StealIt
HashiCorp OfficialClaude skill for DevOps

Terraform Policy

terraform-policy

Write, test, or convert Terraform Policy files (.policy.hcl, .policytest.hcl, Sentinel→tfpolicy). Triggers: policy.hcl, policytest, convert sentinel, tfpolicy, write a policy.

Install

Run this in your project folder. It works with Claude Code, Cursor, Codex and dozens of other agents.

$ npx skills add hashicorp/agent-skills --skill terraform-policy

Needs Node.js. Add -g to install for every project, or -a claude-code to skip the agent picker.

How to use Terraform Policy

Once it's installed, Claude reads this skill on its own whenever a request matches what it's for, so you don't have to mention it by name. In Claude Code you can also run it directly by typing /terraform-policy.

It contains no scripts, only instructions and reference files, so it can't run code on its own.

What the instructions cover

  1. 1USE FOR:
  2. 2DO NOT USE FOR:
  3. 3Routing
  4. 4Examples
  5. 5Troubleshooting

Section headings from the skill's SKILL.md file.

What's inside · 55 files

  • .gitignore
  • README.md
  • SKILL.md
  • examples/README.md
  • examples/conversion/cloudfront-associated-with-waf/README.md
  • examples/conversion/cloudfront-associated-with-waf/cloudfront-associated-with-waf.policy.hcl
  • examples/conversion/cloudfront-associated-with-waf/cloudfront-associated-with-waf.sentinel
  • examples/conversion/cloudtrail-server-side-encryption-enabled/README.md
  • examples/conversion/cloudtrail-server-side-encryption-enabled/cloudtrail-server-side-encryption-enabled.policy.hcl
  • examples/conversion/cloudtrail-server-side-encryption-enabled/cloudtrail-server-side-encryption-enabled.sentinel
  • examples/conversion/dms-endpoint-should-be-ssl-configured/README.md
  • examples/conversion/dms-endpoint-should-be-ssl-configured/dms-endpoint-should-be-ssl-configured.policy.hcl
  • examples/conversion/dms-endpoint-should-be-ssl-configured/dms-endpoint-should-be-ssl-configured.sentinel
  • examples/conversion/dms-endpoints-should-use-ssl/README.md
  • examples/conversion/dms-endpoints-should-use-ssl/dms-endpoints-should-use-ssl.policy.hcl
  • examples/conversion/dms-endpoints-should-use-ssl/dms-endpoints-should-use-ssl.sentinel
  • examples/conversion/ec2-network-acl-should-have-subnet-ids/README.md
  • examples/conversion/ec2-network-acl-should-have-subnet-ids/ec2-network-acl-should-have-subnet-ids.policy.hcl
  • examples/conversion/ec2-network-acl-should-have-subnet-ids/ec2-network-acl-should-have-subnet-ids.sentinel
  • examples/conversion/ec2-vpc-default-security-group-no-traffic/README.md
  • examples/conversion/ec2-vpc-default-security-group-no-traffic/ec2-vpc-default-security-group-no-traffic.policy.hcl
  • examples/conversion/ec2-vpc-default-security-group-no-traffic/ec2-vpc-default-security-group-no-traffic.sentinel
  • examples/conversion/efs-access-point-should-enforce-user-identity/README.md
  • examples/conversion/efs-access-point-should-enforce-user-identity/efs-access-point-should-enforce-user-identity.policy.hcl
  • examples/conversion/efs-access-point-should-enforce-user-identity/efs-access-point-should-enforce-user-identity.sentinel
  • examples/conversion/elasticache-redis-replication-group-encryption-at-transit-enabled/README.md
  • examples/conversion/elasticache-redis-replication-group-encryption-at-transit-enabled/elasticache-redis-replication-group-encryption-at-transit-enabled.policy.hcl
  • examples/conversion/elasticache-redis-replication-group-encryption-at-transit-enabled/elasticache-redis-replication-group-encryption-at-transit-enabled.sentinel
  • examples/conversion/elasticsearch-encrypted-at-rest/README.md
  • examples/conversion/elasticsearch-encrypted-at-rest/elasticsearch-encrypted-at-rest.policy.hcl
  • examples/conversion/elasticsearch-encrypted-at-rest/elasticsearch-encrypted-at-rest.sentinel
  • examples/conversion/elasticsearch-https-required/README.md
  • examples/conversion/elasticsearch-https-required/elasticsearch-https-required.policy.hcl
  • examples/conversion/elasticsearch-https-required/elasticsearch-https-required.sentinel
  • examples/conversion/elasticsearch-in-vpc-only/README.md
  • examples/conversion/elasticsearch-in-vpc-only/elasticsearch-in-vpc-only.policy.hcl
  • examples/conversion/elasticsearch-in-vpc-only/elasticsearch-in-vpc-only.sentinel
  • examples/conversion/eventbridge-custom-event-bus-should-have-attached-policy/README.md
  • examples/conversion/eventbridge-custom-event-bus-should-have-attached-policy/eventbridge-custom-event-bus-should-have-attached-policy.policy.hcl
  • examples/conversion/eventbridge-custom-event-bus-should-have-attached-policy/eventbridge-custom-event-bus-should-have-attached-policy.sentinel
  • + 15 more files on GitHub →

More from HashiCorp

See all →

AWS Ami Builder

Build Amazon Machine Images (AMIs) with Packer using the amazon-ebs builder. Use when creating custom AMIs for EC2 instances.

Cloud & DevOpsHashiCorp913

Azure Image Builder

Build Azure managed images and Azure Compute Gallery images with Packer. Use when creating custom images for Azure VMs.

Cloud & DevOpsHashiCorp913

Azure Verified Modules

Azure Verified Modules (AVM) requirements and best practices for developing certified Azure Terraform modules. Use when creating or reviewing Azure modules that need AVM…

Cloud & DevOpsHashiCorp913

New Terraform Provider

Use this when scaffolding a new Terraform provider with the Plugin Framework: workspace layout, go module setup, provider server main.go, and a provider.go with schema and…

Cloud & DevOpsHashiCorp913

More Claude skills for DevOps

See all →

Deploy To Vercel

Deploy applications and websites to Vercel. Use when the user requests deployment actions like "deploy my app", "deploy and give me the link", "push this live", or "create a…

Cloud & DevOpsVercel34k

Vercel CLI With Tokens

Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. "deploy to…

Cloud & DevOpsVercel34k

Vercel Optimize

Use for Vercel cost and performance optimization on deployed projects, especially Next.js, SvelteKit, Nuxt, and limited Astro apps. Collect Vercel metrics, usage, project config…

Cloud & DevOpsVercel34k

Connectivity Triage

Use this skill when debugging active macOS connectivity failures, when an API or MCP service times out or disconnects, when DNS resolution is failing or inconsistent, or when…

Cloud & DevOpsSeth Hobson42k