Terraform/OpenTofu infrastructure as code patterns. READ-ONLY - Claude NEVER executes terraform commands.
/plugin marketplace add settlemint/agent-marketplace/plugin install devtools@settlemintThis skill inherits all available tools. When active, it can use any tool Claude has access to.
<critical_restriction>
Claude MUST NEVER execute terraform apply or terraform destroy. This is non-negotiable.
terraform apply
terraform destroy
tofu apply
tofu destroy
terraform init # Initialize working directory
terraform plan # Preview changes
terraform validate # Validate configuration
terraform fmt # Format code
terraform output # Show outputs
terraform show # Show state/plan
terraform state list # List resources in state
terraform workspace list # List workspaces
terraform providers # Show providers
tofu init/plan/validate/fmt/etc.
terraform apply can delete production databases.tf files with proper HCL syntaxterraform init to initialize providersterraform plan to preview changesterraform validate and terraform fmtterraform.tfvars templatesterraform apply to apply changesterraform destroy to remove infrastructure</critical_restriction>
<quick_start>
Provider configuration:
terraform {
required_version = ">= 1.5.0"
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 5.0"
}
}
backend "s3" {
bucket = "my-terraform-state"
key = "prod/terraform.tfstate"
region = "us-east-1"
encrypt = true
dynamodb_table = "terraform-locks"
}
}
provider "aws" {
region = var.aws_region
default_tags {
tags = {
Environment = var.environment
ManagedBy = "terraform"
}
}
}
Module structure:
modules/
├── vpc/
│ ├── main.tf
│ ├── variables.tf
│ ├── outputs.tf
│ └── README.md
├── rds/
│ └── ...
environments/
├── prod/
│ ├── main.tf
│ ├── terraform.tfvars
│ └── backend.tf
├── staging/
│ └── ...
</quick_start>
<constraints>Banned:
prevent_destroy on databases/storagecount when for_each is more appropriateRequired:
description and typedescriptionterraform fmt style (user runs locally)sensitive = trueNaming: Resources=snake_case, Modules=kebab-case, Variables=snake_case
Variables with validation:
variable "environment" {
description = "Deployment environment (dev, staging, prod)"
type = string
validation {
condition = contains(["dev", "staging", "prod"], var.environment)
error_message = "Environment must be dev, staging, or prod."
}
}
variable "instance_type" {
description = "EC2 instance type"
type = string
default = "t3.micro"
validation {
condition = can(regex("^t[23]\\.", var.instance_type))
error_message = "Only t2 and t3 instances allowed."
}
}
Lifecycle rules for critical resources:
resource "aws_db_instance" "main" {
identifier = "${var.project}-${var.environment}"
# ... other config
lifecycle {
prevent_destroy = true
ignore_changes = [password]
}
}
resource "aws_s3_bucket" "data" {
bucket = "${var.project}-${var.environment}-data"
lifecycle {
prevent_destroy = true
}
}
Dynamic blocks:
resource "aws_security_group" "main" {
name = "${var.project}-sg"
vpc_id = var.vpc_id
dynamic "ingress" {
for_each = var.ingress_rules
content {
from_port = ingress.value.from_port
to_port = ingress.value.to_port
protocol = ingress.value.protocol
cidr_blocks = ingress.value.cidr_blocks
}
}
}
Module composition:
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
version = "5.1.0" # Always pin versions
name = "${var.project}-vpc"
cidr = var.vpc_cidr
azs = var.availability_zones
private_subnets = var.private_subnet_cidrs
public_subnets = var.public_subnet_cidrs
enable_nat_gateway = true
single_nat_gateway = var.environment != "prod"
tags = local.common_tags
}
</patterns>
<user_instructions>
Claude can run most terraform commands to help you work with infrastructure:
# Claude CAN run these:
terraform init # Initialize providers
terraform plan -out=tfplan # Preview changes
terraform validate # Check syntax
terraform fmt -recursive # Format code
terraform output # Show outputs
terraform show # Show state
# YOU must run these (Claude is blocked):
terraform apply tfplan # Apply changes
terraform destroy # Remove infrastructure
Claude helps with init, plan, validate, format. You run apply/destroy yourself.
</user_instructions>
<success_criteria>
</success_criteria>
This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create command with file references", "interactive command", "use AskUserQuestion in command", or needs guidance on slash command structure, YAML frontmatter fields, dynamic arguments, bash execution in commands, user interaction patterns, or command development best practices for Claude Code.
This skill should be used when the user asks to "create an agent", "add an agent", "write a subagent", "agent frontmatter", "when to use description", "agent examples", "agent tools", "agent colors", "autonomous agent", or needs guidance on agent structure, system prompts, triggering conditions, or agent development best practices for Claude Code plugins.
This skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", "use ${CLAUDE_PLUGIN_ROOT}", "set up event-driven automation", "block dangerous commands", or mentions hook events (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification). Provides comprehensive guidance for creating and implementing Claude Code plugin hooks with focus on advanced prompt-based hooks API.