Individual skill
sg-writing-stackguardian-policy-terraform
Use when writing, reviewing or debugging Terraform/OpenTofu HCL for StackGuardian policies (stackguardian_policy, policies_config, enforced_on, Tirith JSON, OPA/Rego, marketplace policy templates, cost limits, approval gates, config-time workflow rules), attaching a policy to a workflow, group or connector — or when a policy applies but never blocks, blocks every plan, never asks for approval, or its scope silently disappears. Also covers resolving scopes and dependencies via the StackGuardian MCP server.
skills/sg-writing-stackguardian-policy-terraform/SKILL.md
Source commit 66070a05d05c95c06fe936ac0ad2c9bb68bf7623
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 6, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 12
- Repository last updated
- Nov 2, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent-skills Repository topic
- ai-agents Repository topic
- claude-code Repository topic
- cloud-governance Repository topic
- codex Repository topic
- cursor Repository topic
- devops Repository topic
- drift-detection Repository topic
- gemini-cli Repository topic
- github-copilot Repository topic
- operations Derived category
- writing Derived category
- devops Derived category
- testing Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 14,271 bytesSKILL.mdcore · 14,271 bytesSKILL.mdcore · 14,271 bytesexamples/README.mddoc · 1,678 bytesexamples/approvals.tfasset · 2,533 bytesexamples/config_rules.tfasset · 4,518 bytesexamples/network_guardrails.tfasset · 3,291 bytesexamples/no_public_s3.tfasset · 2,854 bytesexamples/opa_and_marketplace.tfasset · 2,781 bytesexamples/required_tags.tfasset · 2,589 bytesexamples/versions.tfasset · 587 bytesreferences/schema.mddoc · 2,776 bytesreferences/sources-and-lifecycle.mddoc · 15,049 bytesreferences/tirith.mddoc · 16,103 bytes
Read excerpt
# Writing StackGuardian policy Terraform
## Overview
A `stackguardian_policy` is a list of rules (`policies_config`) plus a scope (`enforced_on`).
**Attachment lives only on the policy** — workflows, groups and templates have no policy
attribute. Rules are evaluated at two different moments:
| `meta.required_provider` | Evaluated | Verdict effect |
|---|---|---|
| `stackguardian/terraform_plan`, `stackguardian/infracost`, OPA (`OPA_REGO`) | in the plan step of TERRAFORM/OPENTOFU runs (also CloudFormation/Pulumi steps), before `apply`; not on drift or `plan-without-policy` runs, not in Ansible/Kubernetes steps | FAIL errors the run; APPROVAL_REQUIRED pauses before the next step |
| `stackguardian/json` (config rule) | when a workflow in scope is **created/updated** (also via Terraform) and when a run is **built** | FAIL = `403 Workflow policy (<policy>:<rule>) failed …` on create/update (live); at run build the run is refused or gated at step 0 |
The provider validates nothing and the Tirith engine fails *open* on many mistakes, so a wrong