Terraform Modules and Safe Deployments
Get reusable Terraform modules, safe state migrations, explicit provider wiring, and CI gates tied to reviewed plans.
Before & after
Same prompt, same agent — the only difference is the skill.
Terraform is great for managing infrastructure, and multi-region deployments are powerful but complex. You'll want to organize your code into modules — compute modules, networking modules, storage modules — and then compose them for each region. State management is critical; you probably don't want to store state files locally. Something like Terraform Cloud or S3 backend with locking would be safer. You'll also want to think about variables and how to configure different regions differently. Testing your Terraform code helps catch errors before you deploy. Do you have an existing Terraform setup, or are you starting from scratch? That'll help me understand what patterns make sense.
MULTI-REGION ARCHITECTURE
MODULE STRUCTURE
• modules/vpc/ — Networking, subnets, security groups (reusable per region)
• modules/rds/ — Database with automated backups and read replicas
• modules/compute/ — App servers, auto-scaling groups, load balancing
• modules/dns/ — Route53 health checks, failover logic
• environments/prod/ — Region configs (us-east-1, eu-west-1, ap-southeast-1)
STATE MANAGEMENT
→ Backend: S3 + DynamoDB lock table (not Terraform Cloud — cost)
→ State path: prod/us-east-1/terraform.tfstate
→ Lock table: terraform-lock (on-demand billing)
→ Versioning: Enable S3 versioning for rollback
REGION CONFIGURATION (example: prod/us-east-1/main.tf)
module "vpc" {
source = "../../modules/vpc"
region = "us-east-1"
vpc_cidr = "10.0.0.0/16"
}
module "rds" {
source = "../../modules/rds"
availability_zones = ["us-east-1a", "us-east-1b"]
}
→ Separate variables file per region
→ data.tf sources shared DNS zone
DEPLOYMENT SEQUENCE (blue-green pattern)
1. Terraform plan prod/us-east-1 (no auto-approve)
2. Code review (diff must be reviewed by 2 engineers)
3. terraform apply (human confirms after reading plan output)
4. Health checks: 5-minute post-apply validation
5. Repeat for next region (3-hour soak between regions)
DISASTER RECOVERY
• Backup plan: Weekly snapshots stored in separate AWS account
• Rollback: terraform destroy -> reapply from prior state version
• Testing: Staging environment mirrors prod (same modules, smaller instance sizes)About this skill
A small Terraform refactor can propose replacing production infrastructure, and a reviewed pull request can still apply a different plan. This skill produces reusable modules and deployment workflows that account for resource addresses, state ownership, provider identity, and the actual changes Terraform proposes.
What it does
- Designs module inputs, outputs, and boundaries around ownership and lifecycle.
- Diagnoses unexpected replacement and address changes, including count-to-for_each migrations.
- Builds backend migration procedures with locking, recovery checkpoints, and state verification.
- Wires multi-account and multi-region providers explicitly, including child-module aliases.
- Designs CI gates that connect approval to a saved plan, source revision, and target state.
- Turns security requirements into plan checks with explicit handling of unknown values and replacements.
What you get
Terraform code or a focused review, accompanied by migration steps and concrete plan acceptance criteria. Larger requests include a deployment sequence, policy checks, and recovery boundaries; quick questions receive a direct fix.
Best for
Platform engineers and infrastructure owners maintaining shared Terraform modules, separating environments, refactoring existing state, or tightening production deployment pipelines.
SKILL.md preview
---
name: terraform-modules-and-safe-deployments
description: >-
Design reusable Terraform modules, diagnose resource replacement, plan state migrations, and build deployment gates by tracing resource addresses, provider identity, state ownership, and saved-plan provenance. Use when the user says "design a reusable Terraform module", "my Terraform plan keeps replacing resources", "move our state to a remote backend", "deploy this across multiple regions", "review this Terraform before apply", "stop CI applying a different plan", or "convert count to for_each safely".
---
# Terraform Modules and Safe Deployments
… (sign up to view the full skill)More development skills
View all Development skills →Chaos Experiment and Game Day Planner
Plans chaos experiments and game days: hypothesis, blast radius, abort conditions, tool manifests, rollback, and post-run review.
Claude Code Cost and Latency Routing
Configure Claude Code Router with model tiers, explicit fallbacks, compatibility checks, and a cost-aware validation plan.
CI/CD Pipeline Builder with Gated Deploys
Generates CI/CD workflows from your repo's real stack: cached fast-fail checks, pinned actions, and staging-to-prod deploys with gates.
Dockerfile and Compose Review: Size, Cache, Security
Rewrites Dockerfiles and compose files for smaller images, cache-friendly builds, and non-root, secret-free containers, with reasons.