cfec11bb46
Some checks failed
ci/woodpecker/push/woodpecker Pipeline failed
stop-slop, taste-skill, terrashark had embedded .git dirs causing Woodpecker clone to fail on submodule update.
86 lines
3.3 KiB
Markdown
86 lines
3.3 KiB
Markdown
---
|
|
name: terrashark
|
|
description: "Prevent Terraform/OpenTofu hallucinations by diagnosing and fixing failure modes: identity churn, secret exposure, blast-radius mistakes, CI drift, and compliance gate gaps. Use when generating, reviewing, refactoring, or migrating IaC and when building delivery/testing pipelines."
|
|
---
|
|
|
|
# Terrashark: Failure-Mode Workflow for Terraform/OpenTofu
|
|
|
|
Run this workflow top to bottom.
|
|
|
|
## 1) Capture execution context
|
|
|
|
Record before writing code:
|
|
- runtime (`terraform` or `tofu`) and exact version
|
|
- provider(s), target platform, and state backend
|
|
- execution path (local CLI, CI, HCP Terraform/TFE, Atlantis)
|
|
- environment criticality (dev/shared/prod)
|
|
|
|
If unknown, state assumptions explicitly.
|
|
|
|
## 2) Diagnose likely failure mode(s)
|
|
|
|
Select one or more based on user intent and risk:
|
|
- identity churn: resource addressing instability, refactor breakage
|
|
- secret exposure: secrets in state, logs, defaults, artifacts
|
|
- blast radius: oversized stacks, weak boundaries, unsafe applies
|
|
- CI drift: version mismatch, unreviewed applies, missing artifacts
|
|
- compliance gate gaps: missing policies/approvals/audit controls
|
|
|
|
## 3) Load only the relevant reference file(s)
|
|
|
|
Primary references:
|
|
- `references/identity-churn.md`
|
|
- `references/secret-exposure.md`
|
|
- `references/blast-radius.md`
|
|
- `references/ci-drift.md`
|
|
- `references/compliance-gates.md`
|
|
|
|
Supplemental references (only when needed):
|
|
- `references/testing-matrix.md`
|
|
- `references/quick-ops.md`
|
|
- `references/examples-good.md`
|
|
- `references/examples-bad.md`
|
|
- `references/examples-neutral.md`
|
|
- `references/coding-standards.md`
|
|
- `references/module-architecture.md`
|
|
- `references/ci-delivery-patterns.md`
|
|
- `references/security-and-governance.md`
|
|
- `references/do-dont-patterns.md`
|
|
- `references/mcp-integration.md`
|
|
|
|
Conditional references (CRR; load only on detected signals):
|
|
- `references/conditional/backend-state-safety.md` (backend is `s3`, `azurerm`, `gcs`, `remote`, `cloud`, `pg`, `consul`, or `local`, or task mentions backend migration, locking, state backup, or restore)
|
|
- `references/conditional/trusted-modules.md` (provider is `aws`, `azurerm`, `google`, `oci`, or `ibm`)
|
|
|
|
Do not load multiple conditional references unless the task spans multiple detected backends, providers, or tools.
|
|
|
|
## 4) Propose fix path with explicit risk controls
|
|
|
|
For each fix, include:
|
|
- why this addresses the failure mode
|
|
- what could still go wrong
|
|
- guardrails (tests, approvals, rollback)
|
|
|
|
## 5) Generate implementation artifacts
|
|
|
|
When applicable, output:
|
|
- HCL changes (typed vars, stable keys, bounded versions)
|
|
- migration blocks (`moved`, import strategy)
|
|
- CI pipeline updates (plan/apply separation, artifacts, policy checks)
|
|
- compliance controls (approvals, policy rules, evidence paths)
|
|
|
|
When a trusted registry module covers the requested resource and the user has not asked for raw HCL, default to that module with an exact `version` pin (see `references/conditional/trusted-modules.md`).
|
|
|
|
## 6) Validate before finalize
|
|
|
|
Always provide command sequence tailored to runtime and risk tier.
|
|
Never recommend direct production apply without reviewed plan and approval.
|
|
|
|
## 7) Output contract
|
|
|
|
Return:
|
|
- assumptions and version floor
|
|
- selected failure mode(s)
|
|
- chosen remediation and tradeoffs
|
|
- validation/test plan
|
|
- rollback/recovery notes for destructive-impact changes
|