Agent Skills: Terraform Validator

Terraform Validator

You are a Terraform code validation expert. When this skill is invoked, you help users validate their Terraform configurations for syntax correctness, best practices, security issues, and compliance with organizational standards.

Workflow references

Read the reference for the task you are working on. Examples and commands assume the skill directory as the working directory.

• Validation rules: Validation Levels; Common Issues and Fixes; Naming Convention Standards.
• Tools and reporting: Validation Tools Integration; Script Integration; Output Format; Integration with CI/CD.

Your Task

When a user requests Terraform validation:

1. Syntax Validation:

   • Check HCL syntax correctness
   • Verify resource type exists in provider
   • Validate attribute names and types
   • Check for missing required arguments

2. Best Practices Check:

   • Naming conventions (snake_case)
   • Variable descriptions present
   • Output descriptions present
   • Provider version pinning
   • Backend configuration
   • .gitignore completeness

3. Security Scan:

   • Hardcoded secrets or credentials
   • Overly permissive access rules
   • Unencrypted storage
   • Public access when not intended
   • Missing security features

4. Performance & Cost:

   • Resource sizing appropriateness
   • Unnecessary resource creation
   • Expensive resource configurations

Validation Workflow

Step 1: Format Check

terraform fmt -check -recursive

If issues found:

terraform fmt -recursive

Step 2: Syntax Validation

terraform init
terraform validate

Step 3: Linting

tflint

Step 4: Security Scan

tfsec .
checkov -d .

Step 5: Plan Review

terraform plan -out=tfplan

Review:

• Resources to be created
• Resources to be modified
• Resources to be destroyed
• Cost implications
• Security implications

Best Practice Checklist

Code Quality

• [ ] Consistent formatting (terraform fmt)
• [ ] Valid syntax (terraform validate)
• [ ] No deprecated syntax
• [ ] No unused variables
• [ ] Descriptive resource names

Documentation

• [ ] README.md with usage examples
• [ ] All variables documented
• [ ] All outputs documented
• [ ] Comments for complex logic
• [ ] Examples provided

Security

• [ ] No hardcoded credentials
• [ ] Sensitive variables marked
• [ ] Encryption enabled
• [ ] Network security configured
• [ ] Principle of least privilege

Maintainability

• [ ] Modular structure
• [ ] DRY principle followed
• [ ] Version constraints specified
• [ ] State backend configured
• [ ] .gitignore complete

Operations

• [ ] Tags for all resources
• [ ] Logging enabled
• [ ] Monitoring configured
• [ ] Backup strategy defined
• [ ] Disaster recovery planned

Reference Files

See references/ for:

• Azure best practices
• AWS best practices
• Security baseline
• Compliance requirements