Agent Native

terraform-policy

This skill helps write, test, and convert Terraform Policy files in .policy.hcl and .policytest.hcl formats, and convert Sentinel policies to Terraform Policy…

by HashiCorpOfficial publisherNot reviewed

Identity proven by GitHub's verified organisation badge (hashicorp)

Agents
Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode, claude.ai and API
License
MPL-2.0 (copyleft)
Pin
f706481pinned Oct 9, 2026
Context cost
about 920 tokenswhen the skill loads
GitHub stars
890on hashicorp/agent-skills
Scripts
None found

What it does

“Write, test, or convert Terraform Policy files (.policy.hcl, .policytest.hcl, Sentinel→tfpolicy). Triggers: policy.hcl, policytest, convert sentinel, tfpolicy, write a policy.”
The author's description, from SKILL.md

Generated summary from the skill's own text

This skill helps write, test, and convert Terraform Policy files in .policy.hcl and .policytest.hcl formats, and convert Sentinel policies to Terraform Policy syntax. It routes authoring tasks to tfpolicy-author and testing tasks to tfpolicy-test, adjusting guidance based on the installed tfpolicy CLI version.

When to use it

  • Creating a new .policy.hcl policy from requirements or descriptions
  • Converting existing Sentinel policies to Terraform Policy format
  • Writing or debugging .policytest.hcl test files for policies
  • Migrating a Sentinel policy library to Terraform Policy

When not to

  • Writing .tftest.hcl files for Terraform modules, use terraform-test instead
  • General Terraform HCL authoring, use terraform-style-guide instead

Install

These commands install from the publisher's repository and need no account.

skills CLI

npx skills add hashicorp/agent-skills --skill terraform-policy

Installs from the repository's default branch, which may have changed since the commit we checked.

GitHub CLI 2.90 or later

gh skill install hashicorp/agent-skills terraform-policy@f706481af9b8fedb66de909f6243ad29601afa0c

Installs the commit we checked (f706481).

Copy by hand

Download the folder at f706481 and put it in .claude/skills/terraform-policy for Claude Code and in .agents/skills/terraform-policy for Codex, Cursor, Gemini CLI, GitHub Copilot and OpenCode.

Skill folder on GitHub at f706481

Copy for your agent

A prompt for any coding agent. It installs this skill from GitHub at the pinned commit, copies the files as they are, and runs nothing unless you ask.

Prompt

Install the agent skill "terraform-policy" by HashiCorp.

Source, pinned to commit f706481af9b8fedb66de909f6243ad29601afa0c:
https://github.com/hashicorp/agent-skills/tree/f706481af9b8fedb66de909f6243ad29601afa0c/plugins/terraform/skills/terraform-policy

1. Download that folder at exactly this commit. Do not use the default branch.
2. Copy every file unchanged, keeping the folder structure, into .claude/skills/terraform-policy/ for Claude Code and .agents/skills/terraform-policy/ for Codex, Cursor, Gemini CLI, GitHub Copilot and OpenCode. Create the folders if they do not exist.
3. Do not edit the files, and do not run any script in the folder unless I ask you to.
4. When you are done, list the files you copied and where you put them.

Listing and checks: https://www.agentnative.dev/skills/hashicorp/terraform-policy

SKILL.md at the pin

---
name: terraform-policy
description: "Write, test, or convert Terraform Policy files (.policy.hcl, .policytest.hcl, Sentinel→tfpolicy). Triggers: policy.hcl, policytest, convert sentinel, tfpolicy, write a policy."
license: MPL-2.0
metadata:
  lifecycle-status: active
  copyright: Copyright IBM Corp. 2026
  version: "0.1.0"
---

# terraform-policy

**UTILITY SKILL** — INVOKES: [tfpolicy-author](references/tfpolicy-author.md) | [tfpolicy-test](references/tfpolicy-test.md)

## USE FOR:

- Writing a new `.policy.hcl` policy from a description or requirement
- Converting a `.sentinel` policy to Terraform Policy
- Writing or debugging a `.policytest.hcl` test file
- Migrating a Sentinel policy library to Terraform Policy

Before giving authoring or testing instructions, check the installed `tfpolicy` CLI version and tailor guidance accordingly. This skill maintains guidance for the two most recent minor lines, `0.2.x` and `0.3.x`; when a new minor ships, drop the oldest line and add the new one.
- If the CLI is `0.2.x` (baseline), include a top-level `policy { required_providers { ... } }` block when authoring `.policy.hcl` files containing resource or provider policies. It is mandatory for `tfpolicy validate`; version-range validation is best effort, and wildcard targets such as `resource_policy "*"` are not schema-validated. `tfpolicy test` does not preflight mocked `attrs`/`prior_attrs` against provider schemas, `core::alltrue`/`core::anytrue` do not exist, and, only in this `0.2.x` line, mock `resource {}` blocks may omit `attrs`/`prior_attrs` entirely.
- If the CLI is `0.3.x` or newer, the other guidance above still applies, but the `0.2.x` allowance for omitting resource state does not: every mock `resource {}` block in `.policytest.hcl` files must declare `attrs` or `prior_attrs`; if both evaluate to empty, the test case is skipped (`provider {}` and `module {}` mocks are unaffected) (see [tfpolicy-test](references/tfpolicy-test.md#every-resource--mock-must-declare-a-non-empty-state-block-tfpolicy-030)). `tfpolicy test` reuses the target `.policy.hcl`'s existing top-level `policy { required_providers { ... } }` block (there is no separate `.policytest.hcl`-level declaration) to validate provider, resource, and data-source policies and `core::getdatasource()`/`core::getresources()` arguments against resolved provider schemas before any test runs, failing the whole run on a schema mismatch (see [tfpolicy-test](references/tfpolicy-test.md#test-execution-behavior)). `core::alltrue(list)` and `core::anytrue(list)` are also available — prefer them over the `core::length()` list-comprehension workaround (see [tfpolicy-author](references/tfpolicy-author.md#core-functions--common-idioms)). `meta.tfe_stack` and `meta.tfe_workspace.tags` are available to resource, provider, and module policies; Stack fields are empty outside Stack evaluations.
- If the CLI version is unknown, ask the user to check it first or provide guidance that clearly distinguishes the `0.2.x` and `0.3.x` paths.

## DO NOT USE FOR:

- Writing `.tftest.hcl` files for Terraform modules — use `terraform-test`
- General Terraform HCL authoring — use `terraform-style-guide`

## Routing

| Task | Sub-skill |
|------|-----------|
| Write or convert a `.policy.hcl` policy | [tfpolicy-author](references/tfpolicy-author.md) |
| Write or debug a `.policytest.hcl` test | [tfpolicy-test](references/tfpolicy-test.md) |

## Examples

- "Block EC2 instances without encryption" → [tfpolicy-author](references/tfpolicy-author.md)
- "Convert this Sentinel policy to tfpolicy" → [tfpolicy-author](references/tfpolicy-author.md)
- "Write a policytest for my EBS policy" → [tfpolicy-test](references/tfpolicy-test.md)

## Troubleshooting

- **Wrong skill triggered?** Load the sub-skill directly from the routing table above.

```bash
npx skills add hashicorp/agent-skills/terraform/terraform-policy/skills/tfpolicy-author
npx skills add hashicorp/agent-skills/terraform/terraform-policy/skills/tfpolicy-test
```

From hashicorp/agent-skills at f706481, shown as plain text under its license: MPL-2.0 (copyleft). The license text is in plugins/terraform/skills/terraform-policy/SKILL.md.

View SKILL.md on GitHub at f706481

Files

55 files, 318 KB in total. Each file has a sha256 in the pin's manifest; the first 12 characters are shown.

Skill folder on GitHub at f706481
All 19 skills from HashiCorp

More from HashiCorp

  • aws-ami-builder

    This skill enables the agent to build custom Amazon Machine Images using Packer's amazon-ebs builder.

    Claude Code, Codex, Cursor +4 · about 870 tokens · pinned 6 days ago

  • azure-image-builder

    This skill uses Packer's Azure ARM builder to create custom managed images and Compute Gallery images in Azure.

    Claude Code, Codex, Cursor +4 · about 1K tokens · pinned 6 days ago

  • azure-verified-modules

    This skill provides comprehensive requirements and best practices for developing Azure Terraform modules that meet Azure Verified Modules (AVM) certification…

    Claude Code, Codex, Cursor +4 · about 4K tokens · pinned 6 days ago

  • new-terraform-provider

    Scaffolds a new Terraform provider using the Plugin Framework by creating workspace structure, initializing a Go module, and generating main.go and…

    Contains scripts

    Claude Code, Codex, Cursor +3 · about 330 tokens · pinned 6 days ago

  • provider-actions

    This skill guides implementing Terraform Actions, imperative operations that execute at provider lifecycle events using the Plugin Framework.

    Claude Code, Codex, Cursor +4 · about 4.2K tokens · pinned 6 days ago

  • provider-configuration

    This skill guides implementing Terraform provider authentication using the Plugin Framework, covering provider schema design, credential provider chains that…

    Claude Code, Codex, Cursor +4 · about 3.3K tokens · pinned 6 days ago

All Cloud and DevOps skills

Related in Cloud and DevOps

  • google-agents-cli-deploy

    Deploys agents built with agents-cli to Agent Runtime, Cloud Run, or GKE using a tested CLI pipeline.

    by GoogleOfficial publisher

    Claude Code, Codex, Cursor +4 · about 7.4K tokens · pinned 6 days ago

  • azure-to-aws

    This skill guides agents through migrating Azure workloads to AWS across six phases: discovering Azure resources from Terraform, live CLI, app code, and…

    by Amazon (AWS)Official publisher

    Contains scripts

    Claude Code, Codex, Cursor +3 · about 4.3K tokens · pinned 6 days ago

  • gcp-to-aws

    Migrates workloads from Google Cloud Platform to AWS, including AI and agentic applications from any provider.

    by Amazon (AWS)Official publisher

    Contains scripts

    Claude Code, Codex, Cursor +3 · about 14.3K tokens · pinned 6 days ago

  • heroku-to-aws

    This skill guides migration of applications and databases from Heroku to AWS services like Elastic Beanstalk, RDS, ElastiCache, and MSK.

    by Amazon (AWS)Official publisher

    Contains scripts

    Claude Code, Codex, Cursor +3 · about 7K tokens · pinned 6 days ago

  • tf-best-practices

    This skill provides authoring rules for generating secure AWS Terraform and runs a read-only policy gate to verify generated code against those rules.

    by Amazon (AWS)Official publisher

    Contains scripts

    Claude Code, Codex, Cursor +3 · about 3K tokens · pinned 6 days ago

  • provider-ephemeral-resources

    Implement Terraform ephemeral resources using the Plugin Framework to handle sensitive values like tokens and credentials that must never be written to state…

    by HashiCorpOfficial publisher

    Claude Code, Codex, Cursor +4 · about 2.1K tokens · pinned 6 days ago

The skills listed here are third-party software, collected from public GitHub repositories as a catalog of recent skills and provided as is. Agent Native does not write or control them and is not responsible for any harm, loss or damage caused by installing or using them. Labels and checks describe what we saw at one commit and are not a guarantee. Read a skill's files before you run it. Terms of use