Official · HashiCorpFreePublished on GitHub

terraform-policy

Write, test, or convert Terraform Policy files (.policy.hcl, .policytest.hcl, Sentinel→tfpolicy). Triggers: policy.hcl, policytest, convert sentinel, tfpolicy, write a policy.

The English summary is being prepared. Showing the original description.

hashicorp/agent-skills

Works withTerraform

See how to install

Files included (55)

SKILL.md3.9 KB
.gitignore29 B
examples/conversion/cloudfront-associated-with-waf/cloudfront-associated-with-waf.policy.hcl589 B
examples/conversion/cloudfront-associated-with-waf/cloudfront-associated-with-waf.sentinel1.6 KB
examples/conversion/cloudfront-associated-with-waf/README.md871 B
examples/conversion/cloudtrail-server-side-encryption-enabled/cloudtrail-server-side-encryption-enabled.policy.hcl512 B
examples/conversion/cloudtrail-server-side-encryption-enabled/cloudtrail-server-side-encryption-enabled.sentinel1.4 KB
examples/conversion/cloudtrail-server-side-encryption-enabled/README.md846 B
examples/conversion/dms-endpoint-should-be-ssl-configured/dms-endpoint-should-be-ssl-configured.policy.hcl516 B
examples/conversion/dms-endpoint-should-be-ssl-configured/dms-endpoint-should-be-ssl-configured.sentinel1.5 KB
examples/conversion/dms-endpoint-should-be-ssl-configured/README.md872 B
examples/conversion/dms-endpoints-should-use-ssl/dms-endpoints-should-use-ssl.policy.hcl579 B
examples/conversion/dms-endpoints-should-use-ssl/dms-endpoints-should-use-ssl.sentinel1.4 KB
examples/conversion/dms-endpoints-should-use-ssl/README.md800 B
examples/conversion/ec2-network-acl-should-have-subnet-ids/ec2-network-acl-should-have-subnet-ids.policy.hcl1.0 KB
examples/conversion/ec2-network-acl-should-have-subnet-ids/ec2-network-acl-should-have-subnet-ids.sentinel2.9 KB
examples/conversion/ec2-network-acl-should-have-subnet-ids/README.md970 B
examples/conversion/ec2-vpc-default-security-group-no-traffic/ec2-vpc-default-security-group-no-traffic.policy.hcl865 B
examples/conversion/ec2-vpc-default-security-group-no-traffic/ec2-vpc-default-security-group-no-traffic.sentinel3.6 KB
examples/conversion/ec2-vpc-default-security-group-no-traffic/README.md1.1 KB
examples/conversion/efs-access-point-should-enforce-user-identity/efs-access-point-should-enforce-user-identity.policy.hcl448 B
examples/conversion/efs-access-point-should-enforce-user-identity/efs-access-point-should-enforce-user-identity.sentinel1.3 KB
examples/conversion/efs-access-point-should-enforce-user-identity/README.md727 B
examples/conversion/elasticache-redis-replication-group-encryption-at-transit-enabled/elasticache-redis-replication-group-encryption-at-transit-enabled.policy.hcl547 B
examples/conversion/elasticache-redis-replication-group-encryption-at-transit-enabled/elasticache-redis-replication-group-encryption-at-transit-enabled.sentinel1.5 KB
examples/conversion/elasticache-redis-replication-group-encryption-at-transit-enabled/README.md777 B
examples/conversion/elasticsearch-encrypted-at-rest/elasticsearch-encrypted-at-rest.policy.hcl584 B
examples/conversion/elasticsearch-encrypted-at-rest/elasticsearch-encrypted-at-rest.sentinel1.5 KB
examples/conversion/elasticsearch-encrypted-at-rest/README.md734 B
examples/conversion/elasticsearch-https-required/elasticsearch-https-required.policy.hcl1.1 KB
examples/conversion/elasticsearch-https-required/elasticsearch-https-required.sentinel2.3 KB
examples/conversion/elasticsearch-https-required/README.md904 B
examples/conversion/elasticsearch-in-vpc-only/elasticsearch-in-vpc-only.policy.hcl589 B
examples/conversion/elasticsearch-in-vpc-only/elasticsearch-in-vpc-only.sentinel1.9 KB
examples/conversion/elasticsearch-in-vpc-only/README.md890 B
examples/conversion/eventbridge-custom-event-bus-should-have-attached-policy/eventbridge-custom-event-bus-should-have-attached-policy.policy.hcl845 B
examples/conversion/eventbridge-custom-event-bus-should-have-attached-policy/eventbridge-custom-event-bus-should-have-attached-policy.sentinel2.1 KB
examples/conversion/eventbridge-custom-event-bus-should-have-attached-policy/README.md1.1 KB
examples/conversion/s3-block-public-access-bucket-level/README.md1.1 KB
examples/conversion/s3-block-public-access-bucket-level/s3-block-public-access-bucket-level.policy.hcl1.2 KB
examples/conversion/s3-block-public-access-bucket-level/s3-block-public-access-bucket-level.sentinel3.2 KB
examples/conversion/s3-bucket-should-have-object-lock-enabled/README.md975 B
examples/conversion/s3-bucket-should-have-object-lock-enabled/s3-bucket-should-have-object-lock-enabled.policy.hcl1.0 KB
examples/conversion/s3-bucket-should-have-object-lock-enabled/s3-bucket-should-have-object-lock-enabled.sentinel2.8 KB
examples/conversion/secretsmanager-auto-rotation-enabled-check/README.md955 B
examples/conversion/secretsmanager-auto-rotation-enabled-check/secretsmanager-auto-rotation-enabled-check.policy.hcl867 B
examples/conversion/secretsmanager-auto-rotation-enabled-check/secretsmanager-auto-rotation-enabled-check.sentinel2.2 KB
examples/conversion/step-functions-state-machine-logging-enabled/README.md778 B
examples/conversion/step-functions-state-machine-logging-enabled/step-functions-state-machine-logging-enabled.policy.hcl724 B
examples/conversion/step-functions-state-machine-logging-enabled/step-functions-state-machine-logging-enabled.sentinel1.6 KB
examples/README.md2.5 KB
README.md2.8 KB
references/tfpolicy-author.md97.6 KB
references/tfpolicy-test.md45.1 KB
references/verified-syntax.md100.0 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

terraform-policy

UTILITY SKILL — INVOKES: tfpolicy-author | tfpolicy-test

USE FOR:

Writing a new .policy.hcl policy from a description or requirement
Converting a .sentinel policy to Terraform Policy
Writing or debugging a .policytest.hcl test file
Migrating a Sentinel policy library to Terraform Policy

Before giving authoring or testing instructions, check the installed tfpolicy CLI version and tailor guidance accordingly. This skill maintains guidance for the two most recent minor lines, 0.2.x and 0.3.x; when a new minor ships, drop the oldest line and add the new one.

If the CLI is 0.2.x (baseline), include a top-level policy { required_providers { ... } } block when authoring .policy.hcl files containing resource or provider policies. It is mandatory for tfpolicy validate; version-range validation is best effort, and wildcard targets such as resource_policy "*" are not schema-validated. tfpolicy test does not preflight mocked attrs/prior_attrs against provider schemas, core::alltrue/core::anytrue do not exist, and, only in this 0.2.x line, mock resource {} blocks may omit attrs/prior_attrs entirely.
If the CLI is 0.3.x or newer, the other guidance above still applies, but the 0.2.x allowance for omitting resource state does not: every mock resource {} block in .policytest.hcl files must declare attrs or prior_attrs; if both evaluate to empty, the test case is skipped (provider {} and module {} mocks are unaffected) (see tfpolicy-test). tfpolicy test reuses the target .policy.hcl's existing top-level policy { required_providers { ... } } block (there is no separate .policytest.hcl-level declaration) to validate provider, resource, and data-source policies and core::getdatasource()/core::getresources() arguments against resolved provider schemas before any test runs, failing the whole run on a schema mismatch (see tfpolicy-test). core::alltrue(list) and core::anytrue(list) are also available — prefer them over the core::length() list-comprehension workaround (see tfpolicy-author). meta.tfe_stack and meta.tfe_workspace.tags are available to resource, provider, and module policies; Stack fields are empty outside Stack evaluations.
If the CLI version is unknown, ask the user to check it first or provide guidance that clearly distinguishes the 0.2.x and 0.3.x paths.

DO NOT USE FOR:

Writing .tftest.hcl files for Terraform modules — use terraform-test
General Terraform HCL authoring — use terraform-style-guide

Routing

Task	Sub-skill
Write or convert a `.policy.hcl` policy	tfpolicy-author
Write or debug a `.policytest.hcl` test	tfpolicy-test

Examples

"Block EC2 instances without encryption" → tfpolicy-author
"Convert this Sentinel policy to tfpolicy" → tfpolicy-author
"Write a policytest for my EBS policy" → tfpolicy-test

Troubleshooting

Wrong skill triggered? Load the sub-skill directly from the routing table above.

npx skills add hashicorp/agent-skills/terraform/terraform-policy/skills/tfpolicy-author
npx skills add hashicorp/agent-skills/terraform/terraform-policy/skills/tfpolicy-test

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

More skills from this repository

aws-ami-builder

Official · HashiCorpFree

Build Amazon Machine Images (AMIs) with Packer using the amazon-ebs builder. Use when creating custom AMIs for EC2 instances.

The English summary is being prepared. Showing the original description.

hashicorp/agent-skills903Updated Oct 5, 2026

azure-image-builder

Official · HashiCorpFree

Build Azure managed images and Azure Compute Gallery images with Packer. Use when creating custom images for Azure VMs.

The English summary is being prepared. Showing the original description.

hashicorp/agent-skills903Updated Oct 5, 2026

azure-verified-modules

Official · HashiCorpFree

Azure Verified Modules (AVM) requirements and best practices for developing certified Azure Terraform modules. Use when creating or reviewing Azure modules that need AVM certification.

The English summary is being prepared. Showing the original description.

hashicorp/agent-skills903Updated Oct 5, 2026

new-terraform-provider

Official · HashiCorpFree

Use this when scaffolding a new Terraform provider with the Plugin Framework: workspace layout, go module setup, provider server main.go, and a provider.go with schema and Configure. Also use when a user wants to start building a provider for a new API or asks how to begin a terraform-provider-* project.

The English summary is being prepared. Showing the original description.

hashicorp/agent-skills903Updated Oct 5, 2026

provider-actions

Official · HashiCorpFree

Implement Terraform Provider actions using the Plugin Framework. Use when developing imperative operations that execute at lifecycle events (before/after create, update, destroy).

The English summary is being prepared. Showing the original description.

hashicorp/agent-skills903Updated Oct 5, 2026

provider-configuration

Official · HashiCorpFree

Implement Terraform provider configuration and authentication with the Plugin Framework: provider schema for credentials (Optional + Sensitive attributes), environment variable fallbacks, credential provider chains (static config, then environment variables, shared credentials file, and platform identity), unknown-value guards in Configure(), secret redaction, configure-time credential validation, and diagnostics that name every source tried. Use when implementing or reviewing a provider's Configure method or provider schema, adding authentication options (API keys, tokens, profiles, credentials files, assume-role), deciding how a provider should resolve credentials, debugging "no valid credential sources" or missing-credentials errors, or unit testing credential resolution.

The English summary is being prepared. Showing the original description.

hashicorp/agent-skills903Updated Oct 5, 2026

See all skills by hashicorp

Report a problem with this skill

Install

Install with a command

npx skills add https://github.com/hashicorp/agent-skills --skill terraform-policy

Paste it into your terminal and run it (requires Node.js). You can choose which agents to install it for, such as Claude Code or Codex.

Ask your agent

Please install the following Agent Skill.
https://github.com/hashicorp/agent-skills/tree/main/plugins/terraform/skills/terraform-policy

First review SKILL.md and the bundled files and confirm there is nothing suspicious (such as sending data externally or reading credentials). Then place it in ~/.claude/skills/terraform-policy/ for Claude Code, or ~/.agents/skills/terraform-policy/ for Codex.

Send this text to Claude Code or Codex as is. It checks the contents before installing.

View source on GitHub

Repository: hashicorp/agent-skills
Stars: 903
Forks: 132
Category: DevOps
License: MPL-2.0
Original language: English
Last updated: Oct 5, 2026

A skill is a set of instructions and scripts for an agent. cccskills does not guarantee that skills are safe. Review the contents before you install.