Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/sethdford/claude-skills/infrastructure-as-code-patternsnpx skills add sethdford/claude-skills --skill infrastructure-as-code-patternsgit clone --depth 1 https://github.com/sethdford/claude-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sethdford/claude-skills/infrastructure-as-code-patterns)<a href="https://agentmods.dev/skills/sethdford/claude-skills/infrastructure-as-code-patterns"><img src="https://agentmods.dev/badge/skills/sethdford/claude-skills/infrastructure-as-code-patterns.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.00647 |
| Opus 5 | $0.00023 | $0.00324 |
| Sonnet 5 | $0.00009 | $0.00129 |
| Haiku 4.5 | $0.00005 | $0.00065 |
Grade A, and why
infrastructure-as-code-patterns scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 48 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Infrastructure-as-Code Patterns
Define and manage infrastructure through code for reproducibility, version control, and automation.
Context
You are building infrastructure-as-code practices. Choose tools, design module structure, plan testing and validation, implement drift detection. Read current infrastructure, team programming skills, and cloud platform.
Domain Context
Based on IaC best practices (Terraform, CloudFormation, Pulumi):
- Declarative vs Imperative: Declare desired state (Terraform) vs describe steps (CloudFormation). Declarative is more maintainable.
- Modularity: Reusable modules (VPC, database, load balancer); parameterized for different environments
- State Management: Terraform state tracks infrastructure; must be versioned and backed up
- Testing: Unit tests (validate syntax), integration tests (deploy to staging), policy tests (compliance)
- Drift Detection: Find manual changes not in code; reconcile or remediate
Instructions
-
Choose Tool: Terraform (multi-cloud, popular, large ecosystem). CloudFormation (AWS-native, less learning). Pulumi (programming language, more flexible).
-
Design Module Structure: Root modules per environment (dev, staging, prod). Shared modules for common patterns (VPC, RDS cluster, service). Versioned modules in registry.
-
Plan State Management: Store state in remote backend (S3 + DynamoDB for Terraform). Enable versioning and locking. Restrict access (IAM for AWS state). Never commit state to Git.
-
Implement Testing: Validate syntax (terraform fmt). Unit tests (mock resources). Integration tests (deploy to ephemeral environment, test behavior). Destroy after test.
-
Detect and Handle Drift: Use
terraform planto detect changes not in code. Use policy as code (Sentinel, OPA) to enforce compliance. Periodically reconcile drift.
Anti-Patterns
- One Monolithic Module: All infrastructure in single file. Result: hard to understand, reuse, test. Guard: Break into modules; each module responsible for logical unit.
- State Committed to Git: Store state in version control. Result: leaks credentials, creates merge conflicts. Guard: Remote state backend; ignore .tfstate in Git.
- No Testing: Deploy to production first time. Result: broken infrastructure. Guard: Test in ephemeral environment; validate before production.
- Ignoring State Locking: Multiple people apply changes simultaneously. Result: state corruption. Guard: Use remote backend with locking; enforce plan review before apply.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 48 lines · 45 tokens per session scan A 85b6251e9f6f
infrastructure-as-code-patterns is a skill published in the GitHub repository sethdford/claude-skills (38 stars, last pushed 5mo ago), licensed MIT. It adds 45 tokens to every session and 647 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
deno-deploy
Use when deploying Deno apps to production, asking about Deno Deploy, or working with deno deploy CLI commands. Covers deployment workflows, environment variables, KV database access, custom domains, the --tunnel flag for local development, and the deno deploy command reference.
aws-cdk
Create and review Java AWS CDK v2 infrastructure code organized with the BCE (Boundary-Control-Entity) pattern — scaffold the project, wire the app entry point, pin regions in a central Stacks interface, model business components named after AWS services, and keep stacks thin over reusable constructs. Use whenever…
iac-security
Terraform, CloudFormation, and Pulumi hardening: state as a secret store, pinned providers and modules, encryption and network defaults, drift, and the privilege of the pipeline that applies the plan. Use when generating infrastructure code, reviewing IaC changes in a pull request, configuring a state backend, or…
iam-best-practices
Least-privilege cloud IAM: policy scope, privilege-escalation paths, permissions boundaries, workload identity over static keys, MFA enforced by policy, cross-account trust, and separating deploy from runtime. Use when generating IAM policies, roles, or trust documents, wiring CI/CD service accounts or workload…
gandi
Gère les domaines, DNS et emails via l'API Gandi v5. Permet de lister les domaines, consulter/modifier les enregistrements DNS, gérer les boîtes mail et configurer les redirections.
enterprise-agent-ops
Operate long-lived agent workloads with observability, security boundaries, and lifecycle management.