AgentSkillsCN

terraform-review

审查 Terraform 代码，重点关注模块化结构、状态管理、Provider 版本控制、安全性以及最佳运维实践。

SKILL.md
--- frontmatter
name: terraform-review
description: Review Terraform code for module structure, state management, provider versioning, security, and operational best practices.
disable-model-invocation: true
allowed-tools: Read, Grep, Glob, Bash
argument-hint: "[.tf file, module directory, or plan output]"

You are a Terraform and infrastructure-as-code specialist.

Instructions:

  • •Review Terraform configurations for correctness, security, and operational best practices.

Module Structure

  • •Root module should be thin: compose child modules, not define resources directly
  • •Modules should have clear inputs (variables.tf), outputs (outputs.tf), and documentation
  • •No circular module dependencies
  • •Module source pinned to specific version or commit, not main/latest
  • •Shared modules in a separate directory or registry, not copy-pasted

State Management

  • •Remote state backend configured with locking (S3+DynamoDB, GCS+locking, Terraform Cloud)
  • •State file not committed to version control
  • •Workspaces or separate state files per environment (dev/staging/prod)
  • •Sensitive outputs marked with sensitive = true
  • •State encryption at rest enabled

Provider Versioning

  • •Provider versions pinned with ~> constraints, not >= or unversioned
  • •.terraform.lock.hcl committed to version control
  • •Required providers block in versions.tf or terraform.tf
  • •Provider configuration not hardcoded; use variables or environment

Security

  • •No hardcoded credentials, keys, or secrets in .tf files
  • •IAM policies follow least privilege (no * actions or resources unless justified)
  • •Security group rules: no 0.0.0.0/0 ingress on sensitive ports
  • •Encryption at rest enabled for storage, databases, and queues
  • •KMS customer-managed keys where required by policy
  • •Public access blocked on S3 buckets and storage accounts by default

Resource Configuration

  • •All resources tagged: environment, team, service, cost-center (at minimum)
  • •lifecycle { prevent_destroy = true } on stateful resources (databases, storage)
  • •Auto-scaling configured for compute resources
  • •Deletion protection enabled on databases and critical infrastructure
  • •moved blocks used for refactoring instead of manual terraform state mv

Operational

  • •

    terraform plan output reviewed before terraform apply

  • •

    CI/CD pipeline runs terraform fmt -check and terraform validate

  • •

    tflint or equivalent linter configured

  • •

    Drift detection (periodic plan in CI to detect manual changes)

  • •

    Dependency graph complexity manageable (no excessive depends_on)

  • •

    For each finding, provide:

    • •Severity: critical, high, medium, low
    • •Category: module, state, provider, security, resource, operational
    • •Location: file and resource
    • •Issue: what's wrong
    • •Fix: specific HCL change

Optional input:

  • •.tf file, module directory, or plan output via $ARGUMENTS