Agent skill
terraform-infrastructure
Terraform and GCP infrastructure patterns for gh-pr-linear-issue-linker. Use when creating/modifying Terraform, provisioning GCP resources, configuring IAM, Cloud Run, Artifact Registry, or working with infrastructure as code.
Install this agent skill to your Project
npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/other/other/terraform-infrastructure
SKILL.md
Terraform Infrastructure Patterns
Project Structure
infra/
├── main.tf # Primary resources (Cloud Run, Artifact Registry)
├── variables.tf # Input variables (project_id, region, etc.)
├── outputs.tf # Exported values (service_url, etc.)
├── secrets.tf # Secret Manager resources
├── iam.tf # IAM policies and service accounts
├── terraform.tfvars.example # Example configuration
└── terraform.tfvars # Actual secrets (gitignored)
Core Resources
Cloud Run Service
resource "google_cloud_run_service" "app" {
name = var.service_name
location = var.region
template {
spec {
containers {
image = var.image_url
env {
name = "GITHUB_APP_ID"
value_from {
secret_key_ref {
name = google_secret_manager_secret.github_app_id.secret_id
key = "latest"
}
}
}
}
service_account_name = google_service_account.app.email
}
}
}
Artifact Registry
resource "google_artifact_registry_repository" "app" {
location = var.region
repository_id = var.service_name
format = "DOCKER"
description = "Container images for ${var.service_name}"
}
Secret Manager
resource "google_secret_manager_secret" "github_app_id" {
secret_id = "${var.service_name}-github-app-id"
replication {
auto {}
}
}
resource "google_secret_manager_secret_version" "github_app_id" {
secret = google_secret_manager_secret.github_app_id.id
secret_data = var.github_app_id
}
IAM Patterns
Service Account (Least Privilege)
resource "google_service_account" "app" {
account_id = "${var.service_name}-sa"
display_name = "Service account for ${var.service_name}"
}
# Grant only necessary permissions
resource "google_secret_manager_secret_iam_member" "app_secrets" {
secret_id = google_secret_manager_secret.github_app_id.id
role = "roles/secretmanager.secretAccessor"
member = "serviceAccount:${google_service_account.app.email}"
}
Public Access (for GitHub webhooks)
resource "google_cloud_run_service_iam_member" "public" {
service = google_cloud_run_service.app.name
location = google_cloud_run_service.app.location
role = "roles/run.invoker"
member = "allUsers"
}
Cloud Build Integration
# Trigger build when Dockerfile changes
resource "null_resource" "build_image" {
triggers = {
dockerfile_hash = filemd5("${path.module}/../Dockerfile")
}
provisioner "local-exec" {
command = <<-EOT
gcloud builds submit ../. \
--config=cloudbuild.yaml \
--substitutions=_IMAGE_URL=${local.image_url}
EOT
}
}
Variable Patterns
# variables.tf
variable "project_id" {
description = "GCP project ID"
type = string
}
variable "region" {
description = "GCP region"
type = string
default = "us-central1"
}
variable "github_app_id" {
description = "GitHub App ID"
type = string
sensitive = true
}
Output Patterns
# outputs.tf
output "service_url" {
description = "Cloud Run service URL"
value = google_cloud_run_service.app.status[0].url
}
output "artifact_registry_url" {
description = "Artifact Registry repository URL"
value = "${var.region}-docker.pkg.dev/${var.project_id}/${google_artifact_registry_repository.app.repository_id}"
}
Commands
Initialize Terraform:
cd infra && terraform init
Plan changes:
cd infra && terraform plan
Apply changes:
cd infra && terraform apply
View outputs:
cd infra && terraform output
Destroy resources (careful!):
cd infra && terraform destroy
State Management
Backend configuration (use GCS for team):
terraform {
backend "gcs" {
bucket = "your-terraform-state-bucket"
prefix = "gh-pr-linear-issue-linker"
}
}
Local state (for personal projects):
- State stored in
infra/terraform.tfstate - Gitignored automatically
Best Practices
1. Never Commit Secrets
# terraform.tfvars is gitignored
# Use terraform.tfvars.example as template
cp infra/terraform.tfvars.example infra/terraform.tfvars
# Edit terraform.tfvars with actual secrets
2. Use Variables for Everything
# ❌ BAD - Hardcoded values
resource "google_cloud_run_service" "app" {
name = "gh-pr-linear-issue-linker"
location = "us-central1"
}
# ✅ GOOD - Use variables
resource "google_cloud_run_service" "app" {
name = var.service_name
location = var.region
}
3. Document Outputs
output "service_url" {
description = "Cloud Run service URL for GitHub webhook configuration"
value = google_cloud_run_service.app.status[0].url
}
4. Use Modules for Reusability
# For larger projects, extract common patterns
module "secrets" {
source = "./modules/secrets"
service_name = var.service_name
secrets = var.secrets
}
Common Resources Checklist
When setting up new infrastructure:
- Cloud Run service configured
- Artifact Registry repository created
- Secret Manager secrets defined
- Service account with least privilege
- IAM policies for secrets access
- Public access configured (if needed)
- Outputs defined for service URL
- Variables use
sensitive = truefor secrets - terraform.tfvars.example provided
- .gitignore includes terraform.tfvars
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
Didn't find tool you were looking for?