From argos
Terraform / Pulumi / CloudFormation review — state management, module contract, plan output, drift detection, security scan (tfsec/checkov/OPA), cost diff (Infracost). Plan ≠ apply disiplini.
npx claudepluginhub resultakak/argos --plugin argosThis skill uses the workspace's default tool permissions.
`agents/shared/severity-rubric.md` ve `agents/shared/escalation-matrix.md` default-load
Mandates invoking relevant skills via tools before any response in coding sessions. Covers access, priorities, and adaptations for Claude Code, Copilot CLI, Gemini CLI.
Share bugs, ideas, or general feedback.
agents/shared/severity-rubric.md ve agents/shared/escalation-matrix.md default-load
sayılır (agents/coordination.md §11). Bu skill'in çıktısı Critical / High / Medium /
Low + kanıt formatında olmak zorunda — spekülatif Critical yasak. Sahiplik dışı bulgu
ilgili agent'a delege; karar yetkisi eşiği aşılırsa kullanıcı onayı zorunlu.
| Tool | İşaret |
|---|---|
| Terraform | *.tf, terraform.tfstate*, .terraform.lock.hcl |
| Pulumi | Pulumi.yaml, Pulumi.<stack>.yaml |
| CloudFormation | *.yaml/*.json AWSTemplateFormatVersion |
| Ansible | playbook.yml, inventory/, roles/ |
| AWS CDK | cdk.json, bin/, lib/*.ts |
variables.tf input + outputs.tf output explicit.versions.tf Terraform + provider versiyonu pin.variable validation block (tip + range + regex).default değer verilirken comment.?ref=v1.2.0 semver pin (mutable ref yasak).PR description'da terraform plan zorunlu:
Plan: 3 to add, 1 to change, 0 to destroy.
to destroy > 0 → highlight + 2-person review.prevent_destroy = false ihlali → block.<env>-<service>-<purpose> convention.prevent_destroy = true DB/KMS/VPC.create_before_destroy = true zero-downtime.ignore_changes minimum (drift kaynağı).for_each > count (stable address).random_password, local_file → state encryption şart.*.tfvars Git'te: terraform.tfvars .gitignore'da olmalı; sample
terraform.tfvars.example OK.TF_VAR_* ENV preferred runtime için.| Tool | Kapsam |
|---|---|
| tfsec | TF-specific, hızlı, CIS/HIPAA/PCI rule set |
| checkov | Multi-IaC, geniş policy (1k+ check) |
| kics | Multi-IaC, KICS query language |
| OPA + Conftest | Custom policy (organization-specific) |
| Sentinel | TF Cloud paid, policy-as-code |
Severity threshold:
0.0.0.0/0 to all ports).terraform plan cron (haftalık) — drift varsa alert.terraform import / state mv) veya
config'e ekle (ignore_changes precise).Δ cost / month.> $100/ay artış → review + justification.terraform test (1.6+) — declarative.?ref=v1.2.0)to destroy highlight + onayprevent_destroy kritik resource'lardamaster/main ref module source.-auto-approve rutin.rm/mv review'sız.*.tfvars secret Git'te.count = enabled ? 1 : 0 boolean toggle.provisioner "local-exec" rutin.null_resource + local-exec state-driven olmayan.ignore_changes = all.-target apply rutin.latest prod'da.User: /iac-review terraform/envs/prod/
Agent (iac-engineer):
1. Tool tespit: Terraform 1.6.4, AWS provider 5.x.
2. State: S3 backend + DynamoDB lock ✓; encryption KMS ✓; versioning ✓.
3. Module contract: 3 modül; `vpc` `master` ref kullanıyor (Critical, mutable).
4. Plan output:
- Plan: 7 to add, 2 to change, 1 to destroy.
- destroy: aws_db_instance.legacy → `prevent_destroy = false` (Critical).
5. Tag eksik: 4 resource'ta `CostCenter` yok (Medium).
6. Secret: `terraform.tfvars` `.gitignore`'da var ✓; `TF_VAR_DB_PASSWORD` CI ENV.
7. Security: tfsec 3 finding (1 High public S3 ACL, 2 Medium SG egress).
8. Cost: Infracost +$340/ay → RDS instance class büyütüldü.
9. Output:
- Critical: vpc module ref pin + DB prevent_destroy + S3 ACL
- High: SG egress
- Medium: tag eksik 4 resource
- 8 issue açıldı (sahip + tarih).
# IaC Review: <path>
## State / Backend
- Remote, locking, encryption, versioning, per-env
## Module Contract
- variables / outputs / versions / source pin
## Plan Output
```text
Plan: ... to add, ... to change, ... to destroy
| Öncelik | Aksiyon | Sahip | Bitiş | Issue |