Orqestria Download
← Back to Go desktop foundation team

Skill · Version 1.0.0

Infrastructure as code

Makes infrastructure changes reviewable through explicit plans, shared-state protection and environment-specific inputs.

infrastructure-as-code

Team members using this skill

See how it helps

When is it useful?

Use when provisioning changes must avoid accidental replacement of stateful resources.

What does it help you do?

  • Uses locked shared state and reviews planned resource changes.
  • Protects databases and other stateful targets from unintended deletion.
  • Reuses configuration across environments without hiding meaningful differences.

Try asking this

Review an infrastructure plan that replaces a database and propose a data-preserving alternative before applying it. Show which property forces replacement and what data it affects. Produce a revised plan preserving the database and require a separate decision for any unavoidable replacement.

Detailed documentation

Read the skill’s original instructions, examples and checks in their authored language.

Details…Show less

Infrastructure as Code

Manage infrastructure changes through versioned, reviewable declarations with remote state locking, mandatory plan review before apply, and strict separation between stateful data stores and stateless compute.

Plan-Before-Apply Workflow & State Discipline

  1. Remote state with locking:
    • Store Terraform / OpenTofu / Pulumi state in encrypted remote backends with state locking enabled (e.g., S3 + DynamoDB / native S3 lockfile, GCS, or Terraform Cloud) and never commit .tfstate or .tfstate.backup files (which contain plaintext secrets) to version control.
  2. Generate and inspect the execution plan on every change:
    • Run plan (terraform plan -out=tfplan, cdk diff, kubectl diff) on pull requests and review the exact resource diff (create, update in-place, destroy / replace) before any apply runs.
    • Treat any unplanned forces replacement (-/+) on a stateful resource (RDS/Cloud SQL database, persistent volume, S3 bucket, DNS zone, KMS key) as a critical blocker.
  3. Protect stateful resources against accidental deletion:
    • Set deletion_protection = true, lifecycle { prevent_destroy = true }, or RemovalPolicy.RETAIN on production databases, storage buckets, KMS encryption keys, and stateful volumes.
    • Isolate stateful foundational infrastructure (VPC, databases, KMS, DNS) in a separate state/stack from high-churn application deployment configs so a routine app config update cannot touch database state.

Environment Parity Without Copy-Paste Drift

  • Reuse parameterized modules or shared templates across staging and production:
    • Differentiate environments via small, explicit input variable files (envs/staging.tfvars, envs/prod.tfvars)—sizing, replica counts, and domain names—rather than maintaining diverging copy-pasted resource definitions.
  • Pin provider and module versions:
    • Commit .terraform.lock.hcl and pin provider/module versions (version = "~> 5.0") so an automated pipeline run never pulls a breaking major provider upgrade unexpectedly.
  • Detect and reconcile ClickOps drift:
    • Run scheduled or pre-release drift checks (plan -detailed-exitcode). When out-of-band manual changes are discovered in a live environment, import or codify them into IaC rather than overwriting them blindly.

Included files 1

  • SKILL.md