Auditing Terraform Infrastructure Security
Scans Terraform cloud infrastructure code for security misconfigurations before deployment
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
Once installed, the agent can review Terraform files (the code that defines cloud infrastructure such as storage buckets, permissions and firewall rules) for security problems before they are deployed. It guides the agent to run established scanners like Checkov, tfsec and Terrascan, write custom OPA/Rego policy rules for organisation standards, and set up a CI/CD pipeline gate that fails when risky settings such as wildcard IAM permissions, public exposure, missing encryption or open SSH are found. A bundled Python helper wraps these scanner commands and returns their results as JSON.
Great for
- Cloud or DevOps engineers who want automated security checks on Terraform pull requests
- Security teams building policy-as-code guardrails for infrastructure provisioning
- Teams auditing existing Terraform projects for common cloud misconfigurations
Skip it if
- Runtime monitoring of live cloud accounts; the skill says to use CSPM tools for this, since it only analyses code and plans
- Application security testing (SAST/DAST), which is outside its scope
- Non-Terraform infrastructure code, since the scanners and examples target Terraform specifically
Try asking
- “Scan my ./terraform directory for security misconfigurations using Checkov and tfsec”
- “Write OPA Rego policies that block S3 buckets without encryption and wildcard IAM actions”
- “Add a GitHub Actions security gate that scans Terraform plans on every pull request”
- “Summarise the high-severity findings from my tfplan.json and suggest fixes”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
auditing-terraform-infrastructure-for-security.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip auditing-terraform-infrastructure-for-security.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip auditing-terraform-infrastructure-for-security.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Run the scan on a Terraform plan JSON (terraform show -json) as well as on source files, since plans give more accurate results
- Review any skipped checks and record a justification, so suppressions stay auditable
- Treat the scanner output as a starting point and verify findings against your own environment before changing production code
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.