terraform-engineer

An agent skill by Jeffallan, from Jeffallan/claude-skills. Tags: automation, cloud, devops, migration, testing.

What it does

Use when implementing infrastructure as code with Terraform across AWS, Azure, or GCP. Invoke for module development (create reusable modules, manage module versioning), state management (migrate backends, import existing resources, resolve state conflicts), provider configuration, multi-environment workflows, and infrastructure testing.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add Jeffallan/claude-skills --skill terraform-engineer

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/Jeffallan/claude-skills
cp -r claude-skills/skills/terraform-engineer ~/.claude/skills/terraform-engineer

Safety box score

Grade C, moderate risk: 44 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a Terraform operations playbook for AWS, Azure, and GCP: it runs validation/testing commands, manages state, and can apply infrastructure changes. The main risks are broad cloud-side mutations (`terraform apply`, state import/rm/force-unlock) and access to local/cloud credentials; the files are otherwise plain, readable markdown.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It explicitly runs shell tools such as `terraform fmt`, `terraform validate`, `tflint`, `terraform plan -out=tfplan`, and `terraform apply tfplan`, and also shows package installs like `brew install tflint` and `pip install pre-commit`.
Network access	2 (moderate)	Terraform will talk to cloud APIs and remote sources; the docs include remote backends, provider authentication, and a Git module source like `git::https://github.com/org/terraform-modules.git//vpc?ref=v1.2.3`.
Filesystem reach	1 (low)	It reads a home-directory credential file (`shared_credentials_files = ["~/.aws/credentials"]`) and writes local state backups such as `terraform.tfstate.backup`, but it does not edit system files.
Secrets & credentials	2 (moderate)	The skill explicitly handles credential material and secret-bearing inputs, including `~/.aws/credentials`, `client_secret`, `client_certificate_password`, and `file("service-account-key.json")`.
Privilege & persistence	1 (low)	It installs local tooling with commands like `brew install conftest`, `brew install tflint`, and `pip install pre-commit`, but it does not require sudo or register services.
Instruction hijack surface	0 (none)	There are no hidden prompts, prompt-injection tricks, or instructions to ignore higher-level rules; the content is straightforward workflow guidance.
Irreversible actions	3 (high)	This skill's purpose is to change live infrastructure, and it includes `terraform apply tfplan`, `terraform import`, `terraform state rm`, and `terraform force-unlock`, even though it asks for approval before apply.
Transparency	0 (none)	All shipped files are plain markdown with readable examples; there are no binaries, obfuscated blobs, or runtime-decoded code.

Before installing

Read `references/providers.md` and confirm you are okay with it using `~/.aws/credentials`, `client_secret`, or `service-account-key.json`-style auth.
Verify you want the agent to be able to run `terraform apply tfplan` and state commands like `terraform import` / `terraform state rm` on real infrastructure.
Check whether local installs via `brew install tflint`, `brew install conftest`, and `pip install pre-commit` are acceptable in your environment.
Use a non-production cloud account or sandbox first, because the skill is designed to mutate live AWS/Azure/GCP resources.

Rated 2026-10-20 by an automated review of 6 files from the skill's repository.

Source

Repository: Jeffallan/claude-skills (all skills from this repository)
Path: skills/terraform-engineer/SKILL.md
Branch: main
Updated: 2026-09-19

agents-deploy — Use when deploying your agent to AWS, or when a deploy has failed.
devcontainer-setup — Creates devcontainers with Claude Code, language-specific tooling (Python/Node/Rust/Go), and persistent volumes.
ossfuzz — Enrolls a project in OSS-Fuzz, Google's free continuous fuzzing service for open source, and drives it locally.
cloud-architect — Designs cloud architectures, creates migration plans, generates cost optimization recommendations, and produces disaster recovery strategies across AWS, Azure.
salesforce-developer — Writes and debugs Apex code, builds Lightning Web Components, optimizes SOQL queries, implements triggers, batch jobs, platform events.
sre-engineer — Defines service level objectives, creates error budget policies, designs incident response procedures, develops capacity models.