Terraform Iac

Execute and analyze Terraform operations:

# Initialize workspace
terraform init -backend-config=backend.hcl

# Format check
terraform fmt -check -recursive

# Validation
terraform validate

# Plan with output
terraform plan -out=tfplan -detailed-exitcode

# Apply with auto-approve (for CI/CD)
terraform apply -auto-approve tfplan

# Show state
terraform show -json tfplan > plan.json

# State operations
terraform state list
terraform state show <resource>

2. HCL Syntax Validation

Validate Terraform configurations:

# Terraform native validation
terraform validate

# TFLint for best practices
tflint --init
tflint --format=json

# Checkov security scanning
checkov -d . --output json

# Terrascan policy checks
terrascan scan -d . -o json

3. Module Generation

Generate Terraform modules following best practices:

# Example module structure
# modules/vpc/main.tf
resource "aws_vpc" "main" {
  cidr_block           = var.cidr_block
  enable_dns_hostnames = var.enable_dns_hostnames
  enable_dns_support   = var.enable_dns_support

  tags = merge(var.tags, {
    Name = var.name
  })
}

# modules/vpc/variables.tf
variable "cidr_block" {
  description = "CIDR block for the VPC"
  type        = string
}

variable "name" {
  description = "Name of the VPC"
  type        = string
}

variable "enable_dns_hostnames" {
  description = "Enable DNS hostnames"
  type        = bool
  default     = true
}

variable "enable_dns_support" {
  description = "Enable DNS support"
  type        = bool
  default     = true
}

variable "tags" {
  description = "Additional tags"
  type        = map(string)
  default     = {}
}

# modules/vpc/outputs.tf
output "vpc_id" {
  description = "ID of the VPC"
  value       = aws_vpc.main.id
}

output "cidr_block" {
  description = "CIDR block of the VPC"
  value       = aws_vpc.main.cidr_block
}

4. State Analysis and Drift Detection

# Refresh and detect drift
terraform plan -refresh-only

# Import existing resources
terraform import <resource_type>.<name> <id>

# Move resources in state
terraform state mv <source> <destination>

# Remove from state (orphaning)
terraform state rm <resource>

5. Multi-Cloud Provider Support

AWS Provider

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = {
      Environment = var.environment
      ManagedBy   = "terraform"
    }
  }
}

GCP Provider

provider "google" {
  project = var.gcp_project
  region  = var.gcp_region
}

provider "google-beta" {
  project = var.gcp_project
  region  = var.gcp_region
}

Azure Provider

provider "azurerm" {
  features {}

  subscription_id = var.azure_subscription_id
}

MCP Server Integration

This skill can leverage the following MCP servers:

Best Practices

Code Organization

infrastructure/
├── environments/
│   ├── dev/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   └── terraform.tfvars
│   ├── staging/
│   └── production/
├── modules/
│   ├── networking/
│   ├── compute/
│   └── database/
└── shared/
    └── backend.tf

State Management

1. Remote Backend - Always use remote state (S3, GCS, Azure Blob)
2. State Locking - Enable locking (DynamoDB, GCS, Azure)
3. State Encryption - Encrypt state at rest
4. Workspace Strategy - Use workspaces or directory structure

Security

1. No Hardcoded Secrets - Use variables or secret managers
2. Least Privilege IAM - Minimal permissions for Terraform
3. Policy as Code - Use Sentinel, OPA, or Checkov
4. Audit Logging - Enable CloudTrail/Audit Logs

CI/CD Integration

# Example GitHub Actions workflow