How to use the Terraform Engineer agent skill: install and run it

What the terraform-engineer skill makes the agent do

An agent skill is a folder with a SKILL.md file that describes how the agent should handle a certain kind of task. When this skill is active, the agent structures Terraform code into reusable modules with inputs, outputs and validation blocks, configures remote state with locking and encryption, and pins provider versions. It can also help migrate backends, import existing resources and resolve state conflicts.

• Module development: create reusable modules and manage module versioning
• State management: migrate backends, import existing resources, resolve state conflicts
• Provider configuration for AWS, Azure and GCP, including authentication
• Multi-environment workflows and infrastructure testing

Install the skill on Claude (ZIP download or upload)

Download the ZIP file from the skill page. Then choose one of two routes. For a personal install, unzip it into ~/.claude/skills/. To scope it to one project, unzip it into the project's .claude/skills/ folder. Alternatively, upload the ZIP in the Claude apps under Settings → Capabilities → Skills.

After installing, the folder should contain SKILL.md along with the references folder, which holds module-patterns.md, state-management.md, providers.md, testing.md and best-practices.md. The agent loads these reference files when a task needs them.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into the project's .claude/skills/
• App install: Settings → Capabilities → Skills, then upload the ZIP

Install the required tools

The skill expects the Terraform CLI to be installed, because its workflow runs terraform fmt, terraform validate, terraform plan and terraform apply. It also runs tflint in the validation step. If the agent will run plan or apply, it needs cloud provider credentials for AWS, Azure or GCP. Set these up in your environment before you start, and check that the terraform command works in the same terminal the agent uses.

• Terraform CLI
• tflint
• Cloud provider credentials for AWS, Azure or GCP (only needed if the agent runs plan or apply)

Trigger the skill with natural requests

You do not need a special command. Describe the Terraform task in plain language and mention Terraform or the cloud provider. The skill's trigger words include Terraform, infrastructure as code, IaC, terraform module, terraform state, AWS provider, Azure provider, GCP provider, terraform plan and terraform apply.

Be specific about the goal, the cloud and any constraints. Name the files or environment when you can, because the agent works from existing code.

• "Turn this S3 bucket definition into a reusable module with validated inputs and outputs."
• "Move our Terraform state from local files to an S3 backend with DynamoDB locking."
• "Import the existing VPC in us-east-1 into state and check the plan shows no changes."
• "Pin the AWS and azurerm provider versions in this repo and run fmt and validate."

Understand the review-before-apply workflow

The skill follows a fixed sequence. It analyses the infrastructure, designs modules, implements state, applies security policies, then validates with terraform fmt, terraform validate and tflint. Validation errors must be fixed and re-checked before going on. It then runs terraform plan -out=tfplan and summarises creates, updates and deletes, with destructive actions called out. It presents that summary and asks for explicit approval. It runs terraform apply tfplan only after you confirm.

If a plan fails, the skill has recovery steps: refresh or re-align state for drift, re-run terraform init and check credentials for provider auth errors, and add depends_on or restructure outputs for ordering errors. After any fix it returns to validation before planning again.

• Validate: terraform fmt, terraform validate, then tflint
• Plan: terraform plan -out=tfplan with a summary of changes
• Approve: the agent refuses to apply without your confirmation, or if destructive changes are present and not accepted

Read the plan summary before you approve

The approval step is only as good as your reading of the plan. Check every line marked for destruction or replacement, confirm the target account, region and environment, and ask the agent why each change is needed. If something is unclear, say no and ask for a narrower plan.

The skill's own rules support this. It says to store no secrets in plain text, avoid local state for production, and never commit .terraform directories. Use these as a checklist when you review.

• Confirm the account, region and environment in the plan match what you intended
• Treat any replacement or deletion as a decision you must accept explicitly
• Check that no secrets appear in code or outputs