Terraform & OpenTofu Skill for AI Agents
Production-focused Terraform and OpenTofu guidance for AI agents
Clear guardrails on high-risk operations: destroy requires plan -destroy first, showing every resource (including implicit dependents) that will be deleted, never uses -auto-approve on destroy, and requires a reviewed plan artifact before production apply — solid safety design for a skill that can trigger irreversible infrastructure changes.
The author, Anton Babenko, is a publicly identifiable, verifiable active Terraform community maintainer (known Terraform module author). Version is pinned (1.17.1); the skill's own frontmatter claims Apache-2.0 while the repo-level license field is NOASSERTION — a minor inconsistency.
- The repo-level GitHub license shows as NOASSERTION while the SKILL.md frontmatter claims Apache-2.0 — worth confirming before relying on it
What it does & when to use it
This skill provides AI coding agents with best-practice guidance for Terraform and OpenTofu, covering testing, modules, state management, CI/CD, security, and compliance. It treats AWS, Azure, and GCP as first-class targets, with AWS used as the default in examples. The README lists compatibility with Claude Code, Cursor, Copilot, Gemini CLI, OpenCode, Codex, Kiro, and other Agent Skills-compatible hosts. SKILL.md is not cached, so its actual frontmatter, body structure, and exact path cannot be independently verified.
It provides decision frameworks for native Terraform tests versus Terratest, module structure and versioning guidance, remote backend and state-isolation patterns, GitHub Actions and GitLab CI examples, and security workflows using tools such as Trivy and Checkov.
- Create tested Terraform modules for AWS VPCs, Azure VNets, or GCP VPC networks
- Configure remote state with S3, Azure, GCS, or Terraform Cloud backends
- Generate CI/CD workflows with formatting, validation, linting, security scanning, cost estimation, and OIDC authentication
- Review existing Terraform configurations against module, naming, state-management, and provider best practices
- Choose between native terraform test and Go-based Terratest for module testing
Pros & cons
- Covers production-oriented testing, modules, state, CI/CD, security, and compliance
- Supports both Terraform and OpenTofu, with cross-cloud mappings for AWS, Azure, and GCP
- Uses decision matrices, flowcharts, and DO/DON'T patterns to explain when and why to use practices
- Provides installation commands and concrete prompts for multiple AI-agent hosts
- SKILL.md is not cached, so the skill body, frontmatter, and actual skill path cannot be independently verified
- Repository metadata says License NOASSERTION, while the README and badge state Apache 2.0, creating a licensing-information discrepancy
- Some guidance depends on specific Terraform/OpenTofu versions, provider support, and optional tools such as the Terraform MCP server, terraform-ls, Trivy, or Checkov
- The supplied material provides no test results, coverage figures, or independent quality assessment
How to install
For an Agent Skills-compatible tool, run: npx skills add https://github.com/antonbabenko/terraform-skill. For Codex, the README gives: git clone https://github.com/antonbabenko/terraform-skill.git ~/.agents/skills/terraform-skill. It also documents installation commands for Claude Code, Gemini CLI, Cursor, Copilot, OpenCode, Kiro, and other hosts.
How to use
After installation, ask for a concrete task such as “Create a Terraform module for an AWS VPC with native tests,” “Configure an S3 backend with native use_lockfile locking and encryption for Terraform state,” or “Review this Terraform configuration following best practices.” The README recommends native tests with Terraform 1.6+ and states that use_lockfile requires Terraform 1.10+, while write_only or *_wo arguments require Terraform 1.11+ where supported by the provider.
Compared to similar skills
The README compares native terraform test with Terratest as alternative testing approaches and uses AWS as the default example while mapping patterns to Azure and GCP. It recommends the companion code-intelligence plugin but explicitly says terraform-skill works independently.