Terraform Patterns

Predictable infrastructure. Secure state. Modules that compose. No drift.

Opinionated Terraform workflow that turns sprawling HCL into well-structured, secure, production-grade infrastructure code. Covers module design, state management, provider patterns, security hardening, and CI/CD integration.

Not a Terraform tutorial — a set of concrete decisions about how to write infrastructure code that doesn't break at 3 AM.

---

Slash Commands

Command	What it does
INLINECODE0	Analyze Terraform code for anti-patterns, security issues, and structure problems
INLINECODE1

Design or refactor a Terraform module with proper inputs, outputs, and composition |
| /terraform:security | Audit Terraform code for security vulnerabilities, secrets exposure, and IAM misconfigurations |

---

When This Skill Activates

Recognize these patterns from the user:

• - "Review this Terraform code"
• "Design a Terraform module for..."
• "My Terraform state is..."
• "Set up remote state backend"
• "Multi-region Terraform deployment"
• "Terraform security review"
• "Module structure best practices"
• "Terraform CI/CD pipeline"
• Any request involving: .tf files, HCL, Terraform modules, state management, provider configuration, infrastructure-as-code

If the user has .tf files or wants to provision infrastructure with Terraform → this skill applies.

---

Workflow

/terraform:review — Terraform Code Review

1. 1. Analyze current state

- Read all .tf files in the target directory - Identify module structure (flat vs nested) - Count resources, data sources, variables, outputs - Check naming conventions

1. 2. Apply review checklist

CODEBLOCK0

1. 3. Generate report

CODEBLOCK1

1. 4. Run security scan

CODEBLOCK2

/terraform:module — Module Design

1. 1. Identify module scope

- Single responsibility: one module = one logical grouping - Determine inputs (variables), outputs, and resource boundaries - Decide: flat module (single directory) vs nested (calling child modules)

1. 2. Apply module design checklist

CODEBLOCK3

1. 3. Generate module scaffold

- Output file structure with boilerplate - Include variable validation blocks - Add lifecycle rules where appropriate

/terraform:security — Security Audit

1. 1. Code-level audit

| Check | Severity | Fix |
|-------|----------|-----|
| Hardcoded secrets in .tf files | Critical | Use variables with sensitive = true or vault |
| IAM policy with * actions | Critical | Scope to specific actions and resources |
| Security group with 0.0.0.0/0 on port 22/3389 | Critical | Restrict to known CIDR blocks or use SSM/bastion |
| S3 bucket without encryption | High | Add server_side_encryption_configuration block |
| S3 bucket with public access | High | Add aws_s3_bucket_public_access_block |
| RDS without encryption | High | Set storage_encrypted = true |
| RDS publicly accessible | High | Set publicly_accessible = false |
| CloudTrail not enabled | Medium | Add aws_cloudtrail resource |
| Missing prevent_destroy on stateful resources | Medium | Add lifecycle { prevent_destroy = true } |
| Variables without sensitive = true for secrets | Medium | Add sensitive = true to secret variables |

1. 2. State security audit

| Check | Severity | Fix |
|-------|----------|-----|
| Local state file | Critical | Migrate to remote backend with encryption |
| Remote state without encryption | High | Enable encryption on backend (SSE-S3, KMS) |
| No state locking | High | Enable DynamoDB for S3, native for TF Cloud |
| State accessible to all team members | Medium | Restrict via IAM policies or TF Cloud teams |

1. 3. Generate security report

   python3 scripts/tf_security_scanner.py ./terraform
   python3 scripts/tf_security_scanner.py ./terraform --output json
   

---

Tooling

scripts/tf_module_analyzer.py

CLI utility for analyzing Terraform directory structure and module quality.

Features:

• - Resource and data source counting
• Variable and output analysis (missing descriptions, types, validation)
• Naming convention checks
• Module composition detection
• File structure validation
• JSON and text output

Usage:
CODEBLOCK5

scripts/tf_security_scanner.py

CLI utility for scanning .tf files for common security issues.

Features:

• - Hardcoded secret detection (AWS keys, passwords, tokens)
• Overly permissive IAM policy detection
• Open security group detection (0.0.0.0/0 on sensitive ports)
• Missing encryption checks (S3, RDS, EBS)
• Public access detection (S3, RDS, EC2)
• Sensitive variable audit
• JSON and text output

Usage:

# Scan a Terraform directory
python3 scripts/tf_security_scanner.py ./terraform

# JSON output
python3 scripts/tf_security_scanner.py ./terraform --output json

# Strict mode (elevate warnings)
python3 scripts/tf_security_scanner.py ./terraform --strict

---

Module Design Patterns

Pattern 1: Flat Module (Small/Medium Projects)

CODEBLOCK7

Best for: Single application, < 20 resources, one team owns everything.

Pattern 2: Nested Modules (Medium/Large Projects)

CODEBLOCK8

Best for: Multiple environments, shared infrastructure patterns, team collaboration.

Pattern 3: Mono-Repo with Terragrunt

CODEBLOCK9

Best for: Large-scale, many environments, DRY configuration, team-level isolation.

---

Provider Configuration Patterns

Version Pinning

CODEBLOCK10

Multi-Region with Aliases

CODEBLOCK11

Multi-Account with Assume Role

provider "aws" {
  alias  = "production"
  region = "us-east-1"

  assume_role {
    role_arn = "arn:aws:iam::PROD_ACCOUNT_ID:role/TerraformRole"
  }
}

---

State Management Decision Tree

CODEBLOCK13

---

CI/CD Integration Patterns

GitHub Actions Plan/Apply

CODEBLOCK14

Drift Detection

CODEBLOCK15

---

Proactive Triggers

Flag these without being asked:

• - No remote backend configured → Migrate to S3/GCS/Azure Blob with locking and encryption.
• Provider without version constraint → Add version = "~> X.0" to prevent breaking upgrades.
• Hardcoded secrets in .tf files → Use variables with sensitive = true, or integrate Vault/SSM.
• IAM policy with "Action": "*" → Scope to specific actions. No wildcard actions in production.
• Security group open to 0.0.0.0/0 on SSH/RDP → Restrict to bastion CIDR or use SSM Session Manager.
• No state locking → Enable DynamoDB table for S3 backend, or use TF Cloud.
• Resources without tags → Add default_tags in provider block. Tags are mandatory for cost tracking.
• Missing prevent_destroy on databases/storage → Add lifecycle block to prevent accidental deletion.

---

Installation

One-liner (any tool)

CODEBLOCK16

Multi-tool install

CODEBLOCK17

OpenClaw

clawhub install terraform-patterns

---

Related Skills

• - senior-devops — Broader DevOps scope (CI/CD, monitoring, containerization). Complementary — use terraform-patterns for IaC-specific work, senior-devops for pipeline and infrastructure operations.
• aws-solution-architect — AWS architecture design. Complementary — terraform-patterns implements the infrastructure, aws-solution-architect designs it.
• senior-security — Application security. Complementary — terraform-patterns covers infrastructure security posture, senior-security covers application-level threats.
• ci-cd-pipeline-builder — Pipeline construction. Complementary — terraform-patterns defines infrastructure, ci-cd-pipeline-builder automates deployment.