prompt
FreeTerraform & OpenTofu IaC specialist prompt with failure-mode routing and response contract.
FreeFree tier
About prompt
This is a specialized system prompt designed to transform an AI assistant into a Terraform and OpenTofu Infrastructure as Code (IaC) specialist. It enforces a strict response contract that includes version assumptions, risk categorization, remediation tradeoffs, validation plans, and rollback notes. The prompt routes every task through a failure-mode table covering identity churn, secret exposure, blast radius, CI drift, compliance gaps, state corruption, and provider upgrade risk. It emphasizes diagnosing before generating and treating infrastructure code as production software.
Key Features
Enforces a strict response contract: assumptions version floor, risk category, remediation tradeoffs, validation plan, rollback notes
Routes tasks through a failure-mode table: identity churn, secret exposure, blast radius, CI drift, compliance gaps, state corruption, provider upgrade risk
Diagnoses before generating infrastructure code
Includes validation plan tailored to runtime and risk tier
Provides rollback notes for destructive or state-mutating changes
Supports both Terraform and OpenTofu runtimes
Stresses version pinning, sensitive variables, and plan-review gates
Pros & Cons
Pros
- Reduces blast radius by enforcing environment separation and plan reviews
- Prevents secret exposure through sensitive variables and write-only arguments
- Promotes stable resource identity via for_each and moved blocks
- Includes explicit rollback instructions for destructive changes
- Encourages version pinning of providers and modules to prevent CI drift
Cons
- Limited to Terraform and OpenTofu; not applicable to other IaC tools
- Requires detailed context from the user to generate accurate responses
- Verbose output may be overkill for simple or read-only infrastructure tasks
- Assumes the user has familiarity with Terraform concepts and commands
Best For
Generating safe, production-ready Terraform/OpenTofu configurationsReviewing existing IaC for security and operational risksPlanning infrastructure changes with explicit rollback strategiesGuiding teams through IaC best practices and failure-mode preventionIntegrating into CI/CD pipelines as a code review co-pilot
FAQ
What is the response contract?
Every response must include: assumptions version floor (runtime, exact version, providers, state backend, execution path, environment criticality), risk category addressed, chosen remediation tradeoffs, a validation plan with specific commands, and rollback notes for destructive changes.
What failure modes does the prompt cover?
It covers identity churn, secret exposure, blast radius, CI drift, compliance gaps, state corruption/recovery, and provider upgrade risk.
Does the prompt support OpenTofu?
Yes, the prompt explicitly mentions both Terraform and OpenTofu runtimes.
What should I do if I need to make a destructive change?
The prompt requires rollback notes for any destructive or state-mutating change, including how to undo and what evidence to keep. Never apply directly to production without a reviewed plan artifact and approval.