Terraform Patterns — Security & Safety

Terraform Patterns is an opinionated skill that guides users in writing well-structured, secure, and production-grade Terraform infrastructure code. It covers module design, state management, provider configuration, security hardening, and CI/CD integration, providing checklists, scripts, and patterns to avoid common pitfalls.

engineering claude-code

📂 View skill on GitHub ↗ 🚀 How to use

✨ What it does

Provides slash commands for code review, module design, and security audit.
Includes detailed checklists for module structure, state management, providers, and security.
Offers Python scripts for analyzing module quality and scanning for security issues.
Presents module design patterns (flat, nested, Terragrunt) and provider configuration patterns.
Includes a state management decision tree and CI/CD integration examples.
Proactively flags common issues like missing remote backend, hardcoded secrets, and open security groups.

🎯 When to use it

When reviewing existing Terraform code for anti-patterns, security issues, or structural problems.
When designing or refactoring a Terraform module with proper inputs, outputs, and composition.
When setting up or migrating to a remote state backend with locking and encryption.
When implementing multi-region or multi-account Terraform deployments.
When auditing Terraform code for security vulnerabilities or secrets exposure.

🚀 How to use

Trigger: /terraform:review

Trigger the skill by using slash commands like /terraform:review, /terraform:module, or /terraform:security, or by asking questions about Terraform code, modules, state, or security. Provide the path to your Terraform files or describe your infrastructure setup. Example prompts:

/terraform:review ./terraform
Design a Terraform module for an AWS VPC
/terraform:security audit my Terraform code

📄 Output: The skill produces analysis reports, module scaffolds, security audit reports, and actionable recommendations based on the checklists and scripts.

📦 Add this skill to Claude Code

# 1. Get the skills repo
git clone --depth 1 https://github.com/alirezarezvani/claude-skills /tmp/claude-skills

# 2. Copy this skill into your project (or ~/.claude/skills for all projects)
mkdir -p .claude/skills
cp -r /tmp/claude-skills/engineering/terraform-patterns/skills/terraform-patterns .claude/skills/terraform-patterns

Skill source: engineering/terraform-patterns/skills/terraform-patterns/SKILL.md

⚠️ Good to know

The skill assumes the user has Terraform files and may require Python to run the included scripts; it is not a tutorial and focuses on best practices.

❓ FAQ

What does the /terraform:review command do?

It analyzes your Terraform code for anti-patterns, security issues, and structural problems, generating a report based on the review checklist.

How does the skill handle state management?

It provides a decision tree to choose the right backend (S3, GCS, Azure Blob, Terraform Cloud) and emphasizes remote state with locking and encryption.

What security checks does the skill perform?

It checks for hardcoded secrets, overly permissive IAM, open security groups, missing encryption, and public access, among others, using the security scanner script.

🤖 Overview, features, install steps and FAQ were generated from the project's SKILL.md on Sep 4, 2026. Always check the original source before running commands.