# Infrastructure As Code

> Manages declarative infrastructure with plan/apply workflows, drift control, secrets hygiene and review. Use when defining or changing cloud or platform resources through IaC rather than click-ops or CI alone.

- **Type:** Skill
- **Install:** `agentstack add skill-mmccalla-coding-agent-skill-library-infrastructure-as-code`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [mmccalla](https://agentstack.voostack.com/s/mmccalla)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [mmccalla](https://github.com/mmccalla)
- **Source:** https://github.com/mmccalla/coding-agent-skill-library/tree/main/skills/infrastructure-as-code

## Install

```sh
agentstack add skill-mmccalla-coding-agent-skill-library-infrastructure-as-code
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Infrastructure as Code

## When to use

Use this skill when infrastructure must be defined, reviewed and applied as **declarative** code: compute, network, identity, data stores, platform baselines and shared services. Apply it to plan/apply (or equivalent preview/deploy) workflows, drift detection, module design, state management, secrets handling and peer review of infrastructure changes. Use it whenever click-ops would create untracked, non-reproducible environments.

## When not to use

- Do not use this skill only to design build and deploy pipelines — use `ci-cd-and-automation` for pipeline safety; IaC may be invoked from CI but remains a separate concern.
- Do not use it only for dependency and supply-chain controls — use `secure-sdlc-and-supply-chain` when that skill is available.
- Do not use it only to decide landing zone or tenancy topology — use `cloud-platform-architecture` for platform design, then implement with IaC.
- Do not use it only for progressive delivery of application releases — use `release-engineering-and-progressive-delivery`.

## Objective

Keep infrastructure reproducible, reviewable and least-privilege by expressing desired state declaratively, previewing changes with plan/apply discipline, controlling drift, protecting secrets and requiring review before privileged applies.

## Procedure

1. Express the desired infrastructure state in declarative code (for example Terraform, OpenTofu, Bicep, CloudFormation or Pulumi) under version control.
2. Separate configuration by environment and blast radius; avoid a single state file that couples unrelated systems when practical.
3. Run a plan (or preview) and review the exact create/update/destroy set before apply; treat unexpected destroys as stop-the-line events.
4. Apply only through an approved path (local with explicit approval, or CI with constrained credentials); record who applied what and when.
5. Manage secrets outside the repository: inject via a secrets manager or OIDC-federated roles; never commit credentials or long-lived keys in code or state that is broadly readable.
6. Detect and remediate drift: reconcile click-ops changes back into code or destroy unauthorised resources according to policy.
7. Require peer review for privileged modules (identity, network, production data stores) and pin provider/module versions intentionally.
8. Verify with the narrowest useful checks (plan in CI, policy-as-code, smoke tests) and state residual risk for any manual exception.

## Required outputs or templates

```markdown
# IaC change record

## Scope
- Resources / modules:
- Environments:
- State backend:

## Plan summary
- Creates:
- Updates:
- Destroys:
- Unexpected changes: none / 

## Secrets and identity
- Credentials path: OIDC / secrets manager / other
- No secrets in repo or world-readable state: yes / no

## Review
- Reviewer:
- Policy-as-code / checks:

## Apply
- Path: CI / approved local
- Drift notes:
- Residual risk:
```

## Rules

- Do not apply infrastructure changes without a reviewed plan when the change can destroy or expose resources.
- Do not commit secrets, private keys or unrestricted cloud credentials into IaC or state artefacts.
- Do not use CI/CD skill guidance alone as a substitute for declarative desired state and drift control.
- Do not leave production drift untracked after emergency click-ops; reconcile promptly.
- Do not grant apply roles broader than the modules being changed.
- Do not pin to floating `latest` providers or modules for production without an explicit risk acceptance.

## Related skills

- `ci-cd-and-automation`
- `secure-sdlc-and-supply-chain`
- `cloud-platform-architecture`
- `release-engineering-and-progressive-delivery`

## References

- [HashiCorp Terraform — Core workflow (plan/apply)](https://developer.hashicorp.com/terraform/intro/core-workflow)
- [OpenTofu documentation](https://opentofu.org/docs/)

## Verification

- [ ] Desired state is expressed declaratively in version control.
- [ ] Plan/apply (or equivalent) preview was reviewed before apply.
- [ ] Secrets are not stored in the repository.
- [ ] Drift handling is stated for any manual change.
- [ ] Review and least-privilege apply path are documented.
- [ ] Residual infrastructure risk is recorded.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [mmccalla](https://github.com/mmccalla)
- **Source:** [mmccalla/coding-agent-skill-library](https://github.com/mmccalla/coding-agent-skill-library)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-mmccalla-coding-agent-skill-library-infrastructure-as-code
- Seller: https://agentstack.voostack.com/s/mmccalla
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.