Login
hashicorp/agent-skillsMPL-2.055 files

Terraform Policy

Write, test, or convert Terraform Policy files (.policy.hcl, .policytest.hcl, Sentinel→tfpolicy). Triggers: policy.hcl, policytest, convert sentinel, tfpolicy, write a policy.

Use this skillView repositoryView on skills.sh
Specification
Skill ID
hashicorp/agent-skills/terraform-policy
Publisher
hashicorp
Repository
agent-skills
Installs
0
Files
55
License
MPL-2.0
Synced
Sep 23, 2026
How to use it

Open any RiverX project, open the Skills panel in the chat, and search for this identifier. The files are fetched from the source repository at install time.

hashicorp/agent-skills/terraform-policyInstalls these files
  • .gitignore
  • README.md
  • SKILL.md
  • examples/README.md
  • examples/conversion/cloudfront-associated-with-waf/README.md
  • examples/conversion/cloudfront-associated-with-waf/cloudfront-associated-with-waf.policy.hcl
  • examples/conversion/cloudfront-associated-with-waf/cloudfront-associated-with-waf.sentinel
  • examples/conversion/cloudtrail-server-side-encryption-enabled/README.md
  • examples/conversion/cloudtrail-server-side-encryption-enabled/cloudtrail-server-side-encryption-enabled.policy.hcl
  • examples/conversion/cloudtrail-server-side-encryption-enabled/cloudtrail-server-side-encryption-enabled.sentinel
  • examples/conversion/dms-endpoint-should-be-ssl-configured/README.md
  • examples/conversion/dms-endpoint-should-be-ssl-configured/dms-endpoint-should-be-ssl-configured.policy.hcl
  • examples/conversion/dms-endpoint-should-be-ssl-configured/dms-endpoint-should-be-ssl-configured.sentinel
  • examples/conversion/dms-endpoints-should-use-ssl/README.md
  • examples/conversion/dms-endpoints-should-use-ssl/dms-endpoints-should-use-ssl.policy.hcl
  • examples/conversion/dms-endpoints-should-use-ssl/dms-endpoints-should-use-ssl.sentinel
  • examples/conversion/ec2-network-acl-should-have-subnet-ids/README.md
  • examples/conversion/ec2-network-acl-should-have-subnet-ids/ec2-network-acl-should-have-subnet-ids.policy.hcl
  • examples/conversion/ec2-network-acl-should-have-subnet-ids/ec2-network-acl-should-have-subnet-ids.sentinel
  • examples/conversion/ec2-vpc-default-security-group-no-traffic/README.md
  • examples/conversion/ec2-vpc-default-security-group-no-traffic/ec2-vpc-default-security-group-no-traffic.policy.hcl
  • examples/conversion/ec2-vpc-default-security-group-no-traffic/ec2-vpc-default-security-group-no-traffic.sentinel
  • examples/conversion/efs-access-point-should-enforce-user-identity/README.md
  • examples/conversion/efs-access-point-should-enforce-user-identity/efs-access-point-should-enforce-user-identity.policy.hcl
  • examples/conversion/efs-access-point-should-enforce-user-identity/efs-access-point-should-enforce-user-identity.sentinel
  • examples/conversion/elasticache-redis-replication-group-encryption-at-transit-enabled/README.md
  • examples/conversion/elasticache-redis-replication-group-encryption-at-transit-enabled/elasticache-redis-replication-group-encryption-at-transit-enabled.policy.hcl
  • examples/conversion/elasticache-redis-replication-group-encryption-at-transit-enabled/elasticache-redis-replication-group-encryption-at-transit-enabled.sentinel
  • examples/conversion/elasticsearch-encrypted-at-rest/README.md
  • examples/conversion/elasticsearch-encrypted-at-rest/elasticsearch-encrypted-at-rest.policy.hcl
  • examples/conversion/elasticsearch-encrypted-at-rest/elasticsearch-encrypted-at-rest.sentinel
  • examples/conversion/elasticsearch-https-required/README.md
  • examples/conversion/elasticsearch-https-required/elasticsearch-https-required.policy.hcl
  • examples/conversion/elasticsearch-https-required/elasticsearch-https-required.sentinel
  • examples/conversion/elasticsearch-in-vpc-only/README.md
  • examples/conversion/elasticsearch-in-vpc-only/elasticsearch-in-vpc-only.policy.hcl
  • examples/conversion/elasticsearch-in-vpc-only/elasticsearch-in-vpc-only.sentinel
  • examples/conversion/eventbridge-custom-event-bus-should-have-attached-policy/README.md
  • examples/conversion/eventbridge-custom-event-bus-should-have-attached-policy/eventbridge-custom-event-bus-should-have-attached-policy.policy.hcl
  • examples/conversion/eventbridge-custom-event-bus-should-have-attached-policy/eventbridge-custom-event-bus-should-have-attached-policy.sentinel
  • examples/conversion/s3-block-public-access-bucket-level/README.md
  • examples/conversion/s3-block-public-access-bucket-level/s3-block-public-access-bucket-level.policy.hcl
  • examples/conversion/s3-block-public-access-bucket-level/s3-block-public-access-bucket-level.sentinel
  • examples/conversion/s3-bucket-should-have-object-lock-enabled/README.md
  • examples/conversion/s3-bucket-should-have-object-lock-enabled/s3-bucket-should-have-object-lock-enabled.policy.hcl
  • examples/conversion/s3-bucket-should-have-object-lock-enabled/s3-bucket-should-have-object-lock-enabled.sentinel
  • examples/conversion/secretsmanager-auto-rotation-enabled-check/README.md
  • examples/conversion/secretsmanager-auto-rotation-enabled-check/secretsmanager-auto-rotation-enabled-check.policy.hcl
  • examples/conversion/secretsmanager-auto-rotation-enabled-check/secretsmanager-auto-rotation-enabled-check.sentinel
  • examples/conversion/step-functions-state-machine-logging-enabled/README.md
  • examples/conversion/step-functions-state-machine-logging-enabled/step-functions-state-machine-logging-enabled.policy.hcl
  • examples/conversion/step-functions-state-machine-logging-enabled/step-functions-state-machine-logging-enabled.sentinel
  • references/tfpolicy-author.md
  • references/tfpolicy-test.md
  • references/verified-syntax.md

What this skill tells the agent

terraform-policy

UTILITY SKILL — INVOKES: tfpolicy-author | tfpolicy-test

USE FOR:

  • Writing a new .policy.hcl policy from a description or requirement
  • Converting a .sentinel policy to Terraform Policy
  • Writing or debugging a .policytest.hcl test file
  • Migrating a Sentinel policy library to Terraform Policy

Before giving authoring or testing instructions, check the installed tfpolicy CLI version and tailor guidance accordingly:

  • If the CLI is 0.1.x, do not require policy { required_providers { ... } }; generate policies compatible with tfpolicy 0.1.x syntax and behavior.
  • If the CLI is 0.2.0 or newer, include a top-level policy { required_providers { ... } } block when authoring .policy.hcl. It is mandatory for tfpolicy validate; version-range validation is best effort, and wildcard targets such as resource_policy "*" are not schema-validated.
  • If the CLI version is unknown, ask the user to check it first or provide guidance that clearly distinguishes the 0.1.x and 0.2.0+ paths.

DO NOT USE FOR:

  • Writing .tftest.hcl files for Terraform modules — use terraform-test
  • General Terraform HCL authoring — use terraform-style-guide

Routing

TaskSub-skill
Write or convert a .policy.hcl policytfpolicy-author
Write or debug a .policytest.hcl testtfpolicy-test

Examples

  • "Block EC2 instances without encryption" → tfpolicy-author
  • "Convert this Sentinel policy to tfpolicy" → tfpolicy-author
  • "Write a policytest for my EBS policy" → tfpolicy-test

Troubleshooting

  • Wrong skill triggered? Load the sub-skill directly from the routing table above.
npx skills add hashicorp/agent-skills/terraform/terraform-policy/skills/tfpolicy-author
npx skills add hashicorp/agent-skills/terraform/terraform-policy/skills/tfpolicy-test

More from hashicorp

hashicorp/agent-skills

Aws Ami Builder

Build Amazon Machine Images (AMIs) with Packer using the amazon-ebs builder. Use when creating custom AMIs for EC2 instances.

hashicorp/agent-skills

Azure Image Builder

Build Azure managed images and Azure Compute Gallery images with Packer. Use when creating custom images for Azure VMs.

hashicorp/agent-skills

Azure Verified Modules

Azure Verified Modules (AVM) requirements and best practices for developing certified Azure Terraform modules. Use when creating or reviewing Azure modules that need AVM certification.

Use this skill in a project

Open any RiverX project, search the Skills panel for hashicorp/agent-skills/terraform-policy, and install it in one click.

Use this skill