CtrlK
BlogDocsLog inGet started
Tessl Logo

terraform-aws

Patterns and best practices for AWS infrastructure as code with Terraform. Use when the user asks about Terraform module structure, naming conventions, state management, IAM policies (least privilege, OIDC), CI/CD pipelines for infrastructure (GitHub Actions, OIDC authentication), security scanning (Checkov, CKV_AWS checks), secrets management, KMS key policies, confused deputy prevention, Lambda function URL auth, API Gateway WAF/logging, or general IaC architecture decisions. Triggers on: Terraform, OpenTofu, IaC, modules, tfstate, remote state, OIDC, IAM, least privilege, GitHub Actions, CI/CD, infrastructure pipeline, AWS provider, Checkov, static analysis, IaC scanning, confused deputy, source ARN, KMS, CMK, secrets in state, ephemeral resources, Lambda function URL, API Gateway WAF.

70

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured reference skill: concrete, specific anti-patterns with exact identifiers and a strong reference-loading strategy that keeps the main file as an overview. Weaker on workflow clarity (no sequenced procedural workflow with checkpoints) and slightly token-heavy due to the inlined dual-platform MCP config.

Suggestions

Move the dual-platform AWS Pricing MCP server JSON config (lines 67-108) into a reference file or collapse to a single example with a one-line Windows variant note, reducing ~40 lines of token weight from the main SKILL.md.

Add a short sequenced workflow with an explicit validation checkpoint for destructive operations (e.g., 1. plan in PR, 2. review plan output, 3. apply only after approval, 4. verify no state corruption) so the scattered apply/destroy safety guidance becomes a clear procedure.

Include one or two minimal positive Terraform code snippets showing the correct pattern (e.g., a scoped Lambda log-group role, an ephemeral secretsmanager resource) alongside the 'Don't' statements to make guidance copy-paste ready.

DimensionReasoningScore

Conciseness

Mostly lean and assumes Claude's competence — no padded explanations of what Terraform or IAM is — but the ~40 lines of dual-platform MCP server JSON config (lines 67-108) inlined in the main file is token-heavy for a SKILL.md overview and could be trimmed or moved to a reference. Not a 3 because there is no unnecessary concept explanation; not a 5 because the inlined config block is over-explanation that could be tightened.

4 / 5

Actionability

Highly concrete guidance — exact Checkov IDs ('CKV_AWS_28/119', 'CKV_AWS_258', 'CKV_AWS_76/CKV2_AWS_29'), exact IAM actions ('sqs:ReceiveMessage, sqs:DeleteMessage, sqs:GetQueueAttributes'), specific attributes ('authorization_type = "NONE"', 'source_arn'), and copy-paste-ready MCP JSON. Not a 5 because the Terraform guidance is actionable instruction ('Don't do X, do Y') rather than positive copy-paste code examples showing correct patterns — a minor gap consistent with the 'mostly executable' anchor.

4 / 5

Workflow Clarity

This is a reference/anti-patterns skill rather than a procedural one, so there is no sequenced multi-step workflow with explicit validation checkpoints; safety guidance for the destructive 'terraform apply' operation does appear as anti-patterns ('require plan review in PR', 'Don't use cancel-in-progress: true on apply/destroy jobs — cancelling mid-apply corrupts state'), but it is scattered rather than presented as a clear sequence. The reference-loading decision table is clear, but checkpoints are implicit, matching the anchor-3 description; not a 4 because no clear sequenced workflow is present.

3 / 5

Progressive Disclosure

Clear overview body with well-signaled one-level-deep references — all three referenced files (terraform-structure.md, security-iam.md, cicd-patterns.md) exist and are pointed to via both a Quick Reference topic→file table and an explicit 'Reference Loading Strategy' decision table with line counts. The 1300 lines of detail are appropriately split out of the main file, and navigation is easy.

5 / 5

Total

16

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, comprehensive description that names a clear niche, enumerates concrete capabilities, and provides both an explicit 'Use when' clause and a dense trigger-term list. Third-person voice is maintained throughout with no first/second-person drift.

DimensionReasoningScore

Specificity

Lists multiple concrete capability areas comprehensively — 'module structure, naming conventions, state management, IAM policies (least privilege, OIDC), CI/CD pipelines... security scanning (Checkov, CKV_AWS checks), secrets management, KMS key policies, confused deputy prevention, Lambda function URL auth, API Gateway WAF/logging' — each a specific concrete topic rather than vague abstraction.

5 / 5

Completeness

Explicitly answers both 'what' ('Patterns and best practices for AWS infrastructure as code with Terraform' plus enumerated capabilities) and 'when' ('Use when the user asks about...' plus the 'Triggers on:' list) with concrete trigger phrases.

5 / 5

Trigger Term Quality

A dedicated 'Triggers on:' clause gives comprehensive natural-term coverage including synonyms and identifiers — 'Terraform, OpenTofu, IaC, modules, tfstate, remote state, OIDC, IAM, least privilege, GitHub Actions, CI/CD, infrastructure pipeline, AWS provider, Checkov, static analysis, IaC scanning, confused deputy, source ARN, KMS, CMK, secrets in state, ephemeral resources, Lambda function URL, API Gateway WAF'.

5 / 5

Distinctiveness Conflict Risk

The Terraform-on-AWS IaC niche is sharply defined by specific signals (Checkov CKV_AWS checks, OIDC federation, confused deputy, source ARN), giving it a clear niche with minimal overlap risk against other skills.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
a-pavithraa/aws-serverless-skill
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.