agentleFS
Sign inStart free
abdullahkhawerabdullahkhawer/devops-skills/skills/terraform-cli/SKILL.md

terraform-cli

Skill8 starsChanged 6 months agoApache-2.0View on GitHub

Perform Terraform operations using the terraform CLI. Use for planning, validating, and inspecting infrastructure-as-code state and workspaces.

  • Installs packages

We split this skill into the rules it gives an agent

12 rules. About 0 are common, 3 are distinctive, and 9 are very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈3

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 9

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Very specific:

    Use the workspace table and rules below when constructing all terraform commands.

    line 8
  2. Distinctive:

    Update the table below with your Terraform workspace/backend names before using this skill:

    line 12
  3. Distinctive:

    If the target environment is unclear, ask the user before running any command.

    line 20
  4. Very specific:

    If terraform is not installed or the backend is not initialized, inform the user that setup is required and ask them to complete the …

    line 24
  5. Very specific:

    Always run commands from the directory containing the relevant Terraform root module, and pass -var-file explicitly for the target …

    line 34
  6. Distinctive:

    NEVER target a workspace or var file not listed in the configuration table above.

    line 100
  7. Very specific:

    NEVER run terraform apply, terraform destroy, or any command in the "Never run" table above without explicit user instruction — a human …

    line 101
  8. Very specific:

    Always run terraform plan and show the output before ever suggesting an apply — never apply blind.

    line 102
  9. Very specific:

    Always confirm the active workspace with terraform workspace show before running any command that reads or writes state, to avoid targeting …

    line 103
  10. Very specific:

    NEVER print, display, or store the contents of .tfvars files or state files that may contain secrets — treat any sensitive = true output as …

    line 104
  11. Very specific:

    If state appears locked (Error: Error acquiring the state lock), do NOT run force-unlock — report this to the user and let them confirm no …

    line 105
  12. Very specific:

    Prefer -out=tfplan and terraform show -json tfplan when a plan must be inspected programmatically, so it can be re-applied exactly as …

    line 106

≈ “Common” is an estimate: at least 1 in 5 of the 308,232 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Terraform CLI Skill

Use the workspace table and rules below when constructing all terraform commands.

Configuration

Update the table below with your Terraform workspace/backend names before using this skill:

EnvironmentWorkspaceBackend Config / Var File
Production<your-prod-workspace><your-prod.tfvars>
Staging / Non-Prod<your-nonprod-workspace><your-nonprod.tfvars>
Sandbox / Dev<your-sandbox-workspace><your-sandbox.tfvars>

If the target environment is unclear, ask the user before running any command.

Prerequisites (one-time setup by user)

If terraform is not installed or the backend is not initialized, inform the user that setup is required and ask them to complete the following steps manually. Do not perform these steps yourself.

brew install terraform
terraform init
terraform workspace list

Command Format

Always run commands from the directory containing the relevant Terraform root module, and pass -var-file explicitly for the target environment:

terraform <command> -var-file=<var-file> [options]

Examples

# Select the correct workspace before running any command
terraform workspace select <your-nonprod-workspace>

# Non-Prod
terraform plan -var-file=<your-nonprod.tfvars> -out=tfplan

# Show a saved plan in human-readable form
terraform show tfplan

# Show a saved plan in JSON (for programmatic inspection)
terraform show -json tfplan

Available Commands

Read-only (safe, no confirmation needed)

CommandDescription
plan -var-file=<file> [-out=tfplan]Show or save a proposed set of changes — does not mutate infrastructure
validateCheck configuration syntax and internal consistency
fmt -recursive [-check] [-diff]Format or check formatting of .tf files
show [tfplan]Show the current state or a saved plan in human-readable form
show -json [tfplan]Show the current state or a saved plan as JSON
state listList all resources tracked in state
state show <resource>Show attributes of a resource in state
output [-json]Show output values from the root module
workspace list / workspace showList or show the current workspace
graphGenerate a visual dependency graph (DOT format)
providersList provider requirements and versions
versionShow Terraform and provider versions
consoleOpen an interactive expression evaluator (read-only against current state)

Mutating operations (confirm with user before running)

CommandDescription
apply tfplan / apply -var-file=<file>Apply a plan and provision/modify real infrastructure
workspace new <name>Create a new workspace
workspace select <name>Switch the active workspace
refresh -var-file=<file>Reconcile state with real infrastructure (can drift outputs)
state mv <src> <dst>Move a resource within state

Never run — requires explicit human approval

CommandReason
destroy / apply -destroyIrreversibly destroys provisioned infrastructure
apply against a production var file/workspaceMutates live production infrastructure
state rm <resource>Removes a resource from state without destroying it — causes drift and orphaned resources
import <resource> <id>Binds existing infrastructure into state; mistakes can corrupt state
taint <resource> / untaint <resource>Forces recreation of a resource on the next apply
force-unlock <lock-id>Removes the state lock — risks concurrent, corrupting writes
workspace delete <name>Irreversible deletion of a workspace and its state

Rules

  • NEVER target a workspace or var file not listed in the configuration table above. If a command references an unfamiliar environment, stop and ask the user to confirm.
  • NEVER run terraform apply, terraform destroy, or any command in the "Never run" table above without explicit user instruction — a human must execute these, especially against production.
  • Always run terraform plan and show the output before ever suggesting an apply — never apply blind.
  • Always confirm the active workspace with terraform workspace show before running any command that reads or writes state, to avoid targeting the wrong environment.
  • NEVER print, display, or store the contents of .tfvars files or state files that may contain secrets — treat any sensitive = true output as a credential and do not display its value.
  • If state appears locked (Error: Error acquiring the state lock), do NOT run force-unlock — report this to the user and let them confirm no other operation is in progress.
  • Prefer -out=tfplan and terraform show -json tfplan when a plan must be inspected programmatically, so it can be re-applied exactly as reviewed.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

Reviews can't be read right now.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free