What problem does it solve? Terraform and OpenTofu changes fail in predictable but costly ways: resource addresses churn after refactors, secrets leak into state files, CI plans diverge from local plans, and targeted destroys cascade beyond intent. This Skill diagnoses the failure mode first, then applies version-aware fixes with explicit validation and rollback plans instead of generating untested HCL. ## Core Features & Use Cases - Diagnose-first routing: Maps symptoms to failure categories (identity churn, secret exposure, blast radius, CI drift, state corruption, testing blind spots) and loads only the matching reference depth. - Version-guarded code generation: Verifies the runtime floor before emitting features like moved blocks, write_only arguments, mock providers, or S3 native locking, with explicit pre-floor fallbacks. - Safe operations contract: Enforces reviewed plan artifacts before apply, plan -destroy before any destroy, and rollback notes for state-mutating changes. - Use Case: A team refactors subnets from count to for_each and resources start recreating. The Skill identifies identity churn, generates moved blocks for each address, and requires a plan showing zero destroy before apply. ## Quick Start Ask the assistant to review your Terraform module for state and security risks, for example: diagnose why my plan wants to recreate all subnets after I reordered the availability zones list and propose a safe fix.
