aws-iac-safety-skill

What I do

I provide safety patterns for AWS Infrastructure-as-Code (Terraform/OpenTofu) and GitHub Actions CI/CD, extracted from production incidents. Each pattern caused a real outage or security issue.

When to use me

Use this skill when:

• Writing or reviewing Terraform/OpenTofu modules managing GitHub or AWS resources
• Setting up multi-environment CI/CD with SSM parameters
• Managing ECR repositories across multiple modules
• Deploying the same Docker image to both EC2 and Lambda
• Auditing IaC for cross-module ownership violations

Related Skills

• opentofu-aws-explorer-skill: AWS resource discovery (Lambda Function URL CNAME pattern).
• opentofu-ecr-provision-skill: ECR provisioning (lowercase-safe naming pattern).
• security-audit-skill: Security auditing (Lambda public-without-auth, local Terraform state patterns).
• docker-containerization-skill: Docker patterns (no-rollback-on-deploy pattern).

---

A. GitHub Resource Management

A1. Repo-Level GitHub Resources Without Count Gating

GitHub repo-level variables/secrets are singular — one per name, shared across environments. Without count gating, non-dev environments attempt to create resources that already exist, triggering HTTP 422 conflicts.

# BAD — creates in ALL environments, 422 on non-dev
resource "github_actions_variable" "registry_token" {
  repository = var.repo_name
  variable_name  = "REGISTRY_TOKEN"
  variable_value = var.registry_token
}

# GOOD — only dev creates repo-level resources
resource "github_actions_variable" "registry_token" {
  count          = var.environment == "dev" ? 1 : 0
  repository     = var.repo_name
  variable_name  = "REGISTRY_TOKEN"
  variable_value = var.registry_token
}

Gotcha: The CI cleanup-resources mechanism uses tofu state rm (not import). After state rm, OpenTofu sees no state for the resource and attempts CREATE on the next plan — triggering the 422 again. The fix is count-gating, not state manipulation.