/terraform-policy

name: terraform-policy
description: "Write, test, or convert Terraform Policy files (.policy.hcl, .policytest.hcl, Sentinel→tfpolicy). Triggers: policy.hcl, policytest, convert sentinel, tfpolicy, write a policy."
license: MPL-2.0
metadata:
  lifecycle-status: active
  copyright: Copyright IBM Corp. 2026
  version: "0.1.0"

terraform-policy

**UTILITY SKILL** — INVOKES: [tfpolicy-author](references/tfpolicy-author.md) | [tfpolicy-test](references/tfpolicy-test.md)

USE FOR:

• Writing a new `.policy.hcl` policy from a description or requirement
• Converting a `.sentinel` policy to Terraform Policy
• Writing or debugging a `.policytest.hcl` test file
• Migrating a Sentinel policy library to Terraform Policy

Before giving authoring or testing instructions, check the installed `tfpolicy` CLI version and tailor guidance accordingly:

• If the CLI is `0.1.x`, do **not** require `policy { required_providers { ... } }`; generate policies compatible with tfpolicy 0.1.x syntax and behavior.
• If the CLI is `0.2.0` or newer, include a top-level `policy { required_providers { ... } }` block when authoring `.policy.hcl`. It is mandatory for `tfpolicy validate`; version-range validation is best effort, and wildcard targets such as `resource_policy "*"` are not schema-validated.
• If the CLI version is unknown, ask the user to check it first or provide guidance that clearly distinguishes the `0.1.x` and `0.2.0+` paths.

DO NOT USE FOR:

• Writing `.tftest.hcl` files for Terraform modules — use `terraform-test`
• General Terraform HCL authoring — use `terraform-style-guide`

Routing

| Task | Sub-skill | |------|-----------| | Write or convert a `.policy.hcl` policy | [tfpolicy-author](references/tfpolicy-author.md) | | Write or debug a `.policytest.hcl` test | [tfpolicy-test](references/tfpolicy-test.md) |

Examples

• "Block EC2 instances without encryption" → [tfpolicy-author](references/tfpolicy-author.md)
• "Convert this Sentinel policy to tfpolicy" → [tfpolicy-author](references/tfpolicy-author.md)
• "Write a policytest for my EBS policy" → [tfpolicy-test](references/tfpolicy-test.md)

Troubleshooting

• **Wrong skill triggered?** Load the sub-skill directly from the routing table above.

npx skills add hashicorp/agent-skills/terraform/terraform-policy/skills/tfpolicy-author
npx skills add hashicorp/agent-skills/terraform/terraform-policy/skills/tfpolicy-test