Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add soulcodex/agentic --skill design-aws-terraform-iacgit clone --depth 1 https://github.com/soulcodex/agenticWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/soulcodex/agentic/design-aws-terraform-iac)<a href="https://agentmods.dev/skills/soulcodex/agentic/design-aws-terraform-iac"><img src="https://agentmods.dev/badge/skills/soulcodex/agentic/design-aws-terraform-iac/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/soulcodex/agentic/design-aws-terraform-iac"><img src="https://agentmods.dev/badge/skills/soulcodex/agentic/design-aws-terraform-iac.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.00623 |
| Opus 5 | $0.00026 | $0.00311 |
| Sonnet 5 | $0.00010 | $0.00125 |
| Haiku 4.5 | $0.00005 | $0.00062 |
Grade A, and why
design-aws-terraform-iac scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 88 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Design AWS Terraform IaC Skill
Design AWS Terraform infrastructure before writing module code.
Always pair this skill with terraform-risk-playbook. That skill is
authoritative for the response contract, failure-mode classification,
version/runtime guards, validation chain, and rollback notes.
Step 1 - Confirm Scope and Constraints
Capture required outcomes:
- workloads and critical paths
- regions, environments, and compliance constraints
- cost boundaries and availability targets
- runtime and version assumptions
- backend and execution path assumptions (local, CI, Terraform Cloud, Atlantis)
Capture non-goals to prevent accidental over-design.
Step 2 - Map Services and Responsibility Boundaries
Use aws-service-matrix.md to map each capability to:
- primary AWS service(s)
- related Terraform module boundary
- key operational risks and ownership notes
Design composable modules with explicit interfaces between network, security, platform, and workload layers.
Step 3 - Define State and Environment Strategy
Decide and document:
- remote backend (prefer
s3withuse_lockfile = true; use DynamoDB locking only as a temporary compatibility bridge for older Terraform workflows) - state key strategy per environment and region
- promotion model (
dev->staging->prod) - drift and rollback expectations
- explicit handling for sensitive values in state and plans
Step 4 - Define Security and Policy Baselines
Specify minimum required controls:
- IAM least privilege for CI and runtime roles
- encryption at rest and in transit
- tag standards for ownership, cost, and data classification
- log/audit coverage and retention
- secret source-of-truth and rotation boundary (for example, Secrets Manager references rather than plaintext values in variables)
Step 5 - Produce a Design Brief and Acceptance Criteria
Output a compact design brief with:
- service choices and tradeoffs
- module map and dependency order
- state strategy and CI plan/apply gate strategy
- explicit risk categories and validation expectations
- rollback notes for destructive or state-mutating steps
- measurable acceptance checks from
acceptance-checklist.md
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 88 lines · 51 tokens per session scan A b11a310ac1d7
design-aws-terraform-iac is a skill published in the GitHub repository soulcodex/agentic (10 stars, last pushed 5d ago), licensed MIT. It adds 51 tokens to every session and 623 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
Cloud Security & Container Hardening
AWS/Azure/GCP security auditing, container and Kubernetes hardening, Infrastructure as Code scanning, and cloud compliance assessment.
AWS WAF Pillar Review
AWS Well-Architected Framework pillar checklists — operational excellence, security, reliability, performance efficiency, cost optimization, sustainability — for reviewing AWS infrastructure changes.
terraform
A guide to Terraform, a tool that describes and manages cloud infrastructure from configuration files. It covers initialization, formatting, validation, planning, applying changes, state inspection, outputs, and HCL syntax.
terraform-iac
Terraform and OpenTofu infrastructure as code best practices - generate HCL configurations, module patterns, state management, CI/CD workflows, and cloud provider templates for AWS, GCP, Azure.
aws-cloud-architecture
Comprehensive guide to AWS cloud architecture covering compute, storage, databases, networking, security, serverless, and cost optimization with production-ready patterns.
terraform-builder
Build infrastructure as code with Terraform. Covers module design, state management, AWS/GCP/Azure resources, and production-grade practices.