terraform-policy

Write, test, or convert Terraform Policy files (.policy.hcl, .policytest.hcl, Sentinel→tfpolicy). Triggers: policy.hcl, policytest, convert sentinel, tfpolicy, write a policy.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

hashicorp/agent-skills

연동 도구Terraform

설치 방법 보기

포함된 파일(55)

SKILL.md3.9 KB
.gitignore29 B
examples/conversion/cloudfront-associated-with-waf/cloudfront-associated-with-waf.policy.hcl589 B
examples/conversion/cloudfront-associated-with-waf/cloudfront-associated-with-waf.sentinel1.6 KB
examples/conversion/cloudfront-associated-with-waf/README.md871 B
examples/conversion/cloudtrail-server-side-encryption-enabled/cloudtrail-server-side-encryption-enabled.policy.hcl512 B
examples/conversion/cloudtrail-server-side-encryption-enabled/cloudtrail-server-side-encryption-enabled.sentinel1.4 KB
examples/conversion/cloudtrail-server-side-encryption-enabled/README.md846 B
examples/conversion/dms-endpoint-should-be-ssl-configured/dms-endpoint-should-be-ssl-configured.policy.hcl516 B
examples/conversion/dms-endpoint-should-be-ssl-configured/dms-endpoint-should-be-ssl-configured.sentinel1.5 KB
examples/conversion/dms-endpoint-should-be-ssl-configured/README.md872 B
examples/conversion/dms-endpoints-should-use-ssl/dms-endpoints-should-use-ssl.policy.hcl579 B
examples/conversion/dms-endpoints-should-use-ssl/dms-endpoints-should-use-ssl.sentinel1.4 KB
examples/conversion/dms-endpoints-should-use-ssl/README.md800 B
examples/conversion/ec2-network-acl-should-have-subnet-ids/ec2-network-acl-should-have-subnet-ids.policy.hcl1.0 KB
examples/conversion/ec2-network-acl-should-have-subnet-ids/ec2-network-acl-should-have-subnet-ids.sentinel2.9 KB
examples/conversion/ec2-network-acl-should-have-subnet-ids/README.md970 B
examples/conversion/ec2-vpc-default-security-group-no-traffic/ec2-vpc-default-security-group-no-traffic.policy.hcl865 B
examples/conversion/ec2-vpc-default-security-group-no-traffic/ec2-vpc-default-security-group-no-traffic.sentinel3.6 KB
examples/conversion/ec2-vpc-default-security-group-no-traffic/README.md1.1 KB
examples/conversion/efs-access-point-should-enforce-user-identity/efs-access-point-should-enforce-user-identity.policy.hcl448 B
examples/conversion/efs-access-point-should-enforce-user-identity/efs-access-point-should-enforce-user-identity.sentinel1.3 KB
examples/conversion/efs-access-point-should-enforce-user-identity/README.md727 B
examples/conversion/elasticache-redis-replication-group-encryption-at-transit-enabled/elasticache-redis-replication-group-encryption-at-transit-enabled.policy.hcl547 B
examples/conversion/elasticache-redis-replication-group-encryption-at-transit-enabled/elasticache-redis-replication-group-encryption-at-transit-enabled.sentinel1.5 KB
examples/conversion/elasticache-redis-replication-group-encryption-at-transit-enabled/README.md777 B
examples/conversion/elasticsearch-encrypted-at-rest/elasticsearch-encrypted-at-rest.policy.hcl584 B
examples/conversion/elasticsearch-encrypted-at-rest/elasticsearch-encrypted-at-rest.sentinel1.5 KB
examples/conversion/elasticsearch-encrypted-at-rest/README.md734 B
examples/conversion/elasticsearch-https-required/elasticsearch-https-required.policy.hcl1.1 KB
examples/conversion/elasticsearch-https-required/elasticsearch-https-required.sentinel2.3 KB
examples/conversion/elasticsearch-https-required/README.md904 B
examples/conversion/elasticsearch-in-vpc-only/elasticsearch-in-vpc-only.policy.hcl589 B
examples/conversion/elasticsearch-in-vpc-only/elasticsearch-in-vpc-only.sentinel1.9 KB
examples/conversion/elasticsearch-in-vpc-only/README.md890 B
examples/conversion/eventbridge-custom-event-bus-should-have-attached-policy/eventbridge-custom-event-bus-should-have-attached-policy.policy.hcl845 B
examples/conversion/eventbridge-custom-event-bus-should-have-attached-policy/eventbridge-custom-event-bus-should-have-attached-policy.sentinel2.1 KB
examples/conversion/eventbridge-custom-event-bus-should-have-attached-policy/README.md1.1 KB
examples/conversion/s3-block-public-access-bucket-level/README.md1.1 KB
examples/conversion/s3-block-public-access-bucket-level/s3-block-public-access-bucket-level.policy.hcl1.2 KB
examples/conversion/s3-block-public-access-bucket-level/s3-block-public-access-bucket-level.sentinel3.2 KB
examples/conversion/s3-bucket-should-have-object-lock-enabled/README.md975 B
examples/conversion/s3-bucket-should-have-object-lock-enabled/s3-bucket-should-have-object-lock-enabled.policy.hcl1.0 KB
examples/conversion/s3-bucket-should-have-object-lock-enabled/s3-bucket-should-have-object-lock-enabled.sentinel2.8 KB
examples/conversion/secretsmanager-auto-rotation-enabled-check/README.md955 B
examples/conversion/secretsmanager-auto-rotation-enabled-check/secretsmanager-auto-rotation-enabled-check.policy.hcl867 B
examples/conversion/secretsmanager-auto-rotation-enabled-check/secretsmanager-auto-rotation-enabled-check.sentinel2.2 KB
examples/conversion/step-functions-state-machine-logging-enabled/README.md778 B
examples/conversion/step-functions-state-machine-logging-enabled/step-functions-state-machine-logging-enabled.policy.hcl724 B
examples/conversion/step-functions-state-machine-logging-enabled/step-functions-state-machine-logging-enabled.sentinel1.6 KB
examples/README.md2.5 KB
README.md2.8 KB
references/tfpolicy-author.md97.6 KB
references/tfpolicy-test.md45.1 KB
references/verified-syntax.md100.0 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

terraform-policy

UTILITY SKILL — INVOKES: tfpolicy-author | tfpolicy-test

USE FOR:

Writing a new .policy.hcl policy from a description or requirement
Converting a .sentinel policy to Terraform Policy
Writing or debugging a .policytest.hcl test file
Migrating a Sentinel policy library to Terraform Policy

Before giving authoring or testing instructions, check the installed tfpolicy CLI version and tailor guidance accordingly. This skill maintains guidance for the two most recent minor lines, 0.2.x and 0.3.x; when a new minor ships, drop the oldest line and add the new one.

If the CLI is 0.2.x (baseline), include a top-level policy { required_providers { ... } } block when authoring .policy.hcl files containing resource or provider policies. It is mandatory for tfpolicy validate; version-range validation is best effort, and wildcard targets such as resource_policy "*" are not schema-validated. tfpolicy test does not preflight mocked attrs/prior_attrs against provider schemas, core::alltrue/core::anytrue do not exist, and, only in this 0.2.x line, mock resource {} blocks may omit attrs/prior_attrs entirely.
If the CLI is 0.3.x or newer, the other guidance above still applies, but the 0.2.x allowance for omitting resource state does not: every mock resource {} block in .policytest.hcl files must declare attrs or prior_attrs; if both evaluate to empty, the test case is skipped (provider {} and module {} mocks are unaffected) (see tfpolicy-test). tfpolicy test reuses the target .policy.hcl's existing top-level policy { required_providers { ... } } block (there is no separate .policytest.hcl-level declaration) to validate provider, resource, and data-source policies and core::getdatasource()/core::getresources() arguments against resolved provider schemas before any test runs, failing the whole run on a schema mismatch (see tfpolicy-test). core::alltrue(list) and core::anytrue(list) are also available — prefer them over the core::length() list-comprehension workaround (see tfpolicy-author). meta.tfe_stack and meta.tfe_workspace.tags are available to resource, provider, and module policies; Stack fields are empty outside Stack evaluations.
If the CLI version is unknown, ask the user to check it first or provide guidance that clearly distinguishes the 0.2.x and 0.3.x paths.

DO NOT USE FOR:

Writing .tftest.hcl files for Terraform modules — use terraform-test
General Terraform HCL authoring — use terraform-style-guide

Routing

Task	Sub-skill
Write or convert a `.policy.hcl` policy	tfpolicy-author
Write or debug a `.policytest.hcl` test	tfpolicy-test

Examples

"Block EC2 instances without encryption" → tfpolicy-author
"Convert this Sentinel policy to tfpolicy" → tfpolicy-author
"Write a policytest for my EBS policy" → tfpolicy-test

Troubleshooting

Wrong skill triggered? Load the sub-skill directly from the routing table above.

npx skills add hashicorp/agent-skills/terraform/terraform-policy/skills/tfpolicy-author
npx skills add hashicorp/agent-skills/terraform/terraform-policy/skills/tfpolicy-test

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

같은 저장소의 스킬

aws-ami-builder

HashiCorp 공식무료

Build Amazon Machine Images (AMIs) with Packer using the amazon-ebs builder. Use when creating custom AMIs for EC2 instances.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

hashicorp/agent-skills9032026년 10월 5일 업데이트

azure-image-builder

HashiCorp 공식무료

Build Azure managed images and Azure Compute Gallery images with Packer. Use when creating custom images for Azure VMs.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

hashicorp/agent-skills9032026년 10월 5일 업데이트

azure-verified-modules

HashiCorp 공식무료

Azure Verified Modules (AVM) requirements and best practices for developing certified Azure Terraform modules. Use when creating or reviewing Azure modules that need AVM certification.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

hashicorp/agent-skills9032026년 10월 5일 업데이트

new-terraform-provider

HashiCorp 공식무료

Use this when scaffolding a new Terraform provider with the Plugin Framework: workspace layout, go module setup, provider server main.go, and a provider.go with schema and Configure. Also use when a user wants to start building a provider for a new API or asks how to begin a terraform-provider-* project.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

hashicorp/agent-skills9032026년 10월 5일 업데이트

provider-actions

HashiCorp 공식무료

Implement Terraform Provider actions using the Plugin Framework. Use when developing imperative operations that execute at lifecycle events (before/after create, update, destroy).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

hashicorp/agent-skills9032026년 10월 5일 업데이트

provider-configuration

HashiCorp 공식무료

Implement Terraform provider configuration and authentication with the Plugin Framework: provider schema for credentials (Optional + Sensitive attributes), environment variable fallbacks, credential provider chains (static config, then environment variables, shared credentials file, and platform identity), unknown-value guards in Configure(), secret redaction, configure-time credential validation, and diagnostics that name every source tried. Use when implementing or reviewing a provider's Configure method or provider schema, adding authentication options (API keys, tokens, profiles, credentials files, assume-role), deciding how a provider should resolve credentials, debugging "no valid credential sources" or missing-credentials errors, or unit testing credential resolution.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

hashicorp/agent-skills9032026년 10월 5일 업데이트

hashicorp의 스킬 모두 보기

이 스킬의 문제 신고

설치

명령으로 설치

npx skills add https://github.com/hashicorp/agent-skills --skill terraform-policy

터미널에 붙여 넣고 실행합니다(Node.js 필요). Claude Code, Codex 등 설치할 에이전트를 고를 수 있습니다.

에이전트에게 부탁하기

다음 Agent Skill을 설치해 주세요.
https://github.com/hashicorp/agent-skills/tree/main/plugins/terraform/skills/terraform-policy

먼저 SKILL.md와 첨부 파일의 내용을 확인해 수상한 처리(외부 전송, 인증 정보 읽기 등)가 없는지 확인한 뒤 Claude Code는 ~/.claude/skills/terraform-policy/, Codex는 ~/.agents/skills/terraform-policy/ 에 배치해 주세요.

이 문장을 그대로 Claude Code나 Codex에 보내면 내용을 확인한 뒤 설치해 줍니다.

GitHub에서 소스 보기

저장소: hashicorp/agent-skills
스타: 903
포크: 132
카테고리: 인프라·DevOps
라이선스: MPL-2.0
원문 언어: 영어
최종 업데이트: 2026년 10월 5일

스킬은 에이전트를 위한 지시와 스크립트의 묶음입니다. cccskills는 내용의 안전성을 보증하지 않습니다. 설치하기 전에 내용을 확인하세요.