Terraform

Skill 16 of 20

Terraform Policy

Write, test, or convert Terraform Policy files (.policy.hcl, .policytest.hcl, Sentinel→tfpolicy).

1 minute · 185 words · 5 sections

Install

$ npx skills add hashicorp/agent-skills --skill terraform-policy

$ npx skills add hashicorp/agent-skills

» /plugin marketplace add hashicorp/agent-skills

The first command installs just this skill, by the name in its SKILL.md; the second installs the whole repository.

UTILITY SKILL — INVOKES: tfpolicy-author (opens in a new tab) | tfpolicy-test (opens in a new tab)

USE FOR:

Writing a new .policy.hcl policy from a description or requirement
Converting a .sentinel policy to Terraform Policy
Writing or debugging a .policytest.hcl test file
Migrating a Sentinel policy library to Terraform Policy

Before giving authoring or testing instructions, check the installed tfpolicy CLI version and tailor guidance accordingly:

If the CLI is 0.1.x, do not require policy { required_providers { ... } }; generate policies compatible with tfpolicy 0.1.x syntax and behavior.
If the CLI is 0.2.0 or newer, include a top-level policy { required_providers { ... } } block when authoring .policy.hcl. It is mandatory for tfpolicy validate; version-range validation is best effort, and wildcard targets such as resource_policy "*" are not schema-validated.
If the CLI version is unknown, ask the user to check it first or provide guidance that clearly distinguishes the 0.1.x and 0.2.0+ paths.

DO NOT USE FOR:

Writing .tftest.hcl files for Terraform modules — use terraform-test
General Terraform HCL authoring — use terraform-style-guide

Routing

Task	Sub-skill
Write or convert a `.policy.hcl` policy	tfpolicy-author (opens in a new tab)
Write or debug a `.policytest.hcl` test	tfpolicy-test (opens in a new tab)

Examples

“Block EC2 instances without encryption” → tfpolicy-author (opens in a new tab)
“Convert this Sentinel policy to tfpolicy” → tfpolicy-author (opens in a new tab)
“Write a policytest for my EBS policy” → tfpolicy-test (opens in a new tab)

Troubleshooting

Wrong skill triggered? Load the sub-skill directly from the routing table above.

npx skills add hashicorp/agent-skills/terraform/terraform-policy/skills/tfpolicy-author
npx skills add hashicorp/agent-skills/terraform/terraform-policy/skills/tfpolicy-test

About this skill

Trigger

Write, test, or convert Terraform Policy files (.policy.hcl, .policytest.hcl, Sentinel→tfpolicy). Triggers: policy.hcl, policytest, convert sentinel, tfpolicy, write a policy.

The verbatim description from this skill’s front matter — the string an agent matches on to decide whether to load it.

Licence: MPL-2.0
Source: plugins/terraform/skills/terraform-policy/SKILL.md

Colophon for this issue

Colophon

How this issue was made

Source

github.com/hashicorp/agent-skills, branch main, last pushed 21 September 2026.

Licence

MPL-2.0 — the text of every skill is reproduced unmodified, frontmatter included, under the upstream licence.

Discovery

20 skills found by walking the repository tree for SKILL.md, not by matching a directory convention. 2 distinct layouts observed: plugins/packer/skills/*/SKILL.md, plugins/terraform/skills/*/SKILL.md.

Issue colours

Resolved from the awesome-design-md registry — hue 304°, chroma 0.190. Two accent tones are generated per issue and each is proven against its own ground before it ships: a single accent that passes AA on both light and dark paper is arithmetically impossible.

Typefaces

Display: hashicorpSans is not a face we ship; the reader's own choice is used.
Body: hashicorpSans is not a face we ship; the reader's own choice is used.

We never load a typeface at request time from a third-party origin, so a brand face we do not already self-host is substituted rather than fetched.

Heading repairs

1 repair applied to this skill so the document has one h1 and no skipped levels:

Removed “terraform-policy”, a leading h1 that duplicated the skill title.

Spec compliance

Every skill satisfies the Agent Skills specification’s frontmatter rules.

Images

Images inside a skill come from the upstream repository. Where the author gave no alternative text we mark the image decorative rather than inventing a description — a plausible caption we made up is worse than none for the reader who depends on it.

Marketplace

A plugin manifest is published at .claude-plugin/marketplace.json by HashiCorp, declaring 2 plugins. It is read for editorial metadata only — never as the skill index, which is always the repository tree.

Signal

Install counts come from skills.sh. They measure downloads, not quality, and an unranked repository is not an unread one.

Agent surfaces

The whole issue is available as one markdown document at /hashicorp/agent-skills.md, and each skill at its own .md URL.

Publication

Set by Skills Docs from the source repository. Body text is Literata at the reader’s chosen size and measure; code is Geist Mono. Nothing on this page was written by us except this paragraph.

UTILITY SKILL — INVOKES: tfpolicy-author (opens in a new tab) | tfpolicy-test (opens in a new tab)

USE FOR:

Writing a new .policy.hcl policy from a description or requirement
Converting a .sentinel policy to Terraform Policy
Writing or debugging a .policytest.hcl test file
Migrating a Sentinel policy library to Terraform Policy

Before giving authoring or testing instructions, check the installed tfpolicy CLI version and tailor guidance accordingly:

If the CLI is 0.1.x, do not require policy { required_providers { ... } }; generate policies compatible with tfpolicy 0.1.x syntax and behavior.
If the CLI is 0.2.0 or newer, include a top-level policy { required_providers { ... } } block when authoring .policy.hcl. It is mandatory for tfpolicy validate; version-range validation is best effort, and wildcard targets such as resource_policy "*" are not schema-validated.
If the CLI version is unknown, ask the user to check it first or provide guidance that clearly distinguishes the 0.1.x and 0.2.0+ paths.

DO NOT USE FOR:

Writing .tftest.hcl files for Terraform modules — use terraform-test
General Terraform HCL authoring — use terraform-style-guide

Routing

Task	Sub-skill
Write or convert a `.policy.hcl` policy	tfpolicy-author (opens in a new tab)
Write or debug a `.policytest.hcl` test	tfpolicy-test (opens in a new tab)

Examples

“Block EC2 instances without encryption” → tfpolicy-author (opens in a new tab)
“Convert this Sentinel policy to tfpolicy” → tfpolicy-author (opens in a new tab)
“Write a policytest for my EBS policy” → tfpolicy-test (opens in a new tab)

Troubleshooting

Wrong skill triggered? Load the sub-skill directly from the routing table above.

npx skills add hashicorp/agent-skills/terraform/terraform-policy/skills/tfpolicy-author
npx skills add hashicorp/agent-skills/terraform/terraform-policy/skills/tfpolicy-test

Terraform Policy

USE FOR:

DO NOT USE FOR:

Routing

Examples

Troubleshooting

About this skill

Trigger

Colophon

Terraform Policy

USE FOR:

DO NOT USE FOR:

Routing

Examples

Troubleshooting

Appendix 16.1–16.38

ReferencesMarkdown · 3 files

Also bundled51 files

About this skill

Trigger

Colophon

Appendix 16.1–16.38

ReferencesMarkdown · 3 files

Also bundled51 files