terraform-style-check

OverviewHistoryStatsSecurity

npx skills add ...

Documentation

SKILL.md

Generate Terraform HCL code following HashiCorp's official style conventions and best practices. Use when writing, reviewing, or generating Terraform configurations.

npx skills add warpdotdev/oz-skills --skill terraform-style-check

Documentation

SKILL.mdView source

Terraform Style Guide

Generate and maintain Terraform code following HashiCorp's official style conventions and best practices.

Reference: HashiCorp Terraform Style Guide

Code Generation Strategy

When generating Terraform code:

Start with provider configuration and version constraints
Create data sources before dependent resources
Build resources in dependency order
Add outputs for key resource attributes
Use variables for all configurable values

File Organization

File	Purpose
`terraform.tf`	Terraform and provider version requirements
`providers.tf`	Provider configurations
`main.tf`	Primary resources and data sources
`variables.tf`	Input variable declarations (alphabetical)
`outputs.tf`	Output value declarations (alphabetical)
`locals.tf`	Local value declarations

Example Structure

# terraform.tf
terraform {
  required_version = ">= 1.7"
 
  required_providers

Code Formatting

Indentation and Alignment

Use two spaces per nesting level (no tabs)
Align equals signs for consecutive arguments

Block Organization

Arguments precede blocks, with meta-arguments first:

Naming Conventions

Use lowercase with underscores for all names
Use descriptive nouns excluding the resource type
Be specific and meaningful

Variables

Every variable must include type and description:

Outputs

Every output must include description:

Dynamic Resource Creation

Prefer for_each over count

count for Conditional Creation

Security Best Practices

When generating code, apply security hardening:

Enable encryption at rest by default
Configure private networking where applicable
Apply principle of least privilege for security groups
Enable logging and monitoring
Never hardcode credentials or secrets
Mark sensitive outputs with sensitive = true

Example: Secure S3 Bucket

Version Pinning

Version constraint operators:

= 1.0.0 - Exact version
>= 1.0.0 - Greater than or equal
~> 1.0 - Allow rightmost component to increment
>= 1.0, < 2.0 - Version range

Provider Configuration

Version Control

Never commit:

terraform.tfstate, terraform.tfstate.backup
.terraform/ directory
*.tfplan
.tfvars files with sensitive data

Always commit:

All .tf configuration files
.terraform.lock.hcl (dependency lock file)

Validation Tools

Run before committing:

Additional tools:

tflint - Linting and best practices
checkov / tfsec - Security scanning

Code Review Checklist

Based on: HashiCorp Terraform Style Guide

npx skills add warpdotdev/oz-skills --skill terraform-style-check

Documentation

SKILL.md

terraform-style-check skill by warpdotdev | SkillBundle

resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
  subnet_id     = "subnet-12345678"
 
  tags = {
    Name        = "web-server"
    Environment = "production"
  }
}

resource "aws_instance" "example" {
  # Meta-arguments
  count = 3
 
  # Arguments
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
 
  # Blocks
  root_block_device {
    volume_size = 20
  }
 
  # Lifecycle last
  lifecycle {
    create_before_destroy = true
  }
}

# Bad
resource "aws_instance" "webAPI-aws-instance" {}
variable "name" {}
 
# Good
resource "aws_instance" "web_api" {}
variable "application_name" {}

variable "instance_type" {
  description = "EC2 instance type for the web server"
  type        = string
  default     = "t2.micro"
 
  validation {
    condition     = contains(["t2.micro", "t2.small", "t2.medium"], var.instance_type)
    error_message = "Instance type must be t2.micro, t2.small, or t2.medium."
  }
}
 
variable "database_password" {
  description = "Password for the database admin user"
  type        = string
  sensitive   = true
}

output "instance_id" {
  description = "ID of the EC2 instance"
  value       = aws_instance.web.id
}
 
output "database_password" {
  description = "Database administrator password"
  value       = aws_db_instance.main.password
  sensitive   = true
}

# Bad - count for multiple resources
resource "aws_instance" "web" {
  count = var.instance_count
  tags  = { Name = "web-${count.index}" }
}
 
# Good - for_each with named instances
variable "instance_names" {
  type    = set(string)
  default = ["web-1", "web-2", "web-3"]
}
 
resource "aws_instance" "web" {
  for_each = var.instance_names
  tags     = { Name = each.key }
}

resource "aws_cloudwatch_metric_alarm" "cpu" {
  count = var.enable_monitoring ? 1 : 0
 
  alarm_name = "high-cpu-usage"
  threshold  = 80
}

resource "aws_s3_bucket" "data" {
  bucket = "${var.project}-${var.environment}-data"
  tags   = local.common_tags
}
 
resource "aws_s3_bucket_versioning" "data" {
  bucket = aws_s3_bucket.data.id
 
  versioning_configuration {
    status = "Enabled"
  }
}
 
resource "aws_s3_bucket_server_side_encryption_configuration" "data" {
  bucket = aws_s3_bucket.data.id
 
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.s3.arn
    }
  }
}
 
resource "aws_s3_bucket_public_access_block" "data" {
  bucket = aws_s3_bucket.data.id
 
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

terraform {
  required_version = ">= 1.7"
 
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"  # Allow minor updates
    }
  }
}

provider "aws" {
  region = "us-west-2"
 
  default_tags {
    tags = {
      ManagedBy = "Terraform"
      Project   = var.project_name
    }
  }
}
 
# Aliased provider for multi-region
provider "aws" {
  alias  = "east"
  region = "us-east-1"
}

terraform fmt -recursive
terraform validate