本文へ移動
cccskills
無料GitHub で公開

terraform-policy

Write, test, or convert Terraform Policy files (.policy.hcl, .policytest.hcl, Sentinel→tfpolicy). Triggers: policy.hcl, policytest, convert sentinel, tfpolicy, write a policy.

hashicorp/agent-skills
インストール方法を見る

含まれるファイル（55）

  • SKILL.md3.9 KB
  • .gitignore29 B
  • examples/conversion/cloudfront-associated-with-waf/cloudfront-associated-with-waf.policy.hcl589 B
  • examples/conversion/cloudfront-associated-with-waf/cloudfront-associated-with-waf.sentinel1.6 KB
  • examples/conversion/cloudfront-associated-with-waf/README.md871 B
  • examples/conversion/cloudtrail-server-side-encryption-enabled/cloudtrail-server-side-encryption-enabled.policy.hcl512 B
  • examples/conversion/cloudtrail-server-side-encryption-enabled/cloudtrail-server-side-encryption-enabled.sentinel1.4 KB
  • examples/conversion/cloudtrail-server-side-encryption-enabled/README.md846 B
  • examples/conversion/dms-endpoint-should-be-ssl-configured/dms-endpoint-should-be-ssl-configured.policy.hcl516 B
  • examples/conversion/dms-endpoint-should-be-ssl-configured/dms-endpoint-should-be-ssl-configured.sentinel1.5 KB
  • examples/conversion/dms-endpoint-should-be-ssl-configured/README.md872 B
  • examples/conversion/dms-endpoints-should-use-ssl/dms-endpoints-should-use-ssl.policy.hcl579 B
  • examples/conversion/dms-endpoints-should-use-ssl/dms-endpoints-should-use-ssl.sentinel1.4 KB
  • examples/conversion/dms-endpoints-should-use-ssl/README.md800 B
  • examples/conversion/ec2-network-acl-should-have-subnet-ids/ec2-network-acl-should-have-subnet-ids.policy.hcl1.0 KB
  • examples/conversion/ec2-network-acl-should-have-subnet-ids/ec2-network-acl-should-have-subnet-ids.sentinel2.9 KB
  • examples/conversion/ec2-network-acl-should-have-subnet-ids/README.md970 B
  • examples/conversion/ec2-vpc-default-security-group-no-traffic/ec2-vpc-default-security-group-no-traffic.policy.hcl865 B
  • examples/conversion/ec2-vpc-default-security-group-no-traffic/ec2-vpc-default-security-group-no-traffic.sentinel3.6 KB
  • examples/conversion/ec2-vpc-default-security-group-no-traffic/README.md1.1 KB
  • examples/conversion/efs-access-point-should-enforce-user-identity/efs-access-point-should-enforce-user-identity.policy.hcl448 B
  • examples/conversion/efs-access-point-should-enforce-user-identity/efs-access-point-should-enforce-user-identity.sentinel1.3 KB
  • examples/conversion/efs-access-point-should-enforce-user-identity/README.md727 B
  • examples/conversion/elasticache-redis-replication-group-encryption-at-transit-enabled/elasticache-redis-replication-group-encryption-at-transit-enabled.policy.hcl547 B
  • examples/conversion/elasticache-redis-replication-group-encryption-at-transit-enabled/elasticache-redis-replication-group-encryption-at-transit-enabled.sentinel1.5 KB
  • examples/conversion/elasticache-redis-replication-group-encryption-at-transit-enabled/README.md777 B
  • examples/conversion/elasticsearch-encrypted-at-rest/elasticsearch-encrypted-at-rest.policy.hcl584 B
  • examples/conversion/elasticsearch-encrypted-at-rest/elasticsearch-encrypted-at-rest.sentinel1.5 KB
  • examples/conversion/elasticsearch-encrypted-at-rest/README.md734 B
  • examples/conversion/elasticsearch-https-required/elasticsearch-https-required.policy.hcl1.1 KB
  • examples/conversion/elasticsearch-https-required/elasticsearch-https-required.sentinel2.3 KB
  • examples/conversion/elasticsearch-https-required/README.md904 B
  • examples/conversion/elasticsearch-in-vpc-only/elasticsearch-in-vpc-only.policy.hcl589 B
  • examples/conversion/elasticsearch-in-vpc-only/elasticsearch-in-vpc-only.sentinel1.9 KB
  • examples/conversion/elasticsearch-in-vpc-only/README.md890 B
  • examples/conversion/eventbridge-custom-event-bus-should-have-attached-policy/eventbridge-custom-event-bus-should-have-attached-policy.policy.hcl845 B
  • examples/conversion/eventbridge-custom-event-bus-should-have-attached-policy/eventbridge-custom-event-bus-should-have-attached-policy.sentinel2.1 KB
  • examples/conversion/eventbridge-custom-event-bus-should-have-attached-policy/README.md1.1 KB
  • examples/conversion/s3-block-public-access-bucket-level/README.md1.1 KB
  • examples/conversion/s3-block-public-access-bucket-level/s3-block-public-access-bucket-level.policy.hcl1.2 KB
  • examples/conversion/s3-block-public-access-bucket-level/s3-block-public-access-bucket-level.sentinel3.2 KB
  • examples/conversion/s3-bucket-should-have-object-lock-enabled/README.md975 B
  • examples/conversion/s3-bucket-should-have-object-lock-enabled/s3-bucket-should-have-object-lock-enabled.policy.hcl1.0 KB
  • examples/conversion/s3-bucket-should-have-object-lock-enabled/s3-bucket-should-have-object-lock-enabled.sentinel2.8 KB
  • examples/conversion/secretsmanager-auto-rotation-enabled-check/README.md955 B
  • examples/conversion/secretsmanager-auto-rotation-enabled-check/secretsmanager-auto-rotation-enabled-check.policy.hcl867 B
  • examples/conversion/secretsmanager-auto-rotation-enabled-check/secretsmanager-auto-rotation-enabled-check.sentinel2.2 KB
  • examples/conversion/step-functions-state-machine-logging-enabled/README.md778 B
  • examples/conversion/step-functions-state-machine-logging-enabled/step-functions-state-machine-logging-enabled.policy.hcl724 B
  • examples/conversion/step-functions-state-machine-logging-enabled/step-functions-state-machine-logging-enabled.sentinel1.6 KB
  • examples/README.md2.5 KB
  • README.md2.8 KB
  • references/tfpolicy-author.md97.6 KB
  • references/tfpolicy-test.md45.1 KB
  • references/verified-syntax.md100.0 KB

SKILL.md（原文）

インストールする前に、エージェントに与えられる指示の中身を確認できます。

terraform-policy

UTILITY SKILL — INVOKES: tfpolicy-author | tfpolicy-test

USE FOR:

  • Writing a new .policy.hcl policy from a description or requirement
  • Converting a .sentinel policy to Terraform Policy
  • Writing or debugging a .policytest.hcl test file
  • Migrating a Sentinel policy library to Terraform Policy

Before giving authoring or testing instructions, check the installed tfpolicy CLI version and tailor guidance accordingly. This skill maintains guidance for the two most recent minor lines, 0.2.x and 0.3.x; when a new minor ships, drop the oldest line and add the new one.

  • If the CLI is 0.2.x (baseline), include a top-level policy { required_providers { ... } } block when authoring .policy.hcl files containing resource or provider policies. It is mandatory for tfpolicy validate; version-range validation is best effort, and wildcard targets such as resource_policy "*" are not schema-validated. tfpolicy test does not preflight mocked attrs/prior_attrs against provider schemas, core::alltrue/core::anytrue do not exist, and, only in this 0.2.x line, mock resource {} blocks may omit attrs/prior_attrs entirely.
  • If the CLI is 0.3.x or newer, the other guidance above still applies, but the 0.2.x allowance for omitting resource state does not: every mock resource {} block in .policytest.hcl files must declare attrs or prior_attrs; if both evaluate to empty, the test case is skipped (provider {} and module {} mocks are unaffected) (see tfpolicy-test). tfpolicy test reuses the target .policy.hcl's existing top-level policy { required_providers { ... } } block (there is no separate .policytest.hcl-level declaration) to validate provider, resource, and data-source policies and core::getdatasource()/core::getresources() arguments against resolved provider schemas before any test runs, failing the whole run on a schema mismatch (see tfpolicy-test). core::alltrue(list) and core::anytrue(list) are also available — prefer them over the core::length() list-comprehension workaround (see tfpolicy-author). meta.tfe_stack and meta.tfe_workspace.tags are available to resource, provider, and module policies; Stack fields are empty outside Stack evaluations.
  • If the CLI version is unknown, ask the user to check it first or provide guidance that clearly distinguishes the 0.2.x and 0.3.x paths.

DO NOT USE FOR:

  • Writing .tftest.hcl files for Terraform modules — use terraform-test
  • General Terraform HCL authoring — use terraform-style-guide

Routing

TaskSub-skill
Write or convert a .policy.hcl policytfpolicy-author
Write or debug a .policytest.hcl testtfpolicy-test

Examples

Troubleshooting

  • Wrong skill triggered? Load the sub-skill directly from the routing table above.
npx skills add hashicorp/agent-skills/terraform/terraform-policy/skills/tfpolicy-author
npx skills add hashicorp/agent-skills/terraform/terraform-policy/skills/tfpolicy-test

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

ログインしてレビューを書く

同じリポジトリのスキル

概要と使いどころ

aws-ami-builder

無料

Build Amazon Machine Images (AMIs) with Packer using the amazon-ebs builder. Use when creating custom AMIs for EC2 instances.

日本語の概要は準備中です。原文の説明を表示しています。

hashicorp/agent-skills8932026年10月5日 更新

azure-image-builder

無料

Build Azure managed images and Azure Compute Gallery images with Packer. Use when creating custom images for Azure VMs.

日本語の概要は準備中です。原文の説明を表示しています。

hashicorp/agent-skills8932026年10月5日 更新

azure-verified-modules

無料

Azure Verified Modules (AVM) requirements and best practices for developing certified Azure Terraform modules. Use when creating or reviewing Azure modules that need AVM certification.

日本語の概要は準備中です。原文の説明を表示しています。

hashicorp/agent-skills8932026年10月5日 更新

new-terraform-provider

無料

Use this when scaffolding a new Terraform provider with the Plugin Framework: workspace layout, go module setup, provider server main.go, and a provider.go with schema and Configure. Also use when a user wants to start building a provider for a new API or asks how to begin a terraform-provider-* project.

日本語の概要は準備中です。原文の説明を表示しています。

hashicorp/agent-skills8932026年10月5日 更新

provider-actions

無料

Implement Terraform Provider actions using the Plugin Framework. Use when developing imperative operations that execute at lifecycle events (before/after create, update, destroy).

日本語の概要は準備中です。原文の説明を表示しています。

hashicorp/agent-skills8932026年10月5日 更新

provider-configuration

無料

Implement Terraform provider configuration and authentication with the Plugin Framework: provider schema for credentials (Optional + Sensitive attributes), environment variable fallbacks, credential provider chains (static config, then environment variables, shared credentials file, and platform identity), unknown-value guards in Configure(), secret redaction, configure-time credential validation, and diagnostics that name every source tried. Use when implementing or reviewing a provider's Configure method or provider schema, adding authentication options (API keys, tokens, profiles, credentials files, assume-role), deciding how a provider should resolve credentials, debugging "no valid credential sources" or missing-credentials errors, or unit testing credential resolution.

日本語の概要は準備中です。原文の説明を表示しています。

hashicorp/agent-skills8932026年10月5日 更新

hashicorp のスキルをすべて見る

このスキルの問題を報告する