terraform-aws

Four skills covering the parts of Terraform-on-AWS practice that are judgement rather than syntax.

Module layout, variable and output conventions, state backend configuration and locking, and why terraform apply from a laptop against shared state is the thing to design out rather than the thing to be careful about.

Least-privilege role design, assume-role chains, permission boundaries, and OIDC federation from CI in place of long-lived access keys. A stored cloud key in a CI variable is a credential with no expiry that anyone who can run a job can read.

Database migrations as a deploy step: backward-compatible schema change, the expand-contract pattern, and why a migration that cannot be rolled back forces a forward fix under incident conditions — which is the worst time to be writing one.

The review skill deliberately covers only what the deterministic stage cannot decide. code-review-core already ships a Terraform detector running fmt, tflint, checkov and tfsec, and a dependency detector that flags unpinned providers. This adds the questions a linter has no view on: the blast radius of a change, whether a resource replacement is destructive, and whether state will be orphaned.

Every account id, bucket name, role ARN and runner tag in it is a placeholder.