Infrastructure As Code Reviewer
Review Terraform, Pulumi & CloudFormation for security, cost, and compliance issues
What You Can Do
You can submit Terraform, Pulumi, or CloudFormation code—whether single files, modules, or multi-file stacks—and Claude will conduct production-grade security audits, identify cost optimization opportunities, verify compliance tagging requirements, and flag deviations from cloud best practices. Each finding receives a severity rating (Critical, High, Medium, Low) with specific, actionable remediation steps tailored to your infrastructure.
Features
Detects exposed credentials, overly permissive IAM policies, unencrypted data stores, and public-facing resources without access controls
Identifies over-provisioned resources, unnecessary redundancy, inefficient storage classes, and misconfigured auto-scaling
Validates required metadata for billing, ownership, and regulatory tracking across all resources
Reviews Terraform (HCL), Pulumi (Python/YAML), and CloudFormation (JSON/YAML) in a single pass
Classifies findings as Critical, High, Medium, or Low for risk-driven remediation planning
Verifies adherence to cloud provider recommendations and architectural patterns
Provides line-specific recommendations with context on why each issue matters and how to fix it
Handles single files, entire modules, or multi-file infrastructure stacks
Example Output
Security Finding (Critical)
- Issue: S3 bucket has public read access via
acl = "public-read" - Risk: All objects in this bucket are readable by anyone on the internet
- Remediation: Change
aclto"private"and use CloudFront with OAI for public access
Cost Optimization (High)
- Issue: RDS instance t3.xlarge running with average CPU <5%
- Risk: You're paying for unused compute capacity (~$400/month)
- Recommendation: Downsize to t3.small and monitor performance
Compliance (Medium)
- Issue: EC2 instances missing required
EnvironmentandCostCentertags - Risk: Cannot allocate infrastructure costs to departments; fails compliance audit
- Remediation: Add
tags = { Environment = "prod", CostCenter = "eng-ops" }to all compute resources
What's Included
- infrastructure-as-code-reviewer.md: Core skill instruction file with review framework and severity definitions
- Security checklist: Pre-built security audit criteria covering credentials, IAM, encryption, and network exposure
- Cost optimization template: Inventory of common over-provisioning patterns and right-sizing recommendations
- Tagging & compliance framework: Required tag schema and regulatory mapping guide (GDPR, SOC2, CIS)
- Remediation snippets: Code examples for common fixes across Terraform, Pulumi, and CloudFormation
Who It's For
- Cloud engineers reviewing infrastructure pull requests before production deployment
- DevOps teams conducting security audits and compliance validation
- FinOps specialists identifying cost optimization opportunities in cloud stacks
- Solutions architects validating infrastructure designs against organizational standards
- Security engineers integrating IaC scanning into CI/CD pipelines
Best For
- Pre-production code reviews for Terraform, Pulumi, and CloudFormation
- Security vulnerability scanning and remediation planning
- Cost analysis and right-sizing recommendations
- Compliance tagging audits and regulatory gap identification
- Best practice alignment checks for cloud infrastructure
You might also like
You can design culturally appropriate survey instruments tailored to international development contexts, analyze mixed-methods data by integrating quantitative findings with qualitative insights, and implement robust data quality management systems for your field operations. Claude helps you create survey templates with adaptive logic, develop validation protocols, and produce data quality reports that highlight issues before analysis begins.
by skillslib
Prepare comprehensive expert witness reports and testimony that meet Daubert standards for admissibility and withstand cross-examination scrutiny. You'll get structured case analyses integrating psychological assessments, relevant case law citations, and anticipated counterarguments. The skill helps you document your forensic opinions with the legal rigor required in criminal, civil, and family law proceedings.
by skillslib
You can systematically evaluate architectural options by building decision matrices, identifying trade-offs, and documenting design rationale. This skill generates comparison frameworks, risk assessments, and architecture decision records (ADRs) that help you choose between competing approaches based on concrete criteria like performance, scalability, cost, and team capabilities.
by skillslib
You provide a single core insight or perspective, and this skill transforms it into a complete, coordinated thought leadership content suite across every major channel. It generates optimized articles, social threads, email sequences, presentation outlines, and more—all reinforcing the same core message while adapting to each platform's unique audience and format. Every piece maintains strategic consistency while maximizing reach and engagement.
by skillslib
Analyze commercial insurance applications by extracting risk factors, evaluating loss history and industry exposure, and generating structured underwriting recommendations with standardized documentation. You'll reduce review time per application, ensure consistent decision criteria across your team, and maintain compliant audit trails for every underwriting action.
by skillslib
You can convert raw discovery call notes into polished, multi-section sales proposals that include executive summaries tailored to buyer personas, needs analysis mapped to your solution architecture, tiered pricing options with competitive positioning, ROI projections with financial justification, and realistic implementation timelines. The skill preserves personalization and strategic positioning while automating structural components, letting you respond to RFPs and time-sensitive opportunities without sacrificing quality or consistency.
by skillslib
This skill analyzes property damage claims to identify viable subrogation opportunities against third-party defendants. It quantifies recovery potential using liability assessment, damages analysis, and comparable settlement benchmarks—then develops negotiation-backed strategies to maximize your recovery. The skill guides you through intake, documentation, negotiation, and settlement workflows to transform claims into recoveries.
by skillslib
Turn project descriptions, timelines, and structured data into professional draw.io diagrams instantly. You can generate flowcharts, org charts, Gantt charts, swimlane diagrams, and process flows by describing what you need. Claude creates draw.io XML that you can open directly in the editor or modify further.
by skillslib