Terraform Skill (Terraform/OpenTofu Diagnostics)

What it does

This skill rewires how Claude handles infrastructure-as-code work: diagnose first, then generate, with explicit risk controls.

• Failure-mode routing table: maps symptoms into 13 categories — identity churn (addresses shifting after refactor), secret exposure, blast radius, destroy cascade, CI drift, compliance gaps, testing blind spots, state corruption/recovery, provider upgrade and lifecycle risk, provisioner misuse, cross-cloud mapping — and loads only the matching reference file.
• Response contract on every answer: (1) assumptions and version floor (runtime, providers, backend, execution path: local/CI/Cloud/Atlantis), (2) risk category addressed, (3) chosen remediation and tradeoffs, (4) exact validation commands (fmt -check, validate, plan -out, policy checks), (5) rollback notes for anything destructive or state-mutating.
• Hard safety rails: never recommends production apply without a reviewed plan artifact and approval; requires terraform plan -destroy plus an enumerated deletion list (including implicit dependents pulled in via locals or for_each) and explicit confirmation before any destroy — and never -auto-approve on destroy.
• Version-aware feature guards: moved (1.1+), optional() (1.3+), import/check (1.5+), native terraform test (1.6+), mock providers (1.7+), removed (1.7+), cross-variable validation (1.9+), S3 native lockfile (1.10+), write_only args (1.11+).
• Opinionated structure: module hierarchy (resource → resource module → infrastructure module → composition), directory layout, naming and block-ordering rules, variable/output contracts, state-splitting heuristics (split above ~500 resources, combine below ~100), version pinning matrix, trivy/checkov security stage.
• terraform-ls code intelligence: position-anchored goToDefinition/findReferences, manual rename discipline for value symbols, moved blocks instead of blind text renames, and a degradation gate before claiming LSP is broken.

Who it's for

• Platform and DevOps engineers authoring or reviewing shared Terraform modules
• Teams organizing multi-environment layouts and remote state backends
• Anyone building IaC pipelines in GitHub Actions, GitLab CI, or Atlantis, or chasing local-vs-CI plan mismatches
• Engineers designing a test strategy with native terraform test, Terratest, or mock providers
• Teams migrating to OpenTofu or planning a major provider bump

Overkill for basic HCL syntax questions or plain provider API lookups.

Example uses

1. count → for_each migration: "Deleting one subnet in the middle recreated all of them." It diagnoses identity churn, produces the for_each = toset(...) rewrite plus the matching moved blocks, and requires a plan showing zero destroys.
2. Fixing CI drift: "My local plan differs from the CI plan." It pins runtime and providers, commits .terraform.lock.hcl, and restructures the pipeline so the apply job consumes the reviewed plan artifact instead of re-running plan.
3. Secrets leaking into state: "Is sensitive = true enough?" It explains that this only masks display, then offers write_only/*_wo on 1.11+ or runtime lookups from Secrets Manager / Key Vault below that, with tradeoffs.
4. Stuck lock or backend migration: walks through unlocking safely, choosing S3 use_lockfile (1.10+) over DynamoDB, and keeping backups plus evidence with clear rollback notes.

Install the skill I found on Claude Skill Mart.
Copy the skills/terraform-skill folder from the GitHub repo antonbabenko/terraform-skill into my ~/.claude/skills/antonbabenko-terraform-skill/.
When it's done, tell me in one line what this skill can do.