[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71HTV8DH8YPDH6KGDKVF1Q2":3,"skill-same:01M71HTV8DH8YPDH6KGDKVF1Q2":101},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":59,"commitSha":60,"skillDirectory":61,"forksCount":62,"repositoryHtmlUrl":63,"repositoryHomepageUrl":64,"ownerHtmlUrl":65,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":66,"install":67,"resources":80},"01M71HTV8DH8YPDH6KGDKVF1Q2","terraform-patterns",null,"Terraform infrastructure-as-code agent skill and plugin for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw. Covers module design patterns, state management strategies, provider configuration, security hardening, policy-as-code with Sentinel\u002FOPA, and CI\u002FCD plan\u002Fapply workflows. Use when: user wants to design Terraform modules, manage state backends, review Terraform security, implement multi-region deployments, or follow IaC best practices.","marshadgani\u002FArshad.AI","marshadgani","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F275367399?v=4","01M71G2BP4YMZ4AX5YY0QBHAZH","01M71G2BPPHHFRMHQAKJTZPGK4",1,"MIT","https:\u002F\u002Fgithub.com\u002Fmarshadgani\u002FArshad.AI\u002Fblob\u002Fclaude\u002Fai-personal-assistant-main\u002F.claude\u002Fskills\u002Fclaude-skills\u002Fterraform-patterns\u002FSKILL.md",[17,22,25],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":26,"categoryName":27,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"terraform","patterns","terraform patterns","plan","2026","infrastructure-as","as","terraform infrastructure","agent skill","strategies","modules","design","infrastructure-as-code","ci","infrastructure","workflows","security","gemini cli","gemini","openclaw","2026-11-10 10:12:30",false,"---\nname: \"terraform-patterns\"\ndescription: \"Terraform infrastructure-as-code agent skill and plugin for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw. Covers module design patterns, state management strategies, provider configuration, security hardening, policy-as-code with Sentinel\u002FOPA, and CI\u002FCD plan\u002Fapply workflows. Use when: user wants to design Terraform modules, manage state backends, review Terraform security, implement multi-region deployments, or follow IaC best practices.\"\nlicense: MIT\nmetadata:\n  version: 1.0.0\n  author: Alireza Rezvani\n  category: engineering\n  updated: 2026-03-15\n---\n\n# Terraform Patterns\n\n> Predictable infrastructure. Secure state. Modules that compose. No drift.\n\nOpinionated Terraform workflow that turns sprawling HCL into well-structured, secure, production-grade infrastructure code. Covers module design, state management, provider patterns, security hardening, and CI\u002FCD integration.\n\nNot a Terraform tutorial — a set of concrete decisions about how to write infrastructure code that doesn't break at 3 AM.\n\n---\n\n## Slash Commands\n\n| Command | What it does |\n|---------|-------------|\n| `\u002Fterraform:review` | Analyze Terraform code for anti-patterns, security issues, and structure problems |\n| `\u002Fterraform:module` | Design or refactor a Terraform module with proper inputs, outputs, and composition |\n| `\u002Fterraform:security` | Audit Terraform code for security vulnerabilities, secrets exposure, and IAM misconfigurations |\n\n---\n\n## When This Skill Activates\n\nRecognize these patterns from the user:\n\n- \"Review this Terraform code\"\n- \"Design a Terraform module for...\"\n- \"My Terraform state is...\"\n- \"Set up remote state backend\"\n- \"Multi-region Terraform deployment\"\n- \"Terraform security review\"\n- \"Module structure best practices\"\n- \"Terraform CI\u002FCD pipeline\"\n- Any request involving: `.tf` files, HCL, Terraform modules, state management, provider configuration, infrastructure-as-code\n\nIf the user has `.tf` files or wants to provision infrastructure with Terraform → this skill applies.\n\n---\n\n## Workflow\n\n### `\u002Fterraform:review` — Terraform Code Review\n\n1. **Analyze current state**\n   - Read all `.tf` files in the target directory\n   - Identify module structure (flat vs nested)\n   - Count resources, data sources, variables, outputs\n   - Check naming conventions\n\n2. **Apply review checklist**\n\n   ```\n   MODULE STRUCTURE\n   ├── Variables have descriptions and type constraints\n   ├── Outputs expose only what consumers need\n   ├── Resources use consistent naming: {provider}_{type}_{purpose}\n   ├── Locals used for computed values and DRY expressions\n   └── No hardcoded values — everything parameterized or in locals\n\n   STATE & BACKEND\n   ├── Remote backend configured (S3, GCS, Azure Blob, Terraform Cloud)\n   ├── State locking enabled (DynamoDB for S3, native for others)\n   ├── State encryption at rest enabled\n   ├── No secrets stored in state (or state access is restricted)\n   └── Workspaces or directory isolation for environments\n\n   PROVIDERS\n   ├── Version constraints use pessimistic operator: ~> 5.0\n   ├── Required providers block in terraform {} block\n   ├── Provider aliases for multi-region or multi-account\n   └── No provider configuration in child modules\n\n   SECURITY\n   ├── No hardcoded secrets, keys, or passwords\n   ├── IAM follows least-privilege principle\n   ├── Encryption enabled for storage, databases, secrets\n   ├── Security groups are not overly permissive (no 0.0.0.0\u002F0 ingress on sensitive ports)\n   └── Sensitive variables marked with sensitive = true\n   ```\n\n3. **Generate report**\n   ```bash\n   python3 scripts\u002Ftf_module_analyzer.py .\u002Fterraform\n   ```\n\n4. **Run security scan**\n   ```bash\n   python3 scripts\u002Ftf_security_scanner.py .\u002Fterraform\n   ```\n\n### `\u002Fterraform:module` — Module Design\n\n1. **Identify module scope**\n   - Single responsibility: one module = one logical grouping\n   - Determine inputs (variables), outputs, and resource boundaries\n   - Decide: flat module (single directory) vs nested (calling child modules)\n\n2. **Apply module design checklist**\n\n   ```\n   STRUCTURE\n   ├── main.tf        — Primary resources\n   ├── variables.tf   — All input variables with descriptions and types\n   ├── outputs.tf     — All outputs with descriptions\n   ├── versions.tf    — terraform {} block with required_providers\n   ├── locals.tf      — Computed values and naming conventions\n   ├── data.tf        — Data sources (if any)\n   └── README.md      — Usage examples and variable documentation\n\n   VARIABLES\n   ├── Every variable has: description, type, validation (where applicable)\n   ├── Sensitive values marked: sensitive = true\n   ├── Defaults provided for optional settings\n   ├── Use object types for related settings: variable \"config\" { type = object({...}) }\n   └── Validate with: validation { condition = ... }\n\n   OUTPUTS\n   ├── Output IDs, ARNs, endpoints — things consumers need\n   ├── Include description on every output\n   ├── Mark sensitive outputs: sensitive = true\n   └── Don't output entire resources — only specific attributes\n\n   COMPOSITION\n   ├── Root module calls child modules\n   ├── Child modules never call other child modules\n   ├── Pass values explicitly — no hidden data source lookups in child modules\n   ├── Provider configuration only in root module\n   └── Use module \"name\" { source = \".\u002Fmodules\u002Fname\" }\n   ```\n\n3. **Generate module scaffold**\n   - Output file structure with boilerplate\n   - Include variable validation blocks\n   - Add lifecycle rules where appropriate\n\n### `\u002Fterraform:security` — Security Audit\n\n1. **Code-level audit**\n\n   | Check | Severity | Fix |\n   |-------|----------|-----|\n   | Hardcoded secrets in `.tf` files | Critical | Use variables with sensitive = true or vault |\n   | IAM policy with `*` actions | Critical | Scope to specific actions and resources |\n   | Security group with 0.0.0.0\u002F0 on port 22\u002F3389 | Critical | Restrict to known CIDR blocks or use SSM\u002Fbastion |\n   | S3 bucket without encryption | High | Add `server_side_encryption_configuration` block |\n   | S3 bucket with public access | High | Add `aws_s3_bucket_public_access_block` |\n   | RDS without encryption | High | Set `storage_encrypted = true` |\n   | RDS publicly accessible | High | Set `publicly_accessible = false` |\n   | CloudTrail not enabled | Medium | Add `aws_cloudtrail` resource |\n   | Missing `prevent_destroy` on stateful resources | Medium | Add `lifecycle { prevent_destroy = true }` |\n   | Variables without `sensitive = true` for secrets | Medium | Add `sensitive = true` to secret variables |\n\n2. **State security audit**\n\n   | Check | Severity | Fix |\n   |-------|----------|-----|\n   | Local state file | Critical | Migrate to remote backend with encryption |\n   | Remote state without encryption | High | Enable encryption on backend (SSE-S3, KMS) |\n   | No state locking | High | Enable DynamoDB for S3, native for TF Cloud |\n   | State accessible to all team members | Medium | Restrict via IAM policies or TF Cloud teams |\n\n3. **Generate security report**\n   ```bash\n   python3 scripts\u002Ftf_security_scanner.py .\u002Fterraform\n   python3 scripts\u002Ftf_security_scanner.py .\u002Fterraform --output json\n   ```\n\n---\n\n## Tooling\n\n### `scripts\u002Ftf_module_analyzer.py`\n\nCLI utility for analyzing Terraform directory structure and module quality.\n\n**Features:**\n- Resource and data source counting\n- Variable and output analysis (missing descriptions, types, validation)\n- Naming convention checks\n- Module composition detection\n- File structure validation\n- JSON and text output\n\n**Usage:**\n```bash\n# Analyze a Terraform directory\npython3 scripts\u002Ftf_module_analyzer.py .\u002Fterraform\n\n# JSON output\npython3 scripts\u002Ftf_module_analyzer.py .\u002Fterraform --output json\n\n# Analyze a specific module\npython3 scripts\u002Ftf_module_analyzer.py .\u002Fmodules\u002Fvpc\n```\n\n### `scripts\u002Ftf_security_scanner.py`\n\nCLI utility for scanning `.tf` files for common security issues.\n\n**Features:**\n- Hardcoded secret detection (AWS keys, passwords, tokens)\n- Overly permissive IAM policy detection\n- Open security group detection (0.0.0.0\u002F0 on sensitive ports)\n- Missing encryption checks (S3, RDS, EBS)\n- Public access detection (S3, RDS, EC2)\n- Sensitive variable audit\n- JSON and text output\n\n**Usage:**\n```bash\n# Scan a Terraform directory\npython3 scripts\u002Ftf_security_scanner.py .\u002Fterraform\n\n# JSON output\npython3 scripts\u002Ftf_security_scanner.py .\u002Fterraform --output json\n\n# Strict mode (elevate warnings)\npython3 scripts\u002Ftf_security_scanner.py .\u002Fterraform --strict\n```\n\n---\n\n## Module Design Patterns\n\n### Pattern 1: Flat Module (Small\u002FMedium Projects)\n\n```\ninfrastructure\u002F\n├── main.tf          # All resources\n├── variables.tf     # All inputs\n├── outputs.tf       # All outputs\n├── versions.tf      # Provider requirements\n├── terraform.tfvars # Environment values (not committed)\n└── backend.tf       # Remote state configuration\n```\n\nBest for: Single application, \u003C 20 resources, one team owns everything.\n\n### Pattern 2: Nested Modules (Medium\u002FLarge Projects)\n\n```\ninfrastructure\u002F\n├── environments\u002F\n│   ├── dev\u002F\n│   │   ├── main.tf          # Calls modules with dev params\n│   │   ├── backend.tf       # Dev state backend\n│   │   └── terraform.tfvars\n│   ├── staging\u002F\n│   │   └── ...\n│   └── prod\u002F\n│       └── ...\n├── modules\u002F\n│   ├── networking\u002F\n│   │   ├── main.tf\n│   │   ├── variables.tf\n│   │   └── outputs.tf\n│   ├── compute\u002F\n│   │   └── ...\n│   └── database\u002F\n│       └── ...\n└── versions.tf\n```\n\nBest for: Multiple environments, shared infrastructure patterns, team collaboration.\n\n### Pattern 3: Mono-Repo with Terragrunt\n\n```\ninfrastructure\u002F\n├── terragrunt.hcl           # Root config\n├── modules\u002F                  # Reusable modules\n│   ├── vpc\u002F\n│   ├── eks\u002F\n│   └── rds\u002F\n├── dev\u002F\n│   ├── terragrunt.hcl       # Dev overrides\n│   ├── vpc\u002F\n│   │   └── terragrunt.hcl   # Module invocation\n│   └── eks\u002F\n│       └── terragrunt.hcl\n└── prod\u002F\n    ├── terragrunt.hcl\n    └── ...\n```\n\nBest for: Large-scale, many environments, DRY configuration, team-level isolation.\n\n---\n\n## Provider Configuration Patterns\n\n### Version Pinning\n```hcl\nterraform {\n  required_version = \">= 1.5.0\"\n\n  required_providers {\n    aws = {\n      source  = \"hashicorp\u002Faws\"\n      version = \"~> 5.0\"    # Allow 5.x, block 6.0\n    }\n    random = {\n      source  = \"hashicorp\u002Frandom\"\n      version = \"~> 3.5\"\n    }\n  }\n}\n```\n\n### Multi-Region with Aliases\n```hcl\nprovider \"aws\" {\n  region = \"us-east-1\"\n}\n\nprovider \"aws\" {\n  alias  = \"west\"\n  region = \"us-west-2\"\n}\n\nresource \"aws_s3_bucket\" \"primary\" {\n  bucket = \"my-app-primary\"\n}\n\nresource \"aws_s3_bucket\" \"replica\" {\n  provider = aws.west\n  bucket   = \"my-app-replica\"\n}\n```\n\n### Multi-Account with Assume Role\n```hcl\nprovider \"aws\" {\n  alias  = \"production\"\n  region = \"us-east-1\"\n\n  assume_role {\n    role_arn = \"arn:aws:iam::PROD_ACCOUNT_ID:role\u002FTerraformRole\"\n  }\n}\n```\n\n---\n\n## State Management Decision Tree\n\n```\nSingle developer, small project?\n├── Yes → Local state (but migrate to remote ASAP)\n└── No\n    ├── Using Terraform Cloud\u002FEnterprise?\n    │   └── Yes → TF Cloud native backend (built-in locking, encryption, RBAC)\n    └── No\n        ├── AWS?\n        │   └── S3 + DynamoDB (encryption, locking, versioning)\n        ├── GCP?\n        │   └── GCS bucket (native locking, encryption)\n        ├── Azure?\n        │   └── Azure Blob Storage (native locking, encryption)\n        └── Other?\n            └── Consul or PostgreSQL backend\n\nEnvironment isolation strategy:\n├── Separate state files per environment (recommended)\n│   ├── Option A: Separate directories (dev\u002F, staging\u002F, prod\u002F)\n│   └── Option B: Terraform workspaces (simpler but less isolation)\n└── Single state file for all environments (never do this)\n```\n\n---\n\n## CI\u002FCD Integration Patterns\n\n### GitHub Actions Plan\u002FApply\n\n```yaml\n# .github\u002Fworkflows\u002Fterraform.yml\nname: Terraform\non:\n  pull_request:\n    paths: ['terraform\u002F**']\n  push:\n    branches: [main]\n    paths: ['terraform\u002F**']\n\njobs:\n  plan:\n    runs-on: ubuntu-latest\n    if: github.event_name == 'pull_request'\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: hashicorp\u002Fsetup-terraform@v3\n      - run: terraform init\n      - run: terraform validate\n      - run: terraform plan -out=tfplan\n      - run: terraform show -json tfplan > plan.json\n      # Post plan as PR comment\n\n  apply:\n    runs-on: ubuntu-latest\n    if: github.ref == 'refs\u002Fheads\u002Fmain' && github.event_name == 'push'\n    environment: production\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: hashicorp\u002Fsetup-terraform@v3\n      - run: terraform init\n      - run: terraform apply -auto-approve\n```\n\n### Drift Detection\n\n```yaml\n# Run on schedule to detect drift\nname: Drift Detection\non:\n  schedule:\n    - cron: '0 6 * * 1-5'  # Weekdays at 6 AM\n\njobs:\n  detect:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: hashicorp\u002Fsetup-terraform@v3\n      - run: terraform init\n      - run: |\n          terraform plan -detailed-exitcode -out=drift.tfplan 2>&1 | tee drift.log\n          EXIT_CODE=$?\n          if [ $EXIT_CODE -eq 2 ]; then\n            echo \"DRIFT DETECTED — review drift.log\"\n            # Send alert (Slack, PagerDuty, etc.)\n          fi\n```\n\n---\n\n## Proactive Triggers\n\nFlag these without being asked:\n\n- **No remote backend configured** → Migrate to S3\u002FGCS\u002FAzure Blob with locking and encryption.\n- **Provider without version constraint** → Add `version = \"~> X.0\"` to prevent breaking upgrades.\n- **Hardcoded secrets in .tf files** → Use variables with `sensitive = true`, or integrate Vault\u002FSSM.\n- **IAM policy with `\"Action\": \"*\"`** → Scope to specific actions. No wildcard actions in production.\n- **Security group open to 0.0.0.0\u002F0 on SSH\u002FRDP** → Restrict to bastion CIDR or use SSM Session Manager.\n- **No state locking** → Enable DynamoDB table for S3 backend, or use TF Cloud.\n- **Resources without tags** → Add default_tags in provider block. Tags are mandatory for cost tracking.\n- **Missing `prevent_destroy` on databases\u002Fstorage** → Add lifecycle block to prevent accidental deletion.\n\n---\n\n## Multi-Cloud Provider Configuration\n\nWhen a single root module must provision across AWS, Azure, and GCP simultaneously.\n\n### Provider Aliasing Pattern\n\n```hcl\nterraform {\n  required_providers {\n    aws = {\n      source  = \"hashicorp\u002Faws\"\n      version = \"~> 5.0\"\n    }\n    azurerm = {\n      source  = \"hashicorp\u002Fazurerm\"\n      version = \"~> 3.0\"\n    }\n    google = {\n      source  = \"hashicorp\u002Fgoogle\"\n      version = \"~> 5.0\"\n    }\n  }\n}\n\nprovider \"aws\" {\n  region = var.aws_region\n}\n\nprovider \"azurerm\" {\n  features {}\n  subscription_id = var.azure_subscription_id\n}\n\nprovider \"google\" {\n  project = var.gcp_project_id\n  region  = var.gcp_region\n}\n```\n\n### Shared Variables Across Providers\n\n```hcl\nvariable \"environment\" {\n  description = \"Environment name used across all providers\"\n  type        = string\n  validation {\n    condition     = contains([\"dev\", \"staging\", \"prod\"], var.environment)\n    error_message = \"Must be dev, staging, or prod.\"\n  }\n}\n\nlocals {\n  common_tags = {\n    environment = var.environment\n    managed_by  = \"terraform\"\n    project     = var.project_name\n  }\n}\n```\n\n### When to Use Multi-Cloud\n\n- **Yes**: Regulatory requirements mandate data residency across providers, or the org has existing workloads on multiple clouds.\n- **No**: \"Avoiding vendor lock-in\" alone is not sufficient justification. Multi-cloud doubles operational complexity. Prefer single-cloud unless there is a concrete business requirement.\n\n---\n\n## OpenTofu Compatibility\n\nOpenTofu is an open-source fork of Terraform maintained by the Linux Foundation under the MPL 2.0 license.\n\n### Migration from Terraform to OpenTofu\n\n```bash\n# 1. Install OpenTofu\nbrew install opentofu        # macOS\nsnap install --classic tofu  # Linux\n\n# 2. Replace the binary — state files are compatible\ntofu init                    # Re-initializes with OpenTofu\ntofu plan                    # Identical plan output\ntofu apply                   # Same apply workflow\n```\n\n### License Considerations\n\n| | Terraform (1.6+) | OpenTofu |\n|---|---|---|\n| **License** | BSL 1.1 (source-available) | MPL 2.0 (open-source) |\n| **Commercial use** | Restricted for competing products | Unrestricted |\n| **Community governance** | HashiCorp | Linux Foundation |\n\n### Feature Parity\n\nOpenTofu tracks Terraform 1.6.x features. Key additions unique to OpenTofu:\n- Client-side state encryption (`tofu init -encryption`)\n- Early variable\u002Flocals evaluation\n- Provider-defined functions\n\n### When to Choose OpenTofu\n\n- You need a fully open-source license for your supply chain.\n- You want client-side state encryption without Terraform Cloud.\n- Otherwise, either tool works — the HCL syntax and provider ecosystem are identical.\n\n---\n\n## Infracost Integration\n\nInfracost estimates cloud costs from Terraform code before resources are provisioned.\n\n### PR Workflow\n\n```bash\n# Show cost breakdown for current code\ninfracost breakdown --path .\n\n# Compare cost difference between current branch and main\ninfracost diff --path . --compare-to infracost-base.json\n```\n\n### GitHub Actions Cost Comment\n\n```yaml\n# .github\u002Fworkflows\u002Finfracost.yml\nname: Infracost\non: [pull_request]\n\njobs:\n  cost:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: infracost\u002Factions\u002Fsetup@v3\n        with:\n          api-key: ${{ secrets.INFRACOST_API_KEY }}\n      - run: infracost breakdown --path .\u002Fterraform --format json --out-file \u002Ftmp\u002Finfracost.json\n      - run: infracost comment github --path \u002Ftmp\u002Finfracost.json --repo $GITHUB_REPOSITORY --pull-request ${{ github.event.pull_request.number }} --github-token ${{ secrets.GITHUB_TOKEN }} --behavior update\n```\n\n### Budget Thresholds and Cost Policy\n\n```yaml\n# infracost.yml — policy file\nversion: 2.9.0\npolicies:\n  - path: \"*\"\n    max_monthly_cost: \"5000\"    # Fail PR if estimated cost exceeds $5,000\u002Fmonth\n    max_cost_increase: \"500\"    # Fail PR if cost increase exceeds $500\u002Fmonth\n```\n\n---\n\n## Import Existing Infrastructure\n\nBring manually-created resources under Terraform management.\n\n### terraform import Workflow\n\n```bash\n# 1. Write the resource block first (empty body is fine)\n# main.tf:\n# resource \"aws_s3_bucket\" \"legacy\" {}\n\n# 2. Import the resource into state\nterraform import aws_s3_bucket.legacy my-existing-bucket-name\n\n# 3. Run plan to see attribute diff\nterraform plan\n\n# 4. Fill in the resource block until plan shows no changes\n```\n\n### Bulk Import with Config Generation (Terraform 1.5+)\n\n```bash\n# Generate HCL for imported resources\nterraform plan -generate-config-out=generated.tf\n\n# Review generated.tf, then move resources into proper files\n```\n\n### Common Pitfalls\n\n- **Resource drift after import**: The imported resource may have attributes Terraform does not manage. Run `terraform plan` immediately and resolve every diff.\n- **State manipulation**: Use `terraform state mv` to rename or reorganize. Use `terraform state rm` to remove without destroying. Always back up state before manipulation: `terraform state pull > backup.tfstate`.\n- **Sensitive defaults**: Imported resources may expose secrets in state. Restrict state access and enable encryption.\n\n---\n\n## Terragrunt Patterns\n\nTerragrunt is a thin wrapper around Terraform that provides DRY configuration for multi-environment setups.\n\n### Root terragrunt.hcl (Shared Config)\n\n```hcl\n# terragrunt.hcl (root)\nremote_state {\n  backend = \"s3\"\n  generate = {\n    path      = \"backend.tf\"\n    if_exists = \"overwrite_terragrunt\"\n  }\n  config = {\n    bucket         = \"my-org-terraform-state\"\n    key            = \"${path_relative_to_include()}\u002Fterraform.tfstate\"\n    region         = \"us-east-1\"\n    encrypt        = true\n    dynamodb_table = \"terraform-locks\"\n  }\n}\n```\n\n### Child terragrunt.hcl (Environment Override)\n\n```hcl\n# prod\u002Fvpc\u002Fterragrunt.hcl\ninclude \"root\" {\n  path = find_in_parent_folders()\n}\n\nterraform {\n  source = \"..\u002F..\u002Fmodules\u002Fvpc\"\n}\n\ninputs = {\n  environment = \"prod\"\n  cidr_block  = \"10.0.0.0\u002F16\"\n}\n```\n\n### Dependencies Between Modules\n\n```hcl\n# prod\u002Feks\u002Fterragrunt.hcl\ndependency \"vpc\" {\n  config_path = \"..\u002Fvpc\"\n}\n\ninputs = {\n  vpc_id     = dependency.vpc.outputs.vpc_id\n  subnet_ids = dependency.vpc.outputs.private_subnet_ids\n}\n```\n\n### When Terragrunt Adds Value\n\n- **Yes**: 3+ environments with identical module structure, shared backend config, or cross-module dependencies.\n- **No**: Single environment, small team, or simple directory-based isolation already works. Terragrunt adds a learning curve and another binary to manage.\n\n---\n\n## Installation\n\n### One-liner (any tool)\n```bash\ngit clone https:\u002F\u002Fgithub.com\u002Falirezarezvani\u002Fclaude-skills.git\ncp -r claude-skills\u002Fengineering\u002Fterraform-patterns ~\u002F.claude\u002Fskills\u002F\n```\n\n### Multi-tool install\n```bash\n.\u002Fscripts\u002Fconvert.sh --skill terraform-patterns --tool codex|gemini|cursor|windsurf|openclaw\n```\n\n### OpenClaw\n```bash\nclawhub install terraform-patterns\n```\n\n---\n\n## Related Skills\n\n- **senior-devops** — Broader DevOps scope (CI\u002FCD, monitoring, containerization). Complementary — use terraform-patterns for IaC-specific work, senior-devops for pipeline and infrastructure operations.\n- **aws-solution-architect** — AWS architecture design. Complementary — terraform-patterns implements the infrastructure, aws-solution-architect designs it.\n- **senior-security** — Application security. Complementary — terraform-patterns covers infrastructure security posture, senior-security covers application-level threats.\n- **ci-cd-pipeline-builder** — Pipeline construction. Complementary — terraform-patterns defines infrastructure, ci-cd-pipeline-builder automates deployment.\n","# Terraform Patterns\n\n> Predictable infrastructure. Secure state. Modules that compose. No drift.\n\nOpinionated Terraform workflow that turns sprawling HCL into well-structured, secure, production-grade infrastructure code. Covers module design, state management, provider patterns, security hardening, and CI\u002FCD integration.\n\nNot a Terraform tutorial — a set of concrete decisions about how to write infrastructure code that doesn't break at 3 AM.\n\n---\n\n## Slash Commands\n\n| Command | What it does |\n|---------|-------------|\n| `\u002Fterraform:review` | Analyze Terraform code for anti-patterns, security issues, and structure problems |\n| `\u002Fterraform:module` | Design or refactor a Terraform module with proper inputs, outputs, and composition |\n| `\u002Fterraform:security` | Audit Terraform code for security vulnerabilities, secrets exposure, and IAM misconfigurations |\n\n---\n\n## When This Skill Activates\n\nRecognize these patterns from the user:\n\n- \"Review this Terraform code\"\n- \"Design a Terraform module for...\"\n- \"My Terraform state is...\"\n- \"Set up remote state backend\"\n- \"Multi-region Terraform deployment\"\n- \"Terraform security review\"\n- \"Module structure best practices\"\n- \"Terraform CI\u002FCD pipeline\"\n- Any request involving: `.tf` files, HCL, Terraform modules, state management, provider configuration, infrastructure-as-code\n\nIf the user has `.tf` files or wants to provision infrastructure with Terraform → this skill applies.\n\n---\n\n## Workflow\n\n### `\u002Fterraform:review` — Terraform Code Review\n\n1. **Analyze current state**\n   - Read all `.tf` files in the target directory\n   - Identify module structure (flat vs nested)\n   - Count resources, data sources, variables, outputs\n   - Check naming conventions\n\n2. **Apply review checklist**\n\n   ```\n   MODULE STRUCTURE\n   ├── Variables have descriptions and type constraints\n   ├── Outputs expose only what consumers need\n   ├── Resources use consistent naming: {provider}_{type}_{purpose}\n   ├── Locals used for computed values and DRY expressions\n   └── No hardcoded values — everything parameterized or in locals\n\n   STATE & BACKEND\n   ├── Remote backend configured (S3, GCS, Azure Blob, Terraform Cloud)\n   ├── State locking enabled (DynamoDB for S3, native for others)\n   ├── State encryption at rest enabled\n   ├── No secrets stored in state (or state access is restricted)\n   └── Workspaces or directory isolation for environments\n\n   PROVIDERS\n   ├── Version constraints use pessimistic operator: ~> 5.0\n   ├── Required providers block in terraform {} block\n   ├── Provider aliases for multi-region or multi-account\n   └── No provider configuration in child modules\n\n   SECURITY\n   ├── No hardcoded secrets, keys, or passwords\n   ├── IAM follows least-privilege principle\n   ├── Encryption enabled for storage, databases, secrets\n   ├── Security groups are not overly permissive (no 0.0.0.0\u002F0 ingress on sensitive ports)\n   └── Sensitive variables marked with sensitive = true\n   ```\n\n3. **Generate report**\n   ```bash\n   python3 scripts\u002Ftf_module_analyzer.py .\u002Fterraform\n   ```\n\n4. **Run security scan**\n   ```bash\n   python3 scripts\u002Ftf_security_scanner.py .\u002Fterraform\n   ```\n\n### `\u002Fterraform:module` — Module Design\n\n1. **Identify module scope**\n   - Single responsibility: one module = one logical grouping\n   - Determine inputs (variables), outputs, and resource boundaries\n   - Decide: flat module (single directory) vs nested (calling child modules)\n\n2. **Apply module design checklist**\n\n   ```\n   STRUCTURE\n   ├── main.tf        — Primary resources\n   ├── variables.tf   — All input variables with descriptions and types\n   ├── outputs.tf     — All outputs with descriptions\n   ├── versions.tf    — terraform {} block with required_providers\n   ├── locals.tf      — Computed values and naming conventions\n   ├── data.tf        — Data sources (if any)\n   └── README.md      — Usage examples and variable documentation\n\n   VARIABLES\n   ├── Every variable has: description, type, validation (where applicable)\n   ├── Sensitive values marked: sensitive = true\n   ├── Defaults provided for optional settings\n   ├── Use object types for related settings: variable \"config\" { type = object({...}) }\n   └── Validate with: validation { condition = ... }\n\n   OUTPUTS\n   ├── Output IDs, ARNs, endpoints — things consumers need\n   ├── Include description on every output\n   ├── Mark sensitive outputs: sensitive = true\n   └── Don't output entire resources — only specific attributes\n\n   COMPOSITION\n   ├── Root module calls child modules\n   ├── Child modules never call other child modules\n   ├── Pass values explicitly — no hidden data source lookups in child modules\n   ├── Provider configuration only in root module\n   └── Use module \"name\" { source = \".\u002Fmodules\u002Fname\" }\n   ```\n\n3. **Generate module scaffold**\n   - Output file structure with boilerplate\n   - Include variable validation blocks\n   - Add lifecycle rules where appropriate\n\n### `\u002Fterraform:security` — Security Audit\n\n1. **Code-level audit**\n\n   | Check | Severity | Fix |\n   |-------|----------|-----|\n   | Hardcoded secrets in `.tf` files | Critical | Use variables with sensitive = true or vault |\n   | IAM policy with `*` actions | Critical | Scope to specific actions and resources |\n   | Security group with 0.0.0.0\u002F0 on port 22\u002F3389 | Critical | Restrict to known CIDR blocks or use SSM\u002Fbastion |\n   | S3 bucket without encryption | High | Add `server_side_encryption_configuration` block |\n   | S3 bucket with public access | High | Add `aws_s3_bucket_public_access_block` |\n   | RDS without encryption | High | Set `storage_encrypted = true` |\n   | RDS publicly accessible | High | Set `publicly_accessible = false` |\n   | CloudTrail not enabled | Medium | Add `aws_cloudtrail` resource |\n   | Missing `prevent_destroy` on stateful resources | Medium | Add `lifecycle { prevent_destroy = true }` |\n   | Variables without `sensitive = true` for secrets | Medium | Add `sensitive = true` to secret variables |\n\n2. **State security audit**\n\n   | Check | Severity | Fix |\n   |-------|----------|-----|\n   | Local state file | Critical | Migrate to remote backend with encryption |\n   | Remote state without encryption | High | Enable encryption on backend (SSE-S3, KMS) |\n   | No state locking | High | Enable DynamoDB for S3, native for TF Cloud |\n   | State accessible to all team members | Medium | Restrict via IAM policies or TF Cloud teams |\n\n3. **Generate security report**\n   ```bash\n   python3 scripts\u002Ftf_security_scanner.py .\u002Fterraform\n   python3 scripts\u002Ftf_security_scanner.py .\u002Fterraform --output json\n   ```\n\n---\n\n## Tooling\n\n### `scripts\u002Ftf_module_analyzer.py`\n\nCLI utility for analyzing Terraform directory structure and module quality.\n\n**Features:**\n- Resource and data source counting\n- Variable and output analysis (missing descriptions, types, validation)\n- Naming convention checks\n- Module composition detection\n- File structure validation\n- JSON and text output\n\n**Usage:**\n```bash\n# Analyze a Terraform directory\npython3 scripts\u002Ftf_module_analyzer.py .\u002Fterraform\n\n# JSON output\npython3 scripts\u002Ftf_module_analyzer.py .\u002Fterraform --output json\n\n# Analyze a specific module\npython3 scripts\u002Ftf_module_analyzer.py .\u002Fmodules\u002Fvpc\n```\n\n### `scripts\u002Ftf_security_scanner.py`\n\nCLI utility for scanning `.tf` files for common security issues.\n\n**Features:**\n- Hardcoded secret detection (AWS keys, passwords, tokens)\n- Overly permissive IAM policy detection\n- Open security group detection (0.0.0.0\u002F0 on sensitive ports)\n- Missing encryption checks (S3, RDS, EBS)\n- Public access detection (S3, RDS, EC2)\n- Sensitive variable audit\n- JSON and text output\n\n**Usage:**\n```bash\n# Scan a Terraform directory\npython3 scripts\u002Ftf_security_scanner.py .\u002Fterraform\n\n# JSON output\npython3 scripts\u002Ftf_security_scanner.py .\u002Fterraform --output json\n\n# Strict mode (elevate warnings)\npython3 scripts\u002Ftf_security_scanner.py .\u002Fterraform --strict\n```\n\n---\n\n## Module Design Patterns\n\n### Pattern 1: Flat Module (Small\u002FMedium Projects)\n\n```\ninfrastructure\u002F\n├── main.tf          # All resources\n├── variables.tf     # All inputs\n├── outputs.tf       # All outputs\n├── versions.tf      # Provider requirements\n├── terraform.tfvars # Environment values (not committed)\n└── backend.tf       # Remote state configuration\n```\n\nBest for: Single application, \u003C 20 resources, one team owns everything.\n\n### Pattern 2: Nested Modules (Medium\u002FLarge Projects)\n\n```\ninfrastructure\u002F\n├── environments\u002F\n│   ├── dev\u002F\n│   │   ├── main.tf          # Calls modules with dev params\n│   │   ├── backend.tf       # Dev state backend\n│   │   └── terraform.tfvars\n│   ├── staging\u002F\n│   │   └── ...\n│   └── prod\u002F\n│       └── ...\n├── modules\u002F\n│   ├── networking\u002F\n│   │   ├── main.tf\n│   │   ├── variables.tf\n│   │   └── outputs.tf\n│   ├── compute\u002F\n│   │   └── ...\n│   └── database\u002F\n│       └── ...\n└── versions.tf\n```\n\nBest for: Multiple environments, shared infrastructure patterns, team collaboration.\n\n### Pattern 3: Mono-Repo with Terragrunt\n\n```\ninfrastructure\u002F\n├── terragrunt.hcl           # Root config\n├── modules\u002F                  # Reusable modules\n│   ├── vpc\u002F\n│   ├── eks\u002F\n│   └── rds\u002F\n├── dev\u002F\n│   ├── terragrunt.hcl       # Dev overrides\n│   ├── vpc\u002F\n│   │   └── terragrunt.hcl   # Module invocation\n│   └── eks\u002F\n│       └── terragrunt.hcl\n└── prod\u002F\n    ├── terragrunt.hcl\n    └── ...\n```\n\nBest for: Large-scale, many environments, DRY configuration, team-level isolation.\n\n---\n\n## Provider Configuration Patterns\n\n### Version Pinning\n```hcl\nterraform {\n  required_version = \">= 1.5.0\"\n\n  required_providers {\n    aws = {\n      source  = \"hashicorp\u002Faws\"\n      version = \"~> 5.0\"    # Allow 5.x, block 6.0\n    }\n    random = {\n      source  = \"hashicorp\u002Frandom\"\n      version = \"~> 3.5\"\n    }\n  }\n}\n```\n\n### Multi-Region with Aliases\n```hcl\nprovider \"aws\" {\n  region = \"us-east-1\"\n}\n\nprovider \"aws\" {\n  alias  = \"west\"\n  region = \"us-west-2\"\n}\n\nresource \"aws_s3_bucket\" \"primary\" {\n  bucket = \"my-app-primary\"\n}\n\nresource \"aws_s3_bucket\" \"replica\" {\n  provider = aws.west\n  bucket   = \"my-app-replica\"\n}\n```\n\n### Multi-Account with Assume Role\n```hcl\nprovider \"aws\" {\n  alias  = \"production\"\n  region = \"us-east-1\"\n\n  assume_role {\n    role_arn = \"arn:aws:iam::PROD_ACCOUNT_ID:role\u002FTerraformRole\"\n  }\n}\n```\n\n---\n\n## State Management Decision Tree\n\n```\nSingle developer, small project?\n├── Yes → Local state (but migrate to remote ASAP)\n└── No\n    ├── Using Terraform Cloud\u002FEnterprise?\n    │   └── Yes → TF Cloud native backend (built-in locking, encryption, RBAC)\n    └── No\n        ├── AWS?\n        │   └── S3 + DynamoDB (encryption, locking, versioning)\n        ├── GCP?\n        │   └── GCS bucket (native locking, encryption)\n        ├── Azure?\n        │   └── Azure Blob Storage (native locking, encryption)\n        └── Other?\n            └── Consul or PostgreSQL backend\n\nEnvironment isolation strategy:\n├── Separate state files per environment (recommended)\n│   ├── Option A: Separate directories (dev\u002F, staging\u002F, prod\u002F)\n│   └── Option B: Terraform workspaces (simpler but less isolation)\n└── Single state file for all environments (never do this)\n```\n\n---\n\n## CI\u002FCD Integration Patterns\n\n### GitHub Actions Plan\u002FApply\n\n```yaml\n# .github\u002Fworkflows\u002Fterraform.yml\nname: Terraform\non:\n  pull_request:\n    paths: ['terraform\u002F**']\n  push:\n    branches: [main]\n    paths: ['terraform\u002F**']\n\njobs:\n  plan:\n    runs-on: ubuntu-latest\n    if: github.event_name == 'pull_request'\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: hashicorp\u002Fsetup-terraform@v3\n      - run: terraform init\n      - run: terraform validate\n      - run: terraform plan -out=tfplan\n      - run: terraform show -json tfplan > plan.json\n      # Post plan as PR comment\n\n  apply:\n    runs-on: ubuntu-latest\n    if: github.ref == 'refs\u002Fheads\u002Fmain' && github.event_name == 'push'\n    environment: production\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: hashicorp\u002Fsetup-terraform@v3\n      - run: terraform init\n      - run: terraform apply -auto-approve\n```\n\n### Drift Detection\n\n```yaml\n# Run on schedule to detect drift\nname: Drift Detection\non:\n  schedule:\n    - cron: '0 6 * * 1-5'  # Weekdays at 6 AM\n\njobs:\n  detect:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: hashicorp\u002Fsetup-terraform@v3\n      - run: terraform init\n      - run: |\n          terraform plan -detailed-exitcode -out=drift.tfplan 2>&1 | tee drift.log\n          EXIT_CODE=$?\n          if [ $EXIT_CODE -eq 2 ]; then\n            echo \"DRIFT DETECTED — review drift.log\"\n            # Send alert (Slack, PagerDuty, etc.)\n          fi\n```\n\n---\n\n## Proactive Triggers\n\nFlag these without being asked:\n\n- **No remote backend configured** → Migrate to S3\u002FGCS\u002FAzure Blob with locking and encryption.\n- **Provider without version constraint** → Add `version = \"~> X.0\"` to prevent breaking upgrades.\n- **Hardcoded secrets in .tf files** → Use variables with `sensitive = true`, or integrate Vault\u002FSSM.\n- **IAM policy with `\"Action\": \"*\"`** → Scope to specific actions. No wildcard actions in production.\n- **Security group open to 0.0.0.0\u002F0 on SSH\u002FRDP** → Restrict to bastion CIDR or use SSM Session Manager.\n- **No state locking** → Enable DynamoDB table for S3 backend, or use TF Cloud.\n- **Resources without tags** → Add default_tags in provider block. Tags are mandatory for cost tracking.\n- **Missing `prevent_destroy` on databases\u002Fstorage** → Add lifecycle block to prevent accidental deletion.\n\n---\n\n## Multi-Cloud Provider Configuration\n\nWhen a single root module must provision across AWS, Azure, and GCP simultaneously.\n\n### Provider Aliasing Pattern\n\n```hcl\nterraform {\n  required_providers {\n    aws = {\n      source  = \"hashicorp\u002Faws\"\n      version = \"~> 5.0\"\n    }\n    azurerm = {\n      source  = \"hashicorp\u002Fazurerm\"\n      version = \"~> 3.0\"\n    }\n    google = {\n      source  = \"hashicorp\u002Fgoogle\"\n      version = \"~> 5.0\"\n    }\n  }\n}\n\nprovider \"aws\" {\n  region = var.aws_region\n}\n\nprovider \"azurerm\" {\n  features {}\n  subscription_id = var.azure_subscription_id\n}\n\nprovider \"google\" {\n  project = var.gcp_project_id\n  region  = var.gcp_region\n}\n```\n\n### Shared Variables Across Providers\n\n```hcl\nvariable \"environment\" {\n  description = \"Environment name used across all providers\"\n  type        = string\n  validation {\n    condition     = contains([\"dev\", \"staging\", \"prod\"], var.environment)\n    error_message = \"Must be dev, staging, or prod.\"\n  }\n}\n\nlocals {\n  common_tags = {\n    environment = var.environment\n    managed_by  = \"terraform\"\n    project     = var.project_name\n  }\n}\n```\n\n### When to Use Multi-Cloud\n\n- **Yes**: Regulatory requirements mandate data residency across providers, or the org has existing workloads on multiple clouds.\n- **No**: \"Avoiding vendor lock-in\" alone is not sufficient justification. Multi-cloud doubles operational complexity. Prefer single-cloud unless there is a concrete business requirement.\n\n---\n\n## OpenTofu Compatibility\n\nOpenTofu is an open-source fork of Terraform maintained by the Linux Foundation under the MPL 2.0 license.\n\n### Migration from Terraform to OpenTofu\n\n```bash\n# 1. Install OpenTofu\nbrew install opentofu        # macOS\nsnap install --classic tofu  # Linux\n\n# 2. Replace the binary — state files are compatible\ntofu init                    # Re-initializes with OpenTofu\ntofu plan                    # Identical plan output\ntofu apply                   # Same apply workflow\n```\n\n### License Considerations\n\n| | Terraform (1.6+) | OpenTofu |\n|---|---|---|\n| **License** | BSL 1.1 (source-available) | MPL 2.0 (open-source) |\n| **Commercial use** | Restricted for competing products | Unrestricted |\n| **Community governance** | HashiCorp | Linux Foundation |\n\n### Feature Parity\n\nOpenTofu tracks Terraform 1.6.x features. Key additions unique to OpenTofu:\n- Client-side state encryption (`tofu init -encryption`)\n- Early variable\u002Flocals evaluation\n- Provider-defined functions\n\n### When to Choose OpenTofu\n\n- You need a fully open-source license for your supply chain.\n- You want client-side state encryption without Terraform Cloud.\n- Otherwise, either tool works — the HCL syntax and provider ecosystem are identical.\n\n---\n\n## Infracost Integration\n\nInfracost estimates cloud costs from Terraform code before resources are provisioned.\n\n### PR Workflow\n\n```bash\n# Show cost breakdown for current code\ninfracost breakdown --path .\n\n# Compare cost difference between current branch and main\ninfracost diff --path . --compare-to infracost-base.json\n```\n\n### GitHub Actions Cost Comment\n\n```yaml\n# .github\u002Fworkflows\u002Finfracost.yml\nname: Infracost\non: [pull_request]\n\njobs:\n  cost:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - uses: infracost\u002Factions\u002Fsetup@v3\n        with:\n          api-key: ${{ secrets.INFRACOST_API_KEY }}\n      - run: infracost breakdown --path .\u002Fterraform --format json --out-file \u002Ftmp\u002Finfracost.json\n      - run: infracost comment github --path \u002Ftmp\u002Finfracost.json --repo $GITHUB_REPOSITORY --pull-request ${{ github.event.pull_request.number }} --github-token ${{ secrets.GITHUB_TOKEN }} --behavior update\n```\n\n### Budget Thresholds and Cost Policy\n\n```yaml\n# infracost.yml — policy file\nversion: 2.9.0\npolicies:\n  - path: \"*\"\n    max_monthly_cost: \"5000\"    # Fail PR if estimated cost exceeds $5,000\u002Fmonth\n    max_cost_increase: \"500\"    # Fail PR if cost increase exceeds $500\u002Fmonth\n```\n\n---\n\n## Import Existing Infrastructure\n\nBring manually-created resources under Terraform management.\n\n### terraform import Workflow\n\n```bash\n# 1. Write the resource block first (empty body is fine)\n# main.tf:\n# resource \"aws_s3_bucket\" \"legacy\" {}\n\n# 2. Import the resource into state\nterraform import aws_s3_bucket.legacy my-existing-bucket-name\n\n# 3. Run plan to see attribute diff\nterraform plan\n\n# 4. Fill in the resource block until plan shows no changes\n```\n\n### Bulk Import with Config Generation (Terraform 1.5+)\n\n```bash\n# Generate HCL for imported resources\nterraform plan -generate-config-out=generated.tf\n\n# Review generated.tf, then move resources into proper files\n```\n\n### Common Pitfalls\n\n- **Resource drift after import**: The imported resource may have attributes Terraform does not manage. Run `terraform plan` immediately and resolve every diff.\n- **State manipulation**: Use `terraform state mv` to rename or reorganize. Use `terraform state rm` to remove without destroying. Always back up state before manipulation: `terraform state pull > backup.tfstate`.\n- **Sensitive defaults**: Imported resources may expose secrets in state. Restrict state access and enable encryption.\n\n---\n\n## Terragrunt Patterns\n\nTerragrunt is a thin wrapper around Terraform that provides DRY configuration for multi-environment setups.\n\n### Root terragrunt.hcl (Shared Config)\n\n```hcl\n# terragrunt.hcl (root)\nremote_state {\n  backend = \"s3\"\n  generate = {\n    path      = \"backend.tf\"\n    if_exists = \"overwrite_terragrunt\"\n  }\n  config = {\n    bucket         = \"my-org-terraform-state\"\n    key            = \"${path_relative_to_include()}\u002Fterraform.tfstate\"\n    region         = \"us-east-1\"\n    encrypt        = true\n    dynamodb_table = \"terraform-locks\"\n  }\n}\n```\n\n### Child terragrunt.hcl (Environment Override)\n\n```hcl\n# prod\u002Fvpc\u002Fterragrunt.hcl\ninclude \"root\" {\n  path = find_in_parent_folders()\n}\n\nterraform {\n  source = \"..\u002F..\u002Fmodules\u002Fvpc\"\n}\n\ninputs = {\n  environment = \"prod\"\n  cidr_block  = \"10.0.0.0\u002F16\"\n}\n```\n\n### Dependencies Between Modules\n\n```hcl\n# prod\u002Feks\u002Fterragrunt.hcl\ndependency \"vpc\" {\n  config_path = \"..\u002Fvpc\"\n}\n\ninputs = {\n  vpc_id     = dependency.vpc.outputs.vpc_id\n  subnet_ids = dependency.vpc.outputs.private_subnet_ids\n}\n```\n\n### When Terragrunt Adds Value\n\n- **Yes**: 3+ environments with identical module structure, shared backend config, or cross-module dependencies.\n- **No**: Single environment, small team, or simple directory-based isolation already works. Terragrunt adds a learning curve and another binary to manage.\n\n---\n\n## Installation\n\n### One-liner (any tool)\n```bash\ngit clone https:\u002F\u002Fgithub.com\u002Falirezarezvani\u002Fclaude-skills.git\ncp -r claude-skills\u002Fengineering\u002Fterraform-patterns ~\u002F.claude\u002Fskills\u002F\n```\n\n### Multi-tool install\n```bash\n.\u002Fscripts\u002Fconvert.sh --skill terraform-patterns --tool codex|gemini|cursor|windsurf|openclaw\n```\n\n### OpenClaw\n```bash\nclawhub install terraform-patterns\n```\n\n---\n\n## Related Skills\n\n- **senior-devops** — Broader DevOps scope (CI\u002FCD, monitoring, containerization). Complementary — use terraform-patterns for IaC-specific work, senior-devops for pipeline and infrastructure operations.\n- **aws-solution-architect** — AWS architecture design. Complementary — terraform-patterns implements the infrastructure, aws-solution-architect designs it.\n- **senior-security** — Application security. Complementary — terraform-patterns covers infrastructure security posture, senior-security covers application-level threats.\n- **ci-cd-pipeline-builder** — Pipeline construction. Complementary — terraform-patterns defines infrastructure, ci-cd-pipeline-builder automates deployment.\n",{"name":5,"license":14,"metadata":54,"description":7},{"author":55,"updated":56,"version":57,"category":58},"Alireza Rezvani",1773532800000,"1.0.0","engineering","claude\u002Fai-personal-assistant-main","fb33f7f5b3a206eb019c788e3c48e91c02ccb1f9",".claude\u002Fskills\u002Fclaude-skills\u002Fterraform-patterns",0,"https:\u002F\u002Fgithub.com\u002Fmarshadgani\u002FArshad.AI","https:\u002F\u002Farshad-ai-seven.vercel.app","https:\u002F\u002Fgithub.com\u002Fmarshadgani","2026-11-02 00:51:35",{"source":8,"skillName":5,"commands":68,"prompt":78,"zipAvailable":79},[69,72,75],{"tool":70,"command":71},"npx","npx skills add marshadgani\u002FArshad.AI --skill terraform-patterns",{"tool":73,"command":74},"bunx","bunx skills add marshadgani\u002FArshad.AI --skill terraform-patterns",{"tool":76,"command":77},"pnpm","pnpm dlx skills add marshadgani\u002FArshad.AI --skill terraform-patterns","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmarshadgani\u002FArshad.AI\u002Fblob\u002Fclaude\u002Fai-personal-assistant-main\u002F.claude\u002Fskills\u002Fclaude-skills\u002Fterraform-patterns\u002FSKILL.md",true,[81,87,91,97],{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"references\u002Fmodule-patterns.md","REFERENCE","参考文档",9900,"https:\u002F\u002Fgithub.com\u002Fmarshadgani\u002FArshad.AI\u002Fblob\u002Fclaude\u002Fai-personal-assistant-main\u002F.claude\u002Fskills\u002Fclaude-skills\u002Fterraform-patterns\u002Freferences\u002Fmodule-patterns.md",{"path":88,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":89,"sourceHtmlUrl":90},"references\u002Fstate-management.md",12177,"https:\u002F\u002Fgithub.com\u002Fmarshadgani\u002FArshad.AI\u002Fblob\u002Fclaude\u002Fai-personal-assistant-main\u002F.claude\u002Fskills\u002Fclaude-skills\u002Fterraform-patterns\u002Freferences\u002Fstate-management.md",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"scripts\u002Ftf_module_analyzer.py","SCRIPT","脚本",13995,"https:\u002F\u002Fgithub.com\u002Fmarshadgani\u002FArshad.AI\u002Fblob\u002Fclaude\u002Fai-personal-assistant-main\u002F.claude\u002Fskills\u002Fclaude-skills\u002Fterraform-patterns\u002Fscripts\u002Ftf_module_analyzer.py",{"path":98,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":99,"sourceHtmlUrl":100},"scripts\u002Ftf_security_scanner.py",18523,"https:\u002F\u002Fgithub.com\u002Fmarshadgani\u002FArshad.AI\u002Fblob\u002Fclaude\u002Fai-personal-assistant-main\u002F.claude\u002Fskills\u002Fclaude-skills\u002Fterraform-patterns\u002Fscripts\u002Ftf_security_scanner.py",[102,135,161,189,217,241],{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":106,"licenseFileUrl":107,"sourceHtmlUrl":108,"categories":109,"keywords":116,"publishedAt":134},"01M71MVWH15PQRS9KT3J24D7WV","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmarshadgani\u002FArshad.AI\u002Fblob\u002Fclaude\u002Fai-personal-assistant-main\u002F.claude\u002Fskills\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fmarshadgani\u002FArshad.AI\u002Fblob\u002Fclaude\u002Fai-personal-assistant-main\u002F.claude\u002Fskills\u002Fwebapp-testing\u002FSKILL.md",[110,113],{"categoryNo":111,"categoryName":112,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":114,"categoryName":115,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000009","前端开发",[117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133],"webapp","testing","webapp testing","for","applications","local","frontend","debugging","toolkit","logs","browser","with","playwright","web","behavior","ui","screenshots","2026-11-10 10:56:23",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":106,"licenseFileUrl":139,"sourceHtmlUrl":140,"categories":141,"keywords":143,"publishedAt":134},"01M71MVMAZ1J606SGA4JPHRDAZ","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","https:\u002F\u002Fgithub.com\u002Fmarshadgani\u002FArshad.AI\u002Fblob\u002Fclaude\u002Fai-personal-assistant-main\u002F.claude\u002Fskills\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fmarshadgani\u002FArshad.AI\u002Fblob\u002Fclaude\u002Fai-personal-assistant-main\u002F.claude\u002Fskills\u002Fweb-artifacts-builder\u002FSKILL.md",[142],{"categoryNo":114,"categoryName":115,"taxonomyType":20,"taxonomyTypeDesc":21},[144,145,146,130,147,148,149,120,150,151,123,152,153,154,155,156,157,158,159,160],"builder","artifacts builder","artifacts","web artifacts builder","single-file","css","Tailwind","ui components","single","use","file","components","react","multi","state","routing","state management",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":165,"sourceHtmlUrl":166,"categories":167,"keywords":174,"publishedAt":134},"01M71MSTFAEYT9J9GA587SP3RB","ui-styling","Create beautiful, accessible user interfaces with shadcn\u002Fui components (built on Radix UI + Tailwind), Tailwind CSS utility-first styling, and canvas-based visual designs. Use when building user interfaces, implementing design systems, creating responsive layouts, adding accessible components (dialogs, dropdowns, forms, tables), customizing themes and colors, implementing dark mode, generating visual designs and posters, or establishing consistent styling patterns across applications.","https:\u002F\u002Fgithub.com\u002Fmarshadgani\u002FArshad.AI\u002Fblob\u002Fclaude\u002Fai-personal-assistant-main\u002F.claude\u002Fskills\u002Fui-ux-pro-max\u002Fui-styling\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fmarshadgani\u002FArshad.AI\u002Fblob\u002Fclaude\u002Fai-personal-assistant-main\u002F.claude\u002Fskills\u002Fui-ux-pro-max\u002Fui-styling\u002FSKILL.md",[168,169],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":170,"categoryName":171,"taxonomyType":172,"taxonomyTypeDesc":173},"01JBSEEDCAT000000000000032","设计师","PROFESSION","适用职业",[175,176,132,149,150,177,178,179,40,180,181,182,183,155,184,185,186,187,188,30],"ui styling","styling","mode","canvas","implementing","themes","utility","design systems","when","across","create","component","layout","forms",{"skillNo":190,"name":40,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":200,"publishedAt":134},"01M71MSM72HXKQRCY5D45WYPNP","Comprehensive design skill: brand identity, design tokens, UI styling, logo generation (55 styles, Gemini, Atlas Cloud, or MuAPI AI), corporate identity program (50 deliverables, CIP mockups), HTML presentations (Chart.js), banner design (22 styles, social\u002Fads\u002Fweb\u002Fprint), icon design (15 styles, SVG, Gemini 3.1 Pro), social photos (HTML→screenshot, multi-platform). Actions: design logo, create CIP, generate mockups, build slides, design banner, generate icon, create social photos, social media images, brand identity, design system. Platforms: Facebook, Twitter, LinkedIn, YouTube, Instagram, Pinterest, TikTok, Threads, Google Ads.","https:\u002F\u002Fgithub.com\u002Fmarshadgani\u002FArshad.AI\u002Fblob\u002Fclaude\u002Fai-personal-assistant-main\u002F.claude\u002Fskills\u002Fui-ux-pro-max\u002Fdesign\u002FSKILL.md",[194,197,198,199],{"categoryNo":195,"categoryName":196,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":26,"categoryName":27,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":170,"categoryName":171,"taxonomyType":172,"taxonomyTypeDesc":173},[40,201,202,203,175,204,205,206,207,185,208,209,210,211,212,213,214,215,132,216],"Media","tiktok","actions","logo","logo generation","chart","multi-platform","ads","youtube","generate","presentations","google","atlas cloud","screenshot","muapi","identity",{"skillNo":218,"name":219,"nameZh":6,"description":220,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":221,"categories":222,"keywords":225,"publishedAt":134},"01M71MSH9T7S227MN2YSYB2EP5","design-system","Token architecture, component specifications, and slide generation. Three-layer tokens (primitive→semantic→component), CSS variables, spacing\u002Ftypography scales, component specs, strategic slide creation. Use for design tokens, systematic design, brand-compliant presentations.","https:\u002F\u002Fgithub.com\u002Fmarshadgani\u002FArshad.AI\u002Fblob\u002Fclaude\u002Fai-personal-assistant-main\u002F.claude\u002Fskills\u002Fui-ux-pro-max\u002Fdesign-system\u002FSKILL.md",[223,224],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":170,"categoryName":171,"taxonomyType":172,"taxonomyTypeDesc":173},[40,226,227,149,228,229,230,231,186,211,232,233,234,235,236,237,238,120,239,240],"design system","system","css variables","creation","Variables","architecture","systematic","token","spacing","layer","typography","brand","three","tokens","slide generation",{"skillNo":242,"name":243,"nameZh":6,"description":244,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":245,"categories":246,"keywords":249,"publishedAt":134},"01M71MSCFZ1HFMNBDMAFXDZV92","banner-design","Design banners for social media, ads, website heroes, creative assets, and print. Multiple art direction options with optional generated or supplied visuals. Actions: design, create, generate banner. Platforms: Facebook, Twitter\u002FX, LinkedIn, YouTube, Instagram, Google Display, website hero, print. Styles: minimalist, gradient, bold typography, photo-based, illustrated, geometric, retro, glassmorphism, 3D, neon, duotone, editorial, collage.","https:\u002F\u002Fgithub.com\u002Fmarshadgani\u002FArshad.AI\u002Fblob\u002Fclaude\u002Fai-personal-assistant-main\u002F.claude\u002Fskills\u002Fui-ux-pro-max\u002Fbanner-design\u002FSKILL.md",[247,248],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":170,"categoryName":171,"taxonomyType":172,"taxonomyTypeDesc":173},[40,250,251,201,252,253,254,203,255,256,257,258,259,260,185,208,209,210,261,262],"banner","banner design","3D","direction","neon","Art","social","generated","hero","dimensions","display","options","website"]