Terraform module and resource generation rules — blast radius, IAM least privilege, SOC 2 defaults.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Terraform Rules
## Module structure
Every Terraform module must have: `main.tf`, `variables.tf`, `outputs.tf`, `versions.tf`, `README.md`.
## Variable validation — always include
```hcl
variable "environment" {
type = string
validation {
condition = contains(["dev", "staging", "production"], var.environment)
error_message = "environment must be dev, staging, or production"
}
}
```
## Pipeline order — enforce all gates before plan
`terraform fmt -check` → `terraform validate` → `tflint` → `checkov`/`tfsec` → `plan`
## IAM — never generate wildcards
```hcl
# ❌ Never
statement {
actions = ["*"]
resources = ["*"]
}
# ✅ Always
statement {
actions = ["s3:GetObject", "s3:ListBucket"]
resources = ["arn:aws:s3:::my-bucket", "arn:aws:s3:::my-bucket/*"]
}
```
## Tagging — always enforce at provider level
```hcl
provider "aws" {
default_tags {
tags = { env = var.environment, team = var.team, managed-by = "terraform" }
}
}
```
## SOC 2 — never generate
- `publicly_accessible = true` on RDS, Redshift, OpenSearch
- `encrypted = false` on any storage (S3, EBS, RDS, DynamoDB, ElastiCache, EFS)
- `is_multi_region_trail = false` on CloudTrail
…
The line at the top of this page pins the label git:20260516.215750b, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
GET https://markdownregistry.com/api/v1/artifacts/art_nbnispmsjkqzi6uf
GET https://markdownregistry.com/api/v1/resolve?ref=nitinjain999/platform-skills/.cursor/rules/terraform.mdc
GET https://markdownregistry.com/api/v1/blob/330aa37ba5783e95d7b701124b62c5dc7c0686670e6b8d379942a39cbd5e4f72
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
nitinjain999/platform-skills · .github/skills/code-review/SKILL.md · Review pull requests to this repo (a Claude Code / Copilot / Cursor platform-engineering skill plugin) for technical…
nitinjain999/platform-skills · SKILL.md · Use when troubleshooting, implementing, reviewing, or auditing platform infrastructure as a system — where Kubernetes…
nitinjain999/platform-skills · plugins/platform-skills/skills/ai-governance/SKILL.md · Generate and enforce policy gates for AI coding agents (Copilot, Claude Code) — real-time session hooks that deny…
magnus919/agent-skills · terraform/SKILL.md · Operate Terraform and OpenTofu across the whole infrastructure lifecycle: module structure, state backends and locking…
nitinjain999/platform-skills · plugins/platform-skills/skills/terraform/SKILL.md · Runs through the full Terraform validation pipeline — fmt, validate, tflint, security scan — and reviews a module or…
nitinjain999/platform-skills · skills/terraform/SKILL.md · Runs through the full Terraform validation pipeline — fmt, validate, tflint, security scan — and reviews a module or…
iliaal/ai-skills · skills/terraform/SKILL.md · Terraform and OpenTofu configuration, modules, testing, state management, and HCL review. Use when working with…
iliaal/whetstone · distillery/generated-skills/terraform/SKILL.md · Terraform and OpenTofu configuration, modules, testing, state management, and HCL review. Use for "terraform module"…
jnpiyush/agentx · .github/skills/infrastructure/terraform/SKILL.md · Provision cloud infrastructure safely and consistently using Terraform and Infrastructure as Code patterns. Use when…
bendrucker/claude · plugins/terraform/skills/terraform/SKILL.md · Terraform Cloud workspace management, run monitoring, and log retrieval. Use when listing workspaces, checking run…
iuliandita/skills · skills/terraform/SKILL.md · Terraform and OpenTofu: HCL, modules, providers, state moves, imports, backends, drift, policy. Use for a plan that…
