terraform-aws
Patterns and best practices for AWS infrastructure as code with Terraform. Use when the user asks about Terraform module structure, naming conventions, state management, IAM policies (least privilege, OIDC), CI/CD pipelines for infrastructure (GitHub Actions, OIDC authentication), security scanning (Checkov, CKV_AWS checks), secrets management, KMS key policies, confused deputy prevention, Lambda function URL auth, API Gateway WAF/logging, or general IaC architecture decisions. Triggers on: Terraform, OpenTofu, IaC, modules, tfstate, remote state, OIDC, IAM, least privilege, GitHub Actions, CI/CD, infrastructure pipeline, AWS provider, Checkov, static analysis, IaC scanning, confused deputy, source ARN, KMS, CMK, secrets in state, ephemeral resources, Lambda function URL, API Gateway WAF.
89
86%
Does it follow best practices?
Impact
93%
2.02xAverage score across 3 eval scenarios
Passed
No findings from the security scan
Evaluation results
83%
12%Serverless Order Processing Infrastructure
Lambda SQS consumer least-privilege IAM and scoped log group
Exact SQS actions only
0%
58%
SQS scoped to queue ARN
100%
100%
Pre-created log group resource
100%
100%
Logs permissions scoped to log group ARN
80%
100%
source_arn on lambda permission
100%
100%
Explicit KMS key policy
0%
30%
kms:Decrypt for Lambda on SQS CMK
100%
100%
DynamoDB customer-managed key
100%
100%
Tags via default_tags
100%
100%
Branch tag in default_tags
0%
0%
X-Ray Active tracing
100%
100%
100%
100%Terraform CI/CD Pipeline for a Multi-Environment Fintech Platform
Multi-environment Terraform CI/CD pipeline with secure AWS auth, IaC scanning, drift detection, and safe concurrency
OIDC provider resource
0%
100%
AssumeRoleWithWebIdentity action
0%
100%
cancel-in-progress false on apply
0%
100%
Object-format environment
0%
100%
Checkov HCL stage
0%
100%
Checkov plan stage
0%
100%
terraform init -reconfigure
0%
100%
Per-branch backend key injection
0%
100%
default_tags with Branch
0%
100%
Apply gated on PR review
0%
100%
detailed-exitcode for drift
0%
100%
env_suffix naming pattern
0%
100%
96%
27%Terraform Remote State Backend Setup
Terraform state backend bootstrap with KMS encryption and safe secret handling
S3 native locking
100%
100%
No DynamoDB lock table
0%
100%
Backend encrypt flag
100%
100%
Backend KMS key ID
100%
100%
Bucket key enabled
100%
100%
Bootstrap uses local state
100%
100%
Ephemeral secret resource
0%
100%
No data source for secret
0%
100%
Explicit KMS key policy
70%
60%
Static default_tags only
100%
100%
- Repository
- a-pavithraa/aws-serverless-skill
- Commit
2b66211
- Evaluated
- Agent
- Claude Code
- Model
- Claude Sonnet 4.6
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.