---
name: terraform-infrastructure-automation
description: Research, design, review, validate, and safely operate Terraform providers, modules, registries, state, plans, workspaces, variables, imports, refactors, HCP Terraform, and Terraform Enterprise. Use for infrastructure-as-code adoption, provider selection, module evaluation, drift review, plan analysis, workspace operations, and migration from manual infrastructure. Integrates with the official HashiCorp Terraform MCP where available.
compatibility: Terraform plan and registry research may run read-only. Apply, destroy, state mutation, workspace deletion, variable writes, imports, moves, and force-unlock require explicit authorization and protected state backups.
license: Apache-2.0
---

# Terraform infrastructure automation

Use Terraform to express reviewed desired state. The existence of a plan does not make its changes safe or authorized.

## Required workflow

1. Identify the target environment, account, project, workspace and state backend.
2. Inspect current configuration, provider locks, state lineage and drift.
3. Research providers and modules from authoritative registries and source repositories.
4. Pin compatible versions and review provider or module upgrade notes.
5. Run formatting, initialization without unexpected upgrades, validation and static checks.
6. Generate a saved plan against the intended workspace and variables.
7. Summarize creates, updates, replacements, deletes, sensitive values and unknown values.
8. Review blast radius, dependencies, quotas, cost and rollback.
9. Apply only with explicit approval and the exact reviewed plan artifact.
10. Re-run plan and service verification after apply.

## State safety

Never edit state manually as a first response. Before imports, moves, removes, force-unlock or backend migration, capture state metadata and a protected backup. Verify serial, lineage, workspace and backend before any state mutation.

## Module policy

Prefer small, composable modules with explicit inputs, outputs, provider requirements and upgrade policy. Avoid modules that hide broad IAM, networking or destructive behavior. Pin source and version; do not consume an unreviewed moving branch.

## MCP usage

Use the official HashiCorp Terraform MCP initially for registry, provider and module research. HCP Terraform or Terraform Enterprise workspace tools belong in compact read-only mode until every write tool is classified. Do not expose unrestricted apply or destroy through the persistent router.

## Plan review

Flag replacement of stateful resources, public exposure, IAM expansion, routing changes, database replacement, secret-value changes, backup removal, provider major upgrades and large count/for_each address churn.

## Output

Return workspace and state identifiers, provider/module sources and versions, validation results, concise plan summary, destructive or replacement actions, capability gate, saved plan identity, rollback or forward-fix strategy, post-apply verification and remaining drift.