tf-best-practices

Best-practice authoring guidance AND a read-only policy gate for AWS Terraform generated by a migration skill. Load during any phase that writes a terraform/ directory — first as the "what to emit" posture rules + security-baseline spec, then after writing as the deterministic policy verdict. Read-only: it reports whether the generated Terraform passes; it never edits .tf files, never touches .phase-status.json, and never decides phase completion. Complements (does not replace) terraform fmt/init/validate.

Agent Skill from aws/agent-toolkit-for-aws

Copilot Studio

Passes documented load rules

No documented load rule failed.

Microsoft 365 Copilot Preview, Frontier tenants only

Needs changes

Fails: Every file has a supported file type (M365-FILE-TYPES)
34 unsupported: .gitignore, fixtures/terraform-policy/bad-db-sg-public-quoted-port/vpc.tf, fixtures/terraform-policy/bad-db-sg-public/vpc.tf, fixtures/terraform-policy/bad-elasticache-cluster-redis-unencrypted/cache.tf, fixtures/terraform-policy/bad-elasticache-unencrypted/cache.tf, fixtures/terraform-policy/bad-heroku-eb-elasticache/cache.tf, fixtures/terraform-policy/bad-http-forward/compute.tf, fixtures/terraform-policy/bad-rds-public-brace-in-comment/main.tf, …
rule · Microsoft 365 Copilot: Supported file and script types

An agent can have at most 8 skills. Custom skills aren't available in tenants that use Microsoft Purview Information Barriers.

Compatible isn't the same as safe. These verdicts only say whether a skill's files follow Microsoft's documented load rules. The checker reads files and never runs them, and it doesn't review what a skill or its scripts actually do. Read a skill's instructions and scripts before you add it to an agent.

Standards signals

Meets the agentskills.io required fields.

Frontmatter	Present and parsed Spec: frontmatter
name	Meets the spec (1-64 chars, a-z 0-9 hyphens) Spec: name
description	Present, 1-1,024 characters Spec: description
compatibility	Absent or under 500 characters Spec: compatibility
Name matches folder	Yes (`tf-best-practices`) Spec: name

Observed from the public SKILL.md at the commit above on 2026-10-24. Not a certification: AAIF and the Agent Skills project don't certify skills. Validate your own skill with skills-ref validate.

Source repo	aws/agent-toolkit-for-aws
Path	plugins/aws-startup-advisor/skills/tf-best-practices/SKILL.md
Commit checked	`e8c630949189`
Repo license	Apache-2.0
Files	39
Scripts	2 (2 scanned for the sandbox heuristic)
Instructions	11,882 characters
Deepest folder	3 below the skill folder
Rules version	2026-10-22

Re-check the latest version How skill checks work

Is this wrong or out of date? Email us. Skills data built 2026-10-24; rules as of 2026-10-22.

Rule-based checks of public files against Microsoft's documented load rules, not tested in Copilot Studio or Microsoft 365 Copilot. Independent project, not affiliated with Microsoft.