Codex skills for Terraform and IaC
These skills make Codex treat infrastructure code as something with live resources behind it: renames get moved blocks, imports and removals go through a reviewable plan, and state changes and applies wait for your go-ahead. They cover Terraform modules and state, OpenTofu migration, drift checks, Pulumi, AWS CDK and SAM, and Azure Bicep.
Start with these 3
- Terraform Modules Small typed interfaces, refactors with zero destroys Codex designs Terraform modules around a narrow, typed interface with optional attributes and validation, keeps provider configuration in the root module, prefers for_each so removing one item never recreates the rest, and adds moved blocks whenever an address changes. Each change is checked with fmt, validate, tflint and terraform test, then planned in every caller to prove nothing gets destroyed.
- Terraform State Imports, moves and lock fixes with a backup first Codex handles Terraform state like a production database: back it up, prefer import, moved and removed blocks that show up in a reviewable plan, and fall back to state mv or rm only with a verified copy and your go-ahead. It splits monolithic states, adopts hand-made cloud resources, clears dead locks after checking nobody is applying, and finishes every job on a plan with no changes.
- OpenTofu Terraform to tofu with a no-change plan as proof Codex moves Terraform repositories to OpenTofu one root module at a time, proving each step with a plan that shows no changes before any apply, and switches CI and wrapper scripts to the tofu binary with regenerated lock files. Afterwards it adopts OpenTofu-only features deliberately, such as KMS-backed state encryption with a plaintext fallback during rollout, and records the lock-in each one adds.
8 more Terraform and IaC skills
-
Pulumi IaC
Typed infrastructure code with no surprise replaces -
AWS CDK
Infrastructure code that never replaces your database -
Azure Bicep
Typed templates, a what-if before every deploy -
Infrastructure Drift
Catch console changes before the next apply does -
SST v3 Apps
TypeScript infrastructure with links, not hardcoded ARNs -
WAF Rules
Count first, block later, except narrowly -
Datadog APM
Linked traces and logs, monitors in code, sane bills -
AWS SAM
Local invokes, reviewed change sets, canary releases
General skills with Terraform and IaC guidance
Not built around Terraform and IaC, but they include steps or tools for it. Not part of the install-all command.
Every Terraform and IaC skill in one command
Installs these 11 into ~/.agents/skills/. Add --project after -- to install into the current repository instead.
The installer is a 104-line POSIX shell script. It fetches the skills you name from codexskills.dev and unpacks each into its own folder in your skills directory. No sudo, no telemetry, and every skill page shows the full SKILL.md first. Read install.sh
curl -fsSL codexskills.dev/install.sh | sh -s -- terraform-modules terraform-state opentofu pulumi-iac aws-cdk azure-bicep infrastructure-drift sst-apps waf-rules datadog-apm aws-sam Terraform and IaC FAQ
Can Codex import existing cloud resources into Terraform state?
Terraform State uses config-driven import blocks with -generate-config-out for a draft, moved blocks for renames and removed blocks to stop managing a resource without destroying it. It takes a verified backup before touching state, and every apply, state mv, state rm, stuck-lock removal or backend migration needs your explicit confirmation after you have seen the plan or command.
Is there a Codex skill for migrating from Terraform to OpenTofu?
OpenTofu moves a repository one root module at a time and requires a plan with no changes before any apply. It switches CI and wrapper scripts to the tofu binary with regenerated lock files, and only afterwards adopts OpenTofu-only features such as state encryption, warning not to enable them while some pipelines still run Terraform on the same state.
How does Codex handle infrastructure drift?
Infrastructure Drift runs refresh-only plans with detailed exit codes, turns the JSON plan into a per-attribute report with a bundled script, and traces each change in cloud audit logs before deciding to revert, adopt, import or ignore it. It also covers Pulumi, CloudFormation and Argo CD, and applies nothing without your approval.
How do I install all 11 Terraform and IaC skills at once?
Pass every name to the installer in one command: curl -fsSL https://codexskills.dev/install.sh | sh -s -- terraform-modules terraform-state opentofu pulumi-iac aws-cdk azure-bicep infrastructure-drift sst-apps waf-rules datadog-apm aws-sam. Add --project right after -- to put them in the current repository's .agents/skills/ so your team gets them too.
Which Terraform and IaC skill should I try first?
Terraform Modules is the closest fit for most Terraform and IaC work. Mention it with $terraform-modules in a prompt to load it on purpose; after that, Codex picks it up on its own whenever a task matches.