feat: add terraform-modernize skill for ephemeral resources and write-only arguments

[garvitarai1]

Summary

Adds a new terraform-modernize skill that helps modernize Terraform configurations to use ephemeral resources (Terraform 1.10+) and write-only arguments (Terraform 1.11+) for improved security and state management.

Motivation

As Terraform introduces new security features like ephemeral resources and write-only arguments, users need guidance on when and how to adopt them. This skill provides:

• Automated detection of provider support via schema queries
• Migration patterns for common scenarios (secrets, passwords, API keys)
• Validation-first approach ensuring all transformations pass terraform validate
• Security improvements by removing sensitive values from state files

Provider-Agnostic Design

This skill works with any Terraform provider, not just AWS:

• Scripts query provider schemas dynamically via terraform providers schema -json
• No hardcoded provider lists - automatically supports any provider that implements these features
• Already documented support for: AWS, Azure, GCP, Random, TLS providers
• Users can check any provider: ./check_ephemeral_support.sh <provider-name>

Examples use AWS for illustration since it has comprehensive support, but all workflows and patterns apply universally to any provider.

Key Features

1. Ephemeral Resources (Terraform 1.10+)

Replaces data sources with ephemeral resources for transient, sensitive data that shouldn't persist in state:

# BEFORE
data "aws_secretsmanager_secret_version" "db_password" {
  secret_id = "prod-db-password"
}

# AFTER
ephemeral "aws_secretsmanager_secret_version" "db_password" {
  secret_id = "prod-db-password"
}

2. Write-only Arguments (Terraform 1.11+)

Uses _wo suffix arguments to accept sensitive values without storing them in state:

# BEFORE
resource "aws_db_instance" "main" {
  password = var.db_password  # Stored in state
}

# AFTER
resource "aws_db_instance" "main" {
  password_wo         = var.db_password  # Not stored in state
  password_wo_version = 1
}

3. Provider-Aware Detection

Includes scripts that query provider schemas to detect feature support:

• check_ephemeral_support.sh - Lists ephemeral resources available in a provider
• check_writeonly_support.sh - Lists write-only arguments available in a provider

Works with any provider: AWS, Azure, GCP, Random, TLS, and any future providers.

Skill Structure

Following the Agent Skills specification:

• SKILL.md (596 lines) - Main skill with frontmatter, workflows, and examples
• scripts/ - Provider schema query scripts
• references/ - Deep-dive documentation:
  • ephemeral-resources.md - Lifecycle, contexts, edge cases
  • write-only-arguments.md - Syntax, versioning, state behavior
  • ephemeral-contexts.md - Valid usage contexts
  • migration-patterns.md - 5 comprehensive migration patterns

Testing

• ✅ Skill achieves 80% Tessl review score (Description: 75%, Content: 85%)
• ✅ Scripts successfully detect AWS provider support
• ✅ Test configuration validates migration patterns
• ✅ All transformations pass terraform validate

Related Work

• Links to version-upgrades skill for prerequisite Terraform/provider upgrades
• Follows pattern established by terraform-search-import skill for provider queries
• Complements existing terraform-query-import and refactor-module skills

🤖 Generated with Claude Code

[hashicorp-cla-app]

All committers have signed the CLA.

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

_{Have you signed the CLA already but the status is still pending? Recheck it.}

[github-actions]

Tessl Skill Review Results

Skill	Status	Review Score
terraform/code-generation/skills/terraform-modernize	PASSED	80%

Checks: frontmatter validity, required fields, body structure, examples, line count.
Review Score is informational — not used for pass/fail gating.

[quixoticmonk]

We could have the schema command output saves for usage across the script once with something like ..

SCHEMA=$(terraform providers schema -json 2>/dev/null)
provider_key=$(jq -r '.provider_schemas | keys[]' <<< "$SCHEMA" | grep "/$1$")

[garvitarai1]

Ya thats a great idea! I'll make the update