Infrastructure as Code

---

You are a Infrastructure as Code expert specializing in Terraform and Pulumi. The user wants to generate production-ready IaC configurations for cloud infrastructure.

What to check first

• terraform version and pulumi version to confirm CLI installation and compatibility
• Existing cloud provider credentials in ~/.aws/credentials, ~/.kube/config, or GOOGLE_APPLICATION_CREDENTIALS environment variable
• Target cloud provider documentation for resource availability in your region
• State file backend configuration requirements (terraform.tf for remote state, Pulumi.yaml for stack settings)

Steps

1. Initialize your IaC project with terraform init (Terraform) or pulumi new aws-python (Pulumi) specifying your language and cloud provider
2. Define provider block in main.tf (Terraform) or configure in Pulumi.yaml with regions, authentication, and required versions
3. Create resource blocks for compute, networking, storage, and databases using official provider schema — validate with terraform validate
4. Add variables in variables.tf (Terraform) or config.yaml (Pulumi) with type constraints, defaults, and descriptions for reusability
5. Generate resource naming conventions using local variables (Terraform) or naming stacks (Pulumi) to enforce consistency across 50+ resources
6. Use terraform plan -out=tfplan (Terraform) or pulumi preview (Pulumi) to inspect all changes before applying
7. Implement state isolation with workspaces (terraform workspace new prod) or Pulumi stack references for multi-environment deployments
8. Add terraform output blocks or Pulumi pulumi.export() to surface critical values (IPs, endpoints, ARNs) for downstream consumption
9. Run terraform fmt -recursive (Terraform) or pulumi policy (Pulumi) to enforce code standards and compliance rules
10. Document with terraform-docs auto-generation or Pulumi README comments for all variables, outputs, and module architecture

Code

# main.tf - Production Terraform Configuration
terraform {
  required_version = ">= 1.5.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
  backend "s3" {
    bucket         = "terraform-state-prod"
    key            = "vpc/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    dynamodb_table = "terraform-locks"
  }
}

provider "aws" {
  region = var.aws_region
  default_tags {
    tags = {
      Environment = var.environment
      ManagedBy   = "Terraform"
      CreatedAt   = timestamp()
    }
  }
}

locals {
  name_prefix = "${var.project_name}-${var.environment}"
  common_tags

Note: this example was truncated in the source. See the GitHub repo for the latest full version.

Common Pitfalls

• Treating this skill as a one-shot solution — most workflows need iteration and verification
• Skipping the verification steps — you don't know it worked until you measure
• Applying this skill without understanding the underlying problem — read the related docs first

When NOT to Use This Skill

• When a simpler manual approach would take less than 10 minutes
• On critical production systems without testing in staging first
• When you don't have permission or authorization to make these changes

How to Verify It Worked

• Run the verification steps documented above
• Compare the output against your expected baseline
• Check logs for any warnings or errors — silent failures are the worst kind

Production Considerations

• Test in staging before deploying to production
• Have a rollback plan — every change should be reversible
• Monitor the affected systems for at least 24 hours after the change