domains / devops / terraform-release-and-provisioner-safety / terraform

terraform

Skill card

combined

The two copies address different Terraform tasks. The daymade copy is a release-safety and provisioner-troubleshooting procedure (canonical release entry, environment parity, saved-plan binding, provisioner side effects, and incident-derived symptom patterns). The sickn33 copy is a general IaC best-practices guide (count vs for_each, module patterns, CI/CD, and security scanning). They overlap only in the broad domain of Terraform, and neither contains the other's material steps, so crowning one would hide a real alternative.

Repositories

Other copies

Combined skill

---
name: terraform
---
# Terraform Skill

## Scope
Use this skill for Terraform/OpenTofu work, including release safety, provisioner design, environment isolation, and general IaC best practices.

## Release and Provisioner Safety
1. Route the task: for releases, shared gateways, saved plans, or production promotion, read the release-safety and pre-deploy validation references before approval or mutation.
2. Use the repository's canonical release entry. When shared-gateway publication requires standard CI, initiate that CI within existing authorization. Do not substitute a local Terraform apply, root SSH/SCP, helper, or console write.
3. Prefer provider resources, image baking, cloud-init, or configuration management over provisioners. When a provisioner is necessary, make its artifact, target, lock, validation, and readback explicit.
4. Inventory every resource or recovery tool that can write the target runtime.
5. Give staging and production one required-key schema; let values differ but never let a key be required in one environment and optional or absent in another.
6. Validate the exact candidate bytes, Compose-rendered environment, and immutable runtime image before the first live write or restart.
7. Treat a saved plan as an executable artifact. Bind it to reviewed source/artifact identity and apply that exact file.
8. Honor the user's production authorization at the last reversible point.
9. Stop after the requested result is verified; do not expand scope into unrelated hardening.

## Provisioner Troubleshooting
- If `terraform plan` says "No changes" but the site is down, probe the affected hostname, inspect loaded routes and live files, compare deployed source/artifact hashes with live hashes, and reconstruct each writer's candidate file set and delete/exclude scope.
- Use the repository's canonical release entry and its plan/apply wrapper for recovery; verify the candidate against the current live baseline before replacement.

## General IaC Best Practices
- Use `count` for boolean conditions or simple numeric replication; use `for_each` for stable addressing, key-based reference, or multiple named resources.
- Run static security scanning with Trivy and Checkov.
- Do not store secrets in variables, use default VPCs, skip encryption, or open security groups to 0.0.0.0/0.
- Use secrets managers, dedicated VPCs, encryption at rest, and least-privilege security groups.

## Limitations
- Use this skill only when the task clearly matches the scope above.
- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.