terraform-skill AI工具

Requirements

• An AI agent with skill support: Claude Code, Cursor, Copilot, Gemini CLI, OpenCode, Codex, Kiro, or any Agent Skills-compatible host
• Terraform 1.0+ or OpenTofu 1.6+
• Optional: Terraform MCP server for registry integration

Installation

Installed through one Claude Code marketplace, antonbabenko/agent-plugins (terraform-skill is listed there as an external plugin). Do not also add antonbabenko/terraform-skill as a marketplace - both use the same marketplace name and will clash.

Quick install (any agent)

Works with any Agent Skills-compatible tool:

npx skills add https://github.com/antonbabenko/terraform-skill

Verify installation

After installation, try:

"Create a Terraform module with testing for an S3 bucket"

Claude picks up the skill automatically when working with Terraform or OpenTofu code.

Quick start examples

Create a module with tests (AWS / Azure / GCP): > "Create a Terraform module for an AWS VPC with native tests" > > "Build an Azure module: VNet, subnets, and a PostgreSQL Flexible Server, with native tests" > > "Write a GCP module for a VPC network, subnetwork, and Cloud SQL Postgres, with native tests"

Set up remote state: > "Configure an S3 backend with native use_lockfile locking and encryption for Terraform state" > > "Choose and configure a remote state backend for AWS, Azure, or GCP (locking, encryption, versioning)"

Review existing code: > "Review this Terraform configuration following best practices"

Generate CI/CD workflow: > "Create a GitHub Actions workflow for Terraform with cost estimation"

Testing strategy: > "Help me choose between native tests and Terratest for my modules"

State management: > "How should I organize state files for a multi-team environment?"

Longer example prompts

These assume a recent Terraform/OpenTofu - use_lockfile is 1.10+, write_only is 1.11+.

<details> <summary>AWS: production service (modules + composition, OIDC, native locking)</summary>

"I'm building a new production service on AWS. Design reusable Terraform modules plus a prod/staging composition for a VPC with public/private subnets across 3 AZs, an ECS Fargate service behind an ALB, and an RDS Postgres instance. Include native terraform test coverage, variables with descriptions/types/validation, S3 remote state with encryption, bucket versioning, and native use_lockfile locking (Terraform 1.10+). Keep secret values out of plan/state - use write_only / *_wo arguments where the provider supports them (Terraform 1.11+) and Secrets Manager/SSM references for runtime secrets. Add a GitHub Actions workflow that runs fmt/validate/tflint/trivy on PRs, produces a reviewed plan artifact, and applies it via AWS OIDC (no static keys). Keep prod/staging state isolated and follow naming conventions."

</details>

<details> <summary>GCP: port the AWS pattern (cross-cloud mapping, WIF, gcs backend)</summary>

"We're standardizing IaC across clouds. Port our AWS module pattern to GCP: reusable modules plus an environment composition for a VPC network, a regional subnetwork, and a Cloud SQL Postgres instance (google_sql_database_instance). Use the gcs backend (bucket + prefix) for remote state, and show the state bootstrap bucket separately with object versioning, uniform bucket-level access, public access prevention, and IAM bindings. Use Workload Identity Federation for keyless GitHub Actions auth (no long-lived service-account keys) and native tests. Also show the cross-cloud equivalents (resources + backend) so the team sees the AWS-to-GCP mapping."

</details>

Code intelligence (optional)

The skill works without a language server. To jump to a definition, find references, outline a file, or show hover docs, it can also use terraform-ls, HashiCorp's official Terraform language server.

- Optional. Without terraform-ls the skill falls back to text search (rg) plus reading files. Nothing breaks; you get text matches instead of matches by meaning. - Needs. A local terraform (or tofu) binary on PATH, and terraform init run in the workspace, before it can resolve names across modules and providers. - Install. Get it from the terraform-ls releases page, or turn it on through your editor or agent host. Use whatever version your host supports. - Claude Code: install it as an LSP plugin - /plugin marketplace add boostvolt/claude-code-lsps then /plugin install terraform-ls@claude-code-lsps.

How the skill uses it:

- Use the language server to follow a name to where it is defined or used; use rg plus reading files for exact text, known names, .tfvars, comments, and non-HCL files. - Point the language server at a spot in the file first (find an occurrence, then ask about that position). - terraform-ls cannot rename for you. To rename a variable, local, or output: find every reference, then edit each by hand. To rename a resource or module address: use a moved block, not a text replace.

Module development

Naming conventions (terraform-<PROVIDER>-<NAME>), directory structure, input/output design, version constraints, and documentation standards.

CI/CD workflows

GitHub Actions, GitLab CI, Atlantis, Infracost cost estimation, Trivy/Checkov scanning, and compliance checks.