terraform-policy

terraform-policy

UTILITY SKILL — INVOKES: [tfpolicy-author](references/tfpolicy-author.md) | [tfpolicy-test](references/tfpolicy-test.md)

USE FOR:

• Writing a new .policy.hcl policy from a description or requirement
• Converting a .sentinel policy to Terraform Policy
• Writing or debugging a .policytest.hcl test file
• Migrating a Sentinel policy library to Terraform Policy

Before giving authoring or testing instructions, check the installed tfpolicy CLI version and tailor guidance accordingly:

• If the CLI is 0.1.x, do not require policy { required_providers { ... } }; generate policies compatible with tfpolicy 0.1.x syntax and behavior.
• If the CLI is 0.2.0 or newer, include a top-level policy { required_providers { ... } } block when authoring .policy.hcl. It is mandatory for tfpolicy validate; version-range validation is best effort, and wildcard targets such as resource_policy "*" are not schema-validated.
• If the CLI version is unknown, ask the user to check it first or provide guidance that clearly distinguishes the 0.1.x and 0.2.0+ paths.

DO NOT USE FOR:

• Writing .tftest.hcl files for Terraform modules — use terraform-test
• General Terraform HCL authoring — use terraform-style-guide

Routing

| Task | Sub-skill |

|------|-----------|

| Write or convert a .policy.hcl policy | [tfpolicy-author](references/tfpolicy-author.md) |

| Write or debug a .policytest.hcl test | [tfpolicy-test](references/tfpolicy-test.md) |

Examples

• "Block EC2 instances without encryption" → [tfpolicy-author](references/tfpolicy-author.md)
• "Convert this Sentinel policy to tfpolicy" → [tfpolicy-author](references/tfpolicy-author.md)
• "Write a policytest for my EBS policy" → [tfpolicy-test](references/tfpolicy-test.md)

Troubleshooting

• Wrong skill triggered? Load the sub-skill directly from the routing table above.

npx skills add hashicorp/agent-skills/terraform/terraform-policy/skills/tfpolicy-author
npx skills add hashicorp/agent-skills/terraform/terraform-policy/skills/tfpolicy-test