NDWBP6A8E",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FAlexsander532\u002FAtlas\u002Fblob\u002Fmain\u002Fskills_antigravity\u002Fskills\u002Fterraform-skill\u002FSKILL.md",[17,22,25],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":26,"categoryName":27,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[29,30,31,32,33,34,35,36,37,38,39],"terraform","terraform skill","safe","github","infrastructure","code","best practices","infrastructure as code","https","terraform infrastructure","as","2026-11-10 10:12:30",false,"---\nname: terraform-skill\ndescription: \"Terraform infrastructure as code best practices\"\nlicense: Apache-2.0\nmetadata: \nauthor: \"Anton Babenko\"\nversion: 1.5.0\nsource: \"https:\u002F\u002Fgithub.com\u002Fantonbabenko\u002Fterraform-skill\"\nrisk: safe\n---\n# Terraform Skill for Claude\n\nComprehensive Terraform and OpenTofu guidance covering testing, modules, CI\u002FCD, and production patterns. Based on terraform-best-practices.com and enterprise experience.\n\n## When to Use This Skill\n\n**Activate this skill when:**\n- Creating new Terraform or OpenTofu configurations or modules\n- Setting up testing infrastructure for IaC code\n- Deciding between testing approaches (validate, plan, frameworks)\n- Structuring multi-environment deployments\n- Implementing CI\u002FCD for infrastructure-as-code\n- Reviewing or refactoring existing Terraform\u002FOpenTofu projects\n- Choosing between module patterns or state management approaches\n\n**Don't use this skill for:**\n- Basic Terraform\u002FOpenTofu syntax questions (Claude knows this)\n- Provider-specific API reference (link to docs instead)\n- Cloud platform questions unrelated to Terraform\u002FOpenTofu\n\n## Core Principles\n\n### 1. Code Structure Philosophy\n\n**Module Hierarchy:**\n\n| Type | When to Use | Scope |\n|------|-------------|-------|\n| **Resource Module** | Single logical group of connected resources | VPC + subnets, Security group + rules |\n| **Infrastructure Module** | Collection of resource modules for a purpose | Multiple resource modules in one region\u002Faccount |\n| **Composition** | Complete infrastructure | Spans multiple regions\u002Faccounts |\n\n**Hierarchy:** Resource → Resource Module → Infrastructure Module → Composition\n\n**Directory Structure:**\n```\nenvironments\u002F        # Environment-specific configurations\n├── prod\u002F\n├── staging\u002F\n└── dev\u002F\n\nmodules\u002F            # Reusable modules\n├── networking\u002F\n├── compute\u002F\n└── data\u002F\n\nexamples\u002F           # Module usage examples (also serve as tests)\n├── complete\u002F\n└── minimal\u002F\n```\n\n**Key principle from terraform-best-practices.com:**\n- Separate **environments** (prod, staging) from **modules** (reusable components)\n- Use **examples\u002F** as both documentation and integration test fixtures\n- Keep modules small and focused (single responsibility)\n\n**For detailed module architecture, see:** [Code Patterns: Module Types & Hierarchy](references\u002Fcode-patterns.md)\n\n### 2. Naming Conventions\n\n**Resources:**\n```hcl\n# Good: Descriptive, contextual\nresource \"aws_instance\" \"web_server\" { }\nresource \"aws_s3_bucket\" \"application_logs\" { }\n\n# Good: \"this\" for singleton resources (only one of that type)\nresource \"aws_vpc\" \"this\" { }\nresource \"aws_security_group\" \"this\" { }\n\n# Avoid: Generic names for non-singletons\nresource \"aws_instance\" \"main\" { }\nresource \"aws_s3_bucket\" \"bucket\" { }\n```\n\n**Singleton Resources:**\n\nUse `\"this\"` when your module creates only one resource of that type:\n\n✅ DO:\n```hcl\nresource \"aws_vpc\" \"this\" {}           # Module creates one VPC\nresource \"aws_security_group\" \"this\" {}  # Module creates one SG\n```\n\n❌ DON'T use \"this\" for multiple resources:\n```hcl\nresource \"aws_subnet\" \"this\" {}  # If creating multiple subnets\n```\n\nUse descriptive names when creating multiple resources of the same type.\n\n**Variables:**\n```hcl\n# Prefix with context when needed\nvar.vpc_cidr_block          # Not just \"cidr\"\nvar.database_instance_class # Not just \"instance_class\"\n```\n\n**Files:**\n- `main.tf` - Primary resources\n- `variables.tf` - Input variables\n- `outputs.tf` - Output values\n- `versions.tf` - Provider versions\n- `data.tf` - Data sources (optional)\n\n## Testing Strategy Framework\n\n### Decision Matrix: Which Testing Approach?\n\n| Your Situation | Recommended Approach | Tools | Cost |\n|----------------|---------------------|-------|------|\n| **Quick syntax check** | Static analysis | `terraform validate`, `fmt` | Free |\n| **Pre-commit validation** | Static + lint | `validate`, `tflint`, `trivy`, `checkov` | Free |\n| **Terraform 1.6+, simple logic** | Native test framework | Built-in `terraform test` | Free-Low |\n| **Pre-1.6, or Go expertise** | Integration testing | Terratest | Low-Med |\n| **Security\u002Fcompliance focus** | Policy as code | OPA, Sentinel | Free |\n| **Cost-sensitive workflow** | Mock providers (1.7+) | Native tests + mocking | Free |\n| **Multi-cloud, complex** | Full integration | Terratest + real infra | Med-High |\n\n### Testing Pyramid for Infrastructure\n\n```\n        \u002F\\\n       \u002F  \\          End-to-End Tests (Expensive)\n      \u002F____\\         - Full environment deployment\n     \u002F      \\        - Production-like setup\n    \u002F________\\\n   \u002F          \\      Integration Tests (Moderate)\n  \u002F____________\\     - Module testing in isolation\n \u002F              \\    - Real resources in test account\n\u002F________________\\   Static Analysis (Cheap)\n                     - validate, fmt, lint\n                     - Security scanning\n```\n\n### Native Test Best Practices (1.6+)\n\n**Before generating test code:**\n\n1. **Validate schemas with Terraform MCP:**\n   ```\n   Search provider docs → Get resource schema → Identify block types\n   ```\n\n2. **Choose correct command mode:**\n   - `command = plan` - Fast, for input validation\n   - `command = apply` - Required for computed values and set-type blocks\n\n3. **Handle set-type blocks correctly:**\n   - Cannot index with `[0]`\n   - Use `for` expressions to iterate\n   - Or use `command = apply` to materialize\n\n**Common patterns:**\n- S3 encryption rules: **set** (use for expressions)\n- Lifecycle transitions: **set** (use for expressions)\n- IAM policy statements: **set** (use for expressions)\n\n**For detailed testing guides, see:**\n- **[Testing Frameworks Guide](references\u002Ftesting-frameworks.md)** - Deep dive into static analysis, native tests, and Terratest\n- **[Quick Reference](references\u002Fquick-reference.md#testing-approach-selection)** - Decision flowchart and command cheat sheet\n\n## Code Structure Standards\n\n### Resource Block Ordering\n\n**Strict ordering for consistency:**\n1. `count` or `for_each` FIRST (blank line after)\n2. Other arguments\n3. `tags` as last real argument\n4. `depends_on` after tags (if needed)\n5. `lifecycle` at the very end (if needed)\n\n```hcl\n# ✅ GOOD - Correct ordering\nresource \"aws_nat_gateway\" \"this\" {\n  count = var.create_nat_gateway ? 1 : 0\n\n  allocation_id = aws_eip.this[0].id\n  subnet_id     = aws_subnet.public[0].id\n\n  tags = {\n    Name = \"${var.name}-nat\"\n  }\n\n  depends_on = [aws_internet_gateway.this]\n\n  lifecycle {\n    create_before_destroy = true\n  }\n}\n```\n\n### Variable Block Ordering\n\n1. `description` (ALWAYS required)\n2. `type`\n3. `default`\n4. `validation`\n5. `nullable` (when setting to false)\n\n```hcl\nvariable \"environment\" {\n  description = \"Environment name for resource tagging\"\n  type        = string\n  default     = \"dev\"\n\n  validation {\n    condition     = contains([\"dev\", \"staging\", \"prod\"], var.environment)\n    error_message = \"Environment must be one of: dev, staging, prod.\"\n  }\n\n  nullable = false\n}\n```\n\n**For complete structure guidelines, see:** [Code Patterns: Block Ordering & Structure](references\u002Fcode-patterns.md#block-ordering--structure)\n\n## Count vs For_Each: When to Use Each\n\n### Quick Decision Guide\n\n| Scenario | Use | Why |\n|----------|-----|-----|\n| Boolean condition (create or don't) | `count = condition ? 1 : 0` | Simple on\u002Foff toggle |\n| Simple numeric replication | `count = 3` | Fixed number of identical resources |\n| Items may be reordered\u002Fremoved | `for_each = toset(list)` | Stable resource addresses |\n| Reference by key | `for_each = map` | Named access to resources |\n| Multiple named resources | `for_each` | Better maintainability |\n\n### Common Patterns\n\n**Boolean conditions:**\n```hcl\n# ✅ GOOD - Boolean condition\nresource \"aws_nat_gateway\" \"this\" {\n  count = var.create_nat_gateway ? 1 : 0\n  # ...\n}\n```\n\n**Stable addressing with for_each:**\n```hcl\n# ✅ GOOD - Removing \"us-east-1b\" only affects that subnet\nresource \"aws_subnet\" \"private\" {\n  for_each = toset(var.availability_zones)\n\n  availability_zone = each.key\n  # ...\n}\n\n# ❌ BAD - Removing middle AZ recreates all subsequent subnets\nresource \"aws_subnet\" \"private\" {\n  count = length(var.availability_zones)\n\n  availability_zone = var.availability_zones[count.index]\n  # ...\n}\n```\n\n**For migration guides and detailed examples, see:** [Code Patterns: Count vs For_Each](references\u002Fcode-patterns.md#count-vs-for_each-deep-dive)\n\n## Locals for Dependency Management\n\n**Use locals to ensure correct resource deletion order:**\n\n```hcl\n# Problem: Subnets might be deleted after CIDR blocks, causing errors\n# Solution: Use try() in locals to hint deletion order\n\nlocals {\n  # References secondary CIDR first, falling back to VPC\n  # Forces Terraform to delete subnets before CIDR association\n  vpc_id = try(\n    aws_vpc_ipv4_cidr_block_association.this[0].vpc_id,\n    aws_vpc.this.id,\n    \"\"\n  )\n}\n\nresource \"aws_vpc\" \"this\" {\n  cidr_block = \"10.0.0.0\u002F16\"\n}\n\nresource \"aws_vpc_ipv4_cidr_block_association\" \"this\" {\n  count = var.add_secondary_cidr ? 1 : 0\n\n  vpc_id     = aws_vpc.this.id\n  cidr_block = \"10.1.0.0\u002F16\"\n}\n\nresource \"aws_subnet\" \"public\" {\n  vpc_id     = local.vpc_id  # Uses local, not direct reference\n  cidr_block = \"10.1.0.0\u002F24\"\n}\n```\n\n**Why this matters:**\n- Prevents deletion errors when destroying infrastructure\n- Ensures correct dependency order without explicit `depends_on`\n- Particularly useful for VPC configurations with secondary CIDR blocks\n\n**For detailed examples, see:** [Code Patterns: Locals for Dependency Management](references\u002Fcode-patterns.md#locals-for-dependency-management)\n\n## Module Development\n\n### Standard Module Structure\n\n```\nmy-module\u002F\n├── README.md           # Usage documentation\n├── main.tf             # Primary resources\n├── variables.tf        # Input variables with descriptions\n├── outputs.tf          # Output values\n├── versions.tf         # Provider version constraints\n├── examples\u002F\n│   ├── minimal\u002F        # Minimal working example\n│   └── complete\u002F       # Full-featured example\n└── tests\u002F              # Test files\n    └── module_test.tftest.hcl  # Or .go\n```\n\n### Best Practices Summary\n\n**Variables:**\n- ✅ Always include `description`\n- ✅ Use explicit `type` constraints\n- ✅ Provide sensible `default` values where appropriate\n- ✅ Add `validation` blocks for complex constraints\n- ✅ Use `sensitive = true` for secrets\n\n**Outputs:**\n- ✅ Always include `description`\n- ✅ Mark sensitive outputs with `sensitive = true`\n- ✅ Consider returning objects for related values\n- ✅ Document what consumers should do with each output\n\n**For detailed module patterns, see:**\n- **[Module Patterns Guide](references\u002Fmodule-patterns.md)** - Variable best practices, output design, ✅ DO vs ❌ DON'T patterns\n- **[Quick Reference](references\u002Fquick-reference.md#common-patterns)** - Resource naming, variable naming, file organization\n\n## CI\u002FCD Integration\n\n### Recommended Workflow Stages\n\n1. **Validate** - Format check + syntax validation + linting\n2. **Test** - Run automated tests (native or Terratest)\n3. **Plan** - Generate and review execution plan\n4. **Apply** - Execute changes (with approvals for production)\n\n### Cost Optimization Strategy\n\n1. **Use mocking for PR validation** (free)\n2. **Run integration tests only on main branch** (controlled cost)\n3. **Implement auto-cleanup** (prevent orphaned resources)\n4. **Tag all test resources** (track spending)\n\n**For complete CI\u002FCD templates, see:**\n- **[CI\u002FCD Workflows Guide](references\u002Fci-cd-workflows.md)** - GitHub Actions, GitLab CI, Atlantis integration, cost optimization\n- **[Quick Reference](references\u002Fquick-reference.md#troubleshooting-guide)** - Common CI\u002FCD issues and solutions\n\n## Security & Compliance\n\n### Essential Security Checks\n\n```bash\n# Static security scanning\ntrivy config .\ncheckov -d .\n```\n\n### Common Issues to Avoid\n\n❌ **Don't:**\n- Store secrets in variables\n- Use default VPC\n- Skip encryption\n- Open security groups to 0.0.0.0\u002F0\n\n✅ **Do:**\n- Use AWS Secrets Manager \u002F Parameter Store\n- Create dedicated VPCs\n- Enable encryption at rest\n- Use least-privilege security groups\n\n**For detailed security guidance, see:**\n- **[Security & Compliance Guide](references\u002Fsecurity-compliance.md)** - Trivy\u002FCheckov integration, secrets management, state file security, compliance testing\n\n## Version Management\n\n### Version Constraint Syntax\n\n```hcl\nversion = \"5.0.0\"      # Exact (avoid - inflexible)\nversion = \"~> 5.0\"     # Recommended: 5.0.x only\nversion = \">= 5.0\"     # Minimum (risky - breaking changes)\n```\n\n### Strategy by Component\n\n| Component | Strategy | Example |\n|-----------|----------|---------|\n| **Terraform** | Pin minor version | `required_version = \"~> 1.9\"` |\n| **Providers** | Pin major version | `version = \"~> 5.0\"` |\n| **Modules (prod)** | Pin exact version | `version = \"5.1.2\"` |\n| **Modules (dev)** | Allow patch updates | `version = \"~> 5.1\"` |\n\n### Update Workflow\n\n```bash\n# Lock versions initially\nterraform init              # Creates .terraform.lock.hcl\n\n# Update to latest within constraints\nterraform init -upgrade     # Updates providers\n\n# Review and test\nterraform plan\n```\n\n**For detailed version management, see:** [Code Patterns: Version Management](references\u002Fcode-patterns.md#version-management)\n\n## Modern Terraform Features (1.0+)\n\n### Feature Availability by Version\n\n| Feature | Version | Use Case |\n|---------|---------|----------|\n| `try()` function | 0.13+ | Safe fallbacks, replaces `element(concat())` |\n| `nullable = false` | 1.1+ | Prevent null values in variables |\n| `moved` blocks | 1.1+ | Refactor without destroy\u002Frecreate |\n| `optional()` with defaults | 1.3+ | Optional object attributes |\n| Native testing | 1.6+ | Built-in test framework |\n| Mock providers | 1.7+ | Cost-free unit testing |\n| Provider functions | 1.8+ | Provider-specific data transformation |\n| Cross-variable validation | 1.9+ | Validate relationships between variables |\n| Write-only arguments | 1.11+ | Secrets never stored in state |\n\n### Quick Examples\n\n```hcl\n# try() - Safe fallbacks (0.13+)\noutput \"sg_id\" {\n  value = try(aws_security_group.this[0].id, \"\")\n}\n\n# optional() - Optional attributes with defaults (1.3+)\nvariable \"config\" {\n  type = object({\n    name    = string\n    timeout = optional(number, 300)  # Default: 300\n  })\n}\n\n# Cross-variable validation (1.9+)\nvariable \"environment\" { type = string }\nvariable \"backup_days\" {\n  type = number\n  validation {\n    condition     = var.environment == \"prod\" ? var.backup_days >= 7 : true\n    error_message = \"Production requires backup_days >= 7\"\n  }\n}\n```\n\n**For complete patterns and examples, see:** [Code Patterns: Modern Terraform Features](references\u002Fcode-patterns.md#modern-terraform-features-10)\n\n## Version-Specific Guidance\n\n### Terraform 1.0-1.5\n- Use Terratest for testing\n- No native testing framework available\n- Focus on static analysis and plan validation\n\n### Terraform 1.6+ \u002F OpenTofu 1.6+\n- **New:** Native `terraform test` \u002F `tofu test` command\n- Consider migrating from external frameworks for simple tests\n- Keep Terratest only for complex integration tests\n\n### Terraform 1.7+ \u002F OpenTofu 1.7+\n- **New:** Mock providers for unit testing\n- Reduce cost by mocking external dependencies\n- Use real integration tests for final validation\n\n### Terraform vs OpenTofu\n\nBoth are fully supported by this skill. For licensing, governance, and feature comparison, see [Quick Reference: Terraform vs OpenTofu](references\u002Fquick-reference.md#terraform-vs-opentofu-comparison).\n\n## Detailed Guides\n\nThis skill uses **progressive disclosure** - essential information is in this main file, detailed guides are available when needed:\n\n? **Reference Files:**\n- **[Testing Frameworks](references\u002Ftesting-frameworks.md)** - In-depth guide to static analysis, native tests, and Terratest\n- **[Module Patterns](references\u002Fmodule-patterns.md)** - Module structure, variable\u002Foutput best practices, ✅ DO vs ❌ DON'T patterns\n- **[CI\u002FCD Workflows](references\u002Fci-cd-workflows.md)** - GitHub Actions, GitLab CI templates, cost optimization, automated cleanup\n- **[Security & Compliance](references\u002Fsecurity-compliance.md)** - Trivy\u002FCheckov integration, secrets management, compliance testing\n- **[Quick Reference](references\u002Fquick-reference.md)** - Command cheat sheets, decision flowcharts, troubleshooting guide\n\n**How to use:** When you need detailed information on a topic, reference the appropriate guide. Claude will load it on demand to provide comprehensive guidance.\n\n## License\n\nThis skill is licensed under the **Apache License 2.0**. See the LICENSE file for full terms.\n\n**Copyright © 2026 Anton Babenko**\n","# Terraform Skill for Claude\n\nComprehensive Terraform and OpenTofu guidance covering testing, modules, CI\u002FCD, and production patterns. Based on terraform-best-practices.com and enterprise experience.\n\n## When to Use This Skill\n\n**Activate this skill when:**\n- Creating new Terraform or OpenTofu configurations or modules\n- Setting up testing infrastructure for IaC code\n- Deciding between testing approaches (validate, plan, frameworks)\n- Structuring multi-environment deployments\n- Implementing CI\u002FCD for infrastructure-as-code\n- Reviewing or refactoring existing Terraform\u002FOpenTofu projects\n- Choosing between module patterns or state management approaches\n\n**Don't use this skill for:**\n- Basic Terraform\u002FOpenTofu syntax questions (Claude knows this)\n- Provider-specific API reference (link to docs instead)\n- Cloud platform questions unrelated to Terraform\u002FOpenTofu\n\n## Core Principles\n\n### 1. Code Structure Philosophy\n\n**Module Hierarchy:**\n\n| Type | When to Use | Scope |\n|------|-------------|-------|\n| **Resource Module** | Single logical group of connected resources | VPC + subnets, Security group + rules |\n| **Infrastructure Module** | Collection of resource modules for a purpose | Multiple resource modules in one region\u002Faccount |\n| **Composition** | Complete infrastructure | Spans multiple regions\u002Faccounts |\n\n**Hierarchy:** Resource → Resource Module → Infrastructure Module → Composition\n\n**Directory Structure:**\n```\nenvironments\u002F        # Environment-specific configurations\n├── prod\u002F\n├── staging\u002F\n└── dev\u002F\n\nmodules\u002F            # Reusable modules\n├── networking\u002F\n├── compute\u002F\n└── data\u002F\n\nexamples\u002F           # Module usage examples (also serve as tests)\n├── complete\u002F\n└── minimal\u002F\n```\n\n**Key principle from terraform-best-practices.com:**\n- Separate **environments** (prod, staging) from **modules** (reusable components)\n- Use **examples\u002F** as both documentation and integration test fixtures\n- Keep modules small and focused (single responsibility)\n\n**For detailed module architecture, see:** [Code Patterns: Module Types & Hierarchy](references\u002Fcode-patterns.md)\n\n### 2. Naming Conventions\n\n**Resources:**\n```hcl\n# Good: Descriptive, contextual\nresource \"aws_instance\" \"web_server\" { }\nresource \"aws_s3_bucket\" \"application_logs\" { }\n\n# Good: \"this\" for singleton resources (only one of that type)\nresource \"aws_vpc\" \"this\" { }\nresource \"aws_security_group\" \"this\" { }\n\n# Avoid: Generic names for non-singletons\nresource \"aws_instance\" \"main\" { }\nresource \"aws_s3_bucket\" \"bucket\" { }\n```\n\n**Singleton Resources:**\n\nUse `\"this\"` when your module creates only one resource of that type:\n\n✅ DO:\n```hcl\nresource \"aws_vpc\" \"this\" {}           # Module creates one VPC\nresource \"aws_security_group\" \"this\" {}  # Module creates one SG\n```\n\n❌ DON'T use \"this\" for multiple resources:\n```hcl\nresource \"aws_subnet\" \"this\" {}  # If creating multiple subnets\n```\n\nUse descriptive names when creating multiple resources of the same type.\n\n**Variables:**\n```hcl\n# Prefix with context when needed\nvar.vpc_cidr_block          # Not just \"cidr\"\nvar.database_instance_class # Not just \"instance_class\"\n```\n\n**Files:**\n- `main.tf` - Primary resources\n- `variables.tf` - Input variables\n- `outputs.tf` - Output values\n- `versions.tf` - Provider versions\n- `data.tf` - Data sources (optional)\n\n## Testing Strategy Framework\n\n### Decision Matrix: Which Testing Approach?\n\n| Your Situation | Recommended Approach | Tools | Cost |\n|----------------|---------------------|-------|------|\n| **Quick syntax check** | Static analysis | `terraform validate`, `fmt` | Free |\n| **Pre-commit validation** | Static + lint | `validate`, `tflint`, `trivy`, `checkov` | Free |\n| **Terraform 1.6+, simple logic** | Native test framework | Built-in `terraform test` | Free-Low |\n| **Pre-1.6, or Go expertise** | Integration testing | Terratest | Low-Med |\n| **Security\u002Fcompliance focus** | Policy as code | OPA, Sentinel | Free |\n| **Cost-sensitive workflow** | Mock providers (1.7+) | Native tests + mocking | Free |\n| **Multi-cloud, complex** | Full integration | Terratest + real infra | Med-High |\n\n### Testing Pyramid for Infrastructure\n\n```\n        \u002F\\\n       \u002F  \\          End-to-End Tests (Expensive)\n      \u002F____\\         - Full environment deployment\n     \u002F      \\        - Production-like setup\n    \u002F________\\\n   \u002F          \\      Integration Tests (Moderate)\n  \u002F____________\\     - Module testing in isolation\n \u002F              \\    - Real resources in test account\n\u002F________________\\   Static Analysis (Cheap)\n                     - validate, fmt, lint\n                     - Security scanning\n```\n\n### Native Test Best Practices (1.6+)\n\n**Before generating test code:**\n\n1. **Validate schemas with Terraform MCP:**\n   ```\n   Search provider docs → Get resource schema → Identify block types\n   ```\n\n2. **Choose correct command mode:**\n   - `command = plan` - Fast, for input validation\n   - `command = apply` - Required for computed values and set-type blocks\n\n3. **Handle set-type blocks correctly:**\n   - Cannot index with `[0]`\n   - Use `for` expressions to iterate\n   - Or use `command = apply` to materialize\n\n**Common patterns:**\n- S3 encryption rules: **set** (use for expressions)\n- Lifecycle transitions: **set** (use for expressions)\n- IAM policy statements: **set** (use for expressions)\n\n**For detailed testing guides, see:**\n- **[Testing Frameworks Guide](references\u002Ftesting-frameworks.md)** - Deep dive into static analysis, native tests, and Terratest\n- **[Quick Reference](references\u002Fquick-reference.md#testing-approach-selection)** - Decision flowchart and command cheat sheet\n\n## Code Structure Standards\n\n### Resource Block Ordering\n\n**Strict ordering for consistency:**\n1. `count` or `for_each` FIRST (blank line after)\n2. Other arguments\n3. `tags` as last real argument\n4. `depends_on` after tags (if needed)\n5. `lifecycle` at the very end (if needed)\n\n```hcl\n# ✅ GOOD - Correct ordering\nresource \"aws_nat_gateway\" \"this\" {\n  count = var.create_nat_gateway ? 1 : 0\n\n  allocation_id = aws_eip.this[0].id\n  subnet_id     = aws_subnet.public[0].id\n\n  tags = {\n    Name = \"${var.name}-nat\"\n  }\n\n  depends_on = [aws_internet_gateway.this]\n\n  lifecycle {\n    create_before_destroy = true\n  }\n}\n```\n\n### Variable Block Ordering\n\n1. `description` (ALWAYS required)\n2. `type`\n3. `default`\n4. `validation`\n5. `nullable` (when setting to false)\n\n```hcl\nvariable \"environment\" {\n  description = \"Environment name for resource tagging\"\n  type        = string\n  default     = \"dev\"\n\n  validation {\n    condition     = contains([\"dev\", \"staging\", \"prod\"], var.environment)\n    error_message = \"Environment must be one of: dev, staging, prod.\"\n  }\n\n  nullable = false\n}\n```\n\n**For complete structure guidelines, see:** [Code Patterns: Block Ordering & Structure](references\u002Fcode-patterns.md#block-ordering--structure)\n\n## Count vs For_Each: When to Use Each\n\n### Quick Decision Guide\n\n| Scenario | Use | Why |\n|----------|-----|-----|\n| Boolean condition (create or don't) | `count = condition ? 1 : 0` | Simple on\u002Foff toggle |\n| Simple numeric replication | `count = 3` | Fixed number of identical resources |\n| Items may be reordered\u002Fremoved | `for_each = toset(list)` | Stable resource addresses |\n| Reference by key | `for_each = map` | Named access to resources |\n| Multiple named resources | `for_each` | Better maintainability |\n\n### Common Patterns\n\n**Boolean conditions:**\n```hcl\n# ✅ GOOD - Boolean condition\nresource \"aws_nat_gateway\" \"this\" {\n  count = var.create_nat_gateway ? 1 : 0\n  # ...\n}\n```\n\n**Stable addressing with for_each:**\n```hcl\n# ✅ GOOD - Removing \"us-east-1b\" only affects that subnet\nresource \"aws_subnet\" \"private\" {\n  for_each = toset(var.availability_zones)\n\n  availability_zone = each.key\n  # ...\n}\n\n# ❌ BAD - Removing middle AZ recreates all subsequent subnets\nresource \"aws_subnet\" \"private\" {\n  count = length(var.availability_zones)\n\n  availability_zone = var.availability_zones[count.index]\n  # ...\n}\n```\n\n**For migration guides and detailed examples, see:** [Code Patterns: Count vs For_Each](references\u002Fcode-patterns.md#count-vs-for_each-deep-dive)\n\n## Locals for Dependency Management\n\n**Use locals to ensure correct resource deletion order:**\n\n```hcl\n# Problem: Subnets might be deleted after CIDR blocks, causing errors\n# Solution: Use try() in locals to hint deletion order\n\nlocals {\n  # References secondary CIDR first, falling back to VPC\n  # Forces Terraform to delete subnets before CIDR association\n  vpc_id = try(\n    aws_vpc_ipv4_cidr_block_association.this[0].vpc_id,\n    aws_vpc.this.id,\n    \"\"\n  )\n}\n\nresource \"aws_vpc\" \"this\" {\n  cidr_block = \"10.0.0.0\u002F16\"\n}\n\nresource \"aws_vpc_ipv4_cidr_block_association\" \"this\" {\n  count = var.add_secondary_cidr ? 1 : 0\n\n  vpc_id     = aws_vpc.this.id\n  cidr_block = \"10.1.0.0\u002F16\"\n}\n\nresource \"aws_subnet\" \"public\" {\n  vpc_id     = local.vpc_id  # Uses local, not direct reference\n  cidr_block = \"10.1.0.0\u002F24\"\n}\n```\n\n**Why this matters:**\n- Prevents deletion errors when destroying infrastructure\n- Ensures correct dependency order without explicit `depends_on`\n- Particularly useful for VPC configurations with secondary CIDR blocks\n\n**For detailed examples, see:** [Code Patterns: Locals for Dependency Management](references\u002Fcode-patterns.md#locals-for-dependency-management)\n\n## Module Development\n\n### Standard Module Structure\n\n```\nmy-module\u002F\n├── README.md           # Usage documentation\n├── main.tf             # Primary resources\n├── variables.tf        # Input variables with descriptions\n├── outputs.tf          # Output values\n├── versions.tf         # Provider version constraints\n├── examples\u002F\n│   ├── minimal\u002F        # Minimal working example\n│   └── complete\u002F       # Full-featured example\n└── tests\u002F              # Test files\n    └── module_test.tftest.hcl  # Or .go\n```\n\n### Best Practices Summary\n\n**Variables:**\n- ✅ Always include `description`\n- ✅ Use explicit `type` constraints\n- ✅ Provide sensible `default` values where appropriate\n- ✅ Add `validation` blocks for complex constraints\n- ✅ Use `sensitive = true` for secrets\n\n**Outputs:**\n- ✅ Always include `description`\n- ✅ Mark sensitive outputs with `sensitive = true`\n- ✅ Consider returning objects for related values\n- ✅ Document what consumers should do with each output\n\n**For detailed module patterns, see:**\n- **[Module Patterns Guide](references\u002Fmodule-patterns.md)** - Variable best practices, output design, ✅ DO vs ❌ DON'T patterns\n- **[Quick Reference](references\u002Fquick-reference.md#common-patterns)** - Resource naming, variable naming, file organization\n\n## CI\u002FCD Integration\n\n### Recommended Workflow Stages\n\n1. **Validate** - Format check + syntax validation + linting\n2. **Test** - Run automated tests (native or Terratest)\n3. **Plan** - Generate and review execution plan\n4. **Apply** - Execute changes (with approvals for production)\n\n### Cost Optimization Strategy\n\n1. **Use mocking for PR validation** (free)\n2. **Run integration tests only on main branch** (controlled cost)\n3. **Implement auto-cleanup** (prevent orphaned resources)\n4. **Tag all test resources** (track spending)\n\n**For complete CI\u002FCD templates, see:**\n- **[CI\u002FCD Workflows Guide](references\u002Fci-cd-workflows.md)** - GitHub Actions, GitLab CI, Atlantis integration, cost optimization\n- **[Quick Reference](references\u002Fquick-reference.md#troubleshooting-guide)** - Common CI\u002FCD issues and solutions\n\n## Security & Compliance\n\n### Essential Security Checks\n\n```bash\n# Static security scanning\ntrivy config .\ncheckov -d .\n```\n\n### Common Issues to Avoid\n\n❌ **Don't:**\n- Store secrets in variables\n- Use default VPC\n- Skip encryption\n- Open security groups to 0.0.0.0\u002F0\n\n✅ **Do:**\n- Use AWS Secrets Manager \u002F Parameter Store\n- Create dedicated VPCs\n- Enable encryption at rest\n- Use least-privilege security groups\n\n**For detailed security guidance, see:**\n- **[Security & Compliance Guide](references\u002Fsecurity-compliance.md)** - Trivy\u002FCheckov integration, secrets management, state file security, compliance testing\n\n## Version Management\n\n### Version Constraint Syntax\n\n```hcl\nversion = \"5.0.0\"      # Exact (avoid - inflexible)\nversion = \"~> 5.0\"     # Recommended: 5.0.x only\nversion = \">= 5.0\"     # Minimum (risky - breaking changes)\n```\n\n### Strategy by Component\n\n| Component | Strategy | Example |\n|-----------|----------|---------|\n| **Terraform** | Pin minor version | `required_version = \"~> 1.9\"` |\n| **Providers** | Pin major version | `version = \"~> 5.0\"` |\n| **Modules (prod)** | Pin exact version | `version = \"5.1.2\"` |\n| **Modules (dev)** | Allow patch updates | `version = \"~> 5.1\"` |\n\n### Update Workflow\n\n```bash\n# Lock versions initially\nterraform init              # Creates .terraform.lock.hcl\n\n# Update to latest within constraints\nterraform init -upgrade     # Updates providers\n\n# Review and test\nterraform plan\n```\n\n**For detailed version management, see:** [Code Patterns: Version Management](references\u002Fcode-patterns.md#version-management)\n\n## Modern Terraform Features (1.0+)\n\n### Feature Availability by Version\n\n| Feature | Version | Use Case |\n|---------|---------|----------|\n| `try()` function | 0.13+ | Safe fallbacks, replaces `element(concat())` |\n| `nullable = false` | 1.1+ | Prevent null values in variables |\n| `moved` blocks | 1.1+ | Refactor without destroy\u002Frecreate |\n| `optional()` with defaults | 1.3+ | Optional object attributes |\n| Native testing | 1.6+ | Built-in test framework |\n| Mock providers | 1.7+ | Cost-free unit testing |\n| Provider functions | 1.8+ | Provider-specific data transformation |\n| Cross-variable validation | 1.9+ | Validate relationships between variables |\n| Write-only arguments | 1.11+ | Secrets never stored in state |\n\n### Quick Examples\n\n```hcl\n# try() - Safe fallbacks (0.13+)\noutput \"sg_id\" {\n  value = try(aws_security_group.this[0].id, \"\")\n}\n\n# optional() - Optional attributes with defaults (1.3+)\nvariable \"config\" {\n  type = object({\n    name    = string\n    timeout = optional(number, 300)  # Default: 300\n  })\n}\n\n# Cross-variable validation (1.9+)\nvariable \"environment\" { type = string }\nvariable \"backup_days\" {\n  type = number\n  validation {\n    condition     = var.environment == \"prod\" ? var.backup_days >= 7 : true\n    error_message = \"Production requires backup_days >= 7\"\n  }\n}\n```\n\n**For complete patterns and examples, see:** [Code Patterns: Modern Terraform Features](references\u002Fcode-patterns.md#modern-terraform-features-10)\n\n## Version-Specific Guidance\n\n### Terraform 1.0-1.5\n- Use Terratest for testing\n- No native testing framework available\n- Focus on static analysis and plan validation\n\n### Terraform 1.6+ \u002F OpenTofu 1.6+\n- **New:** Native `terraform test` \u002F `tofu test` command\n- Consider migrating from external frameworks for simple tests\n- Keep Terratest only for complex integration tests\n\n### Terraform 1.7+ \u002F OpenTofu 1.7+\n- **New:** Mock providers for unit testing\n- Reduce cost by mocking external dependencies\n- Use real integration tests for final validation\n\n### Terraform vs OpenTofu\n\nBoth are fully supported by this skill. For licensing, governance, and feature comparison, see [Quick Reference: Terraform vs OpenTofu](references\u002Fquick-reference.md#terraform-vs-opentofu-comparison).\n\n## Detailed Guides\n\nThis skill uses **progressive disclosure** - essential information is in this main file, detailed guides are available when needed:\n\n? **Reference Files:**\n- **[Testing Frameworks](references\u002Ftesting-frameworks.md)** - In-depth guide to static analysis, native tests, and Terratest\n- **[Module Patterns](references\u002Fmodule-patterns.md)** - Module structure, variable\u002Foutput best practices, ✅ DO vs ❌ DON'T patterns\n- **[CI\u002FCD Workflows](references\u002Fci-cd-workflows.md)** - GitHub Actions, GitLab CI templates, cost optimization, automated cleanup\n- **[Security & Compliance](references\u002Fsecurity-compliance.md)** - Trivy\u002FCheckov integration, secrets management, compliance testing\n- **[Quick Reference](references\u002Fquick-reference.md)** - Command cheat sheets, decision flowcharts, troubleshooting guide\n\n**How to use:** When you need detailed information on a topic, reference the appropriate guide. Claude will load it on demand to provide comprehensive guidance.\n\n## License\n\nThis skill is licensed under the **Apache License 2.0**. See the LICENSE file for full terms.\n\n**Copyright © 2026 Anton Babenko**\n",{"name":5,"risk":31,"author":45,"source":46,"license":14,"version":47,"metadata":6,"description":7},"Anton Babenko","https:\u002F\u002Fgithub.com\u002Fantonbabenko\u002Fterraform-skill","1.5.0","main","19cb723d8d900aae5836bc8fae501515c7e072e8","skills_antigravity\u002Fskills\u002Fterraform-skill","https:\u002F\u002Fgithub.com\u002FAlexsander532\u002FAtlas","https:\u002F\u002Fatlas-murex-xi.vercel.app","https:\u002F\u002Fgithub.com\u002FAlexsander532","2026-09-28 16:37:22",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add Alexsander532\u002FAtlas --skill terraform-skill",{"tool":61,"command":62},"bunx","bunx skills add Alexsander532\u002FAtlas --skill terraform-skill",{"tool":64,"command":65},"pnpm","pnpm dlx skills add Alexsander532\u002FAtlas --skill terraform-skill","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAlexsander532\u002FAtlas\u002Fblob\u002Fmain\u002Fskills_antigravity\u002Fskills\u002Fterraform-skill\u002FSKILL.md",true,[],[70,91,135],{"skillNo":71,"name":72,"nameZh":6,"description":73,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":74,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":77,"publishedAt":40},"01M6F770YCSN1KG8X7PZ2W502N","supabase-postgres-best-practices","Postgres performance optimization and best practices from Supabase. Use this skill when writing, reviewing, or optimizing Postgres queries, schema designs, or database configurations.","MIT","https:\u002F\u002Fgithub.com\u002FAlexsander532\u002FAtlas\u002Fblob\u002Fmain\u002Fskills_antigravity\u002Fskills\u002Fpostgres-best-practices\u002FSKILL.md",[],[78,79,80,81,35,82,83,84,85,86,87,88,89,90],"postgres","postgres best practices","supabase","supabase postgres best practices","writing","performance","database","Optimization","performance optimization","use","schema","queries","postgres performance",{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":74,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":117,"publishedAt":40},"01M6CH00Y6P64CQAGY0439BTS5","content-creator","Create SEO-optimized marketing content with consistent brand voice. Includes brand voice analyzer, SEO optimizer, content frameworks, and social media templates. Use when writing blog posts, creating social media content, analyzing brand voice, optimizing SEO, planning content calendars, or when user mentions content creation, brand voice, SEO optimization, social media marketing, or content strategy.","https:\u002F\u002Fgithub.com\u002FAlexsander532\u002FAtlas\u002Fblob\u002Fmain\u002Fskills_antigravity\u002Fskills\u002Fcontent-creator\u002FSKILL.md",[97,100,103,106,111,114],{"categoryNo":98,"categoryName":99,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":101,"categoryName":102,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":104,"categoryName":105,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000019","营销推广",{"categoryNo":107,"categoryName":108,"taxonomyType":109,"taxonomyTypeDesc":110},"01JBSEEDCAT000000000000032","设计师","PROFESSION","适用职业",{"categoryNo":112,"categoryName":113,"taxonomyType":109,"taxonomyTypeDesc":110},"01JBSEEDCAT000000000000035","市场营销",{"categoryNo":115,"categoryName":116,"taxonomyType":109,"taxonomyTypeDesc":110},"01JBSEEDCAT000000000000036","内容创作者",[118,119,120,121,122,123,124,87,125,82,126,127,128,85,129,130,131,132,133,134],"content creator","content","brand","Media","content-marketing","social media","strategy","brand voice","blog","create","planning","analyzing","templates","seo optimizer","seo","social-media","voice",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":74,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":141,"publishedAt":40},"01M6CGTF6S309Z7MW5EZHDS2RS","busybox-on-windows","How to use a Win32 build of BusyBox to run many of the standard UNIX command line tools on Windows.","https:\u002F\u002Fgithub.com\u002FAlexsander532\u002FAtlas\u002Fblob\u002Fmain\u002Fskills_antigravity\u002Fskills\u002Fbusybox-on-windows\u002FSKILL.md",[],[142,143,144,145,146,147,148,149,87,150,151],"windows","busybox on windows","run","win32","command line","Tools","how","command","command line tools","build"]