tf-best-practices
Best-practice authoring guidance AND a read-only policy gate for AWS Terraform generated by a migration skill. Load during any phase that writes a terraform/ directory — first as the "what to emit" posture rules + security-baseline spec, then after writing as the deterministic policy verdict. Read-only: it reports whether the generated Terraform passes; it never edits .tf files, never touches .phase-status.json, and never decides phase completion. Complements (does not replace) terraform fmt/init/validate.
Pinned to revision 45aeba4e1cc0, so it is the text this page describes rather than whatever the author pushed since.
Files
- skills/tf-best-practices/SKILL.md
- skills/tf-best-practices/.gitignore
- skills/tf-best-practices/fixtures/terraform-policy/bad-db-sg-public-quoted-port/vpc.tf
- skills/tf-best-practices/fixtures/terraform-policy/bad-db-sg-public/vpc.tf
- skills/tf-best-practices/fixtures/terraform-policy/bad-elasticache-cluster-redis-unencrypted/cache.tf
- skills/tf-best-practices/fixtures/terraform-policy/bad-elasticache-unencrypted/cache.tf
- skills/tf-best-practices/fixtures/terraform-policy/bad-heroku-eb-elasticache/cache.tf
- skills/tf-best-practices/fixtures/terraform-policy/bad-http-forward/compute.tf
- skills/tf-best-practices/fixtures/terraform-policy/bad-rds-public-brace-in-comment/main.tf
- skills/tf-best-practices/fixtures/terraform-policy/bad-rds-public-closing-brace/main.tf
- skills/tf-best-practices/fixtures/terraform-policy/bad-rds-public-interpolated-brace/rds.tf
- skills/tf-best-practices/fixtures/terraform-policy/bad-rds-public-unencrypted/database.tf
- skills/tf-best-practices/fixtures/terraform-policy/bad-sg-public-ipv6/vpc.tf
- skills/tf-best-practices/fixtures/terraform-policy/bad-sg-public-ssh/vpc.tf
- skills/tf-best-practices/fixtures/terraform-policy/bad-wildcard-iam-listform/security.tf
- skills/tf-best-practices/fixtures/terraform-policy/bad-wildcard-iam/security.tf
- skills/tf-best-practices/fixtures/terraform-policy/good-db-sg-scoped/vpc.tf
- skills/tf-best-practices/fixtures/terraform-policy/good-elasticache-cluster-memcached/cache.tf
- skills/tf-best-practices/fixtures/terraform-policy/good-elasticache-cluster-redis-encrypted/cache.tf
- skills/tf-best-practices/fixtures/terraform-policy/good-elasticache-encrypted/cache.tf
- skills/tf-best-practices/fixtures/terraform-policy/good-heroku-eb-codepipeline/pipeline.tf
- skills/tf-best-practices/fixtures/terraform-policy/good-heroku-eb-loadbalanced/compute.tf
- skills/tf-best-practices/fixtures/terraform-policy/good-heroku-eb-loadbalanced/database.tf
- skills/tf-best-practices/fixtures/terraform-policy/good-heroku-eb-loadbalanced/security.tf
- skills/tf-best-practices/fixtures/terraform-policy/good-heroku-eb-only/compute.tf
- skills/tf-best-practices/fixtures/terraform-policy/good-heroku-eb-singleinstance/compute.tf
- skills/tf-best-practices/fixtures/terraform-policy/good-https-redirect/compute.tf
- skills/tf-best-practices/fixtures/terraform-policy/good-iam-scoped-list/security.tf
- skills/tf-best-practices/fixtures/terraform-policy/good-internet-nlb/compute.tf
- skills/tf-best-practices/fixtures/terraform-policy/good-quoted-port-https/compute.tf
- skills/tf-best-practices/fixtures/terraform-policy/good-rds-private-encrypted/database.tf
- skills/tf-best-practices/fixtures/terraform-policy/good-scoped-iam/security.tf
- skills/tf-best-practices/fixtures/terraform-policy/good-sg-ipv6-scoped/vpc.tf
- skills/tf-best-practices/fixtures/terraform-policy/good-sg-public-webapp/vpc.tf
- skills/tf-best-practices/fixtures/terraform-policy/internal-alb-only/compute.tf
- skills/tf-best-practices/references/security-posture-rules.md
- skills/tf-best-practices/references/terraform-validation.md
- skills/tf-best-practices/scripts/test_validate_terraform_policy.py
- skills/tf-best-practices/scripts/validate-terraform-policy.py
Every link opens the file at its source, pinned to the revision this page describes.