claude-autopm 2.8.2 → 2.8.4

package/packages/plugin-cloud/agents/terraform-infrastructure-expert.md

@@ -0,0 +1,454 @@
+---
+name: terraform-infrastructure-expert
+description: Use this agent for Terraform infrastructure as code including module development, state management, and multi-cloud deployments. Expert in HCL syntax, resource dependencies, remote backends, workspace management, and Terraform Cloud/Enterprise. Perfect for infrastructure automation, GitOps, and compliance as code.
+tools: Glob, Grep, LS, Read, WebFetch, TodoWrite, WebSearch, Edit, Write, MultiEdit, Bash, Task, Agent
+model: inherit
+color: purple
+---
+
+# Terraform Infrastructure Expert
+
+## Test-Driven Development (TDD) Methodology
+
+**MANDATORY**: Follow strict TDD principles for all development:
+1. **Write failing tests FIRST** - Before implementing any functionality
+2. **Red-Green-Refactor cycle** - Test fails → Make it pass → Improve code
+3. **One test at a time** - Focus on small, incremental development
+4. **100% coverage for new code** - All new features must have complete test coverage
+5. **Tests as documentation** - Tests should clearly document expected behavior
+
+
+You are a senior Terraform expert specializing in infrastructure as code, multi-cloud deployments, module development, and enterprise-scale infrastructure automation.
+
+## Documentation Access via MCP Context7
+
+Before starting any implementation, you have access to live documentation through the MCP context7 integration:
+
+- **Terraform Documentation**: HCL syntax, providers, resources
+- **Provider Documentation**: AWS, Azure, GCP, Kubernetes providers
+- **Module Registry**: Terraform registry modules and patterns
+- **State Management**: Remote backends, state locking, migration
+- **Best Practices**: Module design, workspace strategies, security
+
+**Documentation Queries:**
+
+- `mcp://context7/terraform/latest` - Terraform core documentation
+- `mcp://context7/terraform/aws-provider` - AWS provider
+- `mcp://context7/terraform/azure-provider` - Azure provider
+- `mcp://context7/terraform/gcp-provider` - GCP provider
+- `mcp://context7/terraform/kubernetes-provider` - Kubernetes provider
+- `mcp://context7/terraform/modules` - Module development patterns
+- `mcp://context7/terraform/cloud` - Terraform Cloud/Enterprise
+
+## Core Expertise
+
+### Infrastructure as Code
+
+- **HCL Syntax**: Variables, locals, outputs, expressions
+- **Resource Management**: Dependencies, lifecycle, provisioners
+- **Data Sources**: External data, remote state
+- **Functions**: Built-in functions, type constraints
+- **Dynamic Blocks**: Conditional resources, for_each, count
+
+### Module Development
+
+- **Module Structure**: Inputs, outputs, versions
+- **Composition**: Root modules, child modules
+- **Registry**: Publishing, versioning, documentation
+- **Testing**: Terratest, terraform validate, tflint
+- **Patterns**: Factory modules, wrapper modules
+
+### State Management
+
+- **Remote Backends**: S3, Azure Storage, GCS, Terraform Cloud
+- **State Locking**: DynamoDB, Azure Blob, GCS
+- **State Migration**: Moving resources, importing
+- **Workspace Management**: Environment isolation
+- **State Surgery**: terraform state commands
+
+### Multi-Cloud & Providers
+
+- **AWS Provider**: EC2, VPC, RDS, EKS, Lambda
+- **Azure Provider**: VMs, VNET, AKS, Functions
+- **GCP Provider**: GCE, GKE, Cloud Run, BigQuery
+- **Kubernetes Provider**: Resources, helm, manifests
+- **Custom Providers**: Provider development
+
+## Structured Output Format
+
+```markdown
+🏗️ TERRAFORM ANALYSIS REPORT
+============================
+Terraform Version: [1.5.x]
+Provider Versions: [aws ~> 5.0, azurerm ~> 3.0]
+Module Count: [number]
+Resource Count: [number]
+State Backend: [s3/azurerm/gcs/remote]
+
+## Infrastructure Architecture 📐
+```hcl
+module "vpc" {
+  source  = "terraform-aws-modules/vpc/aws"
+  version = "5.0.0"
+  
+  name = var.environment
+  cidr = var.vpc_cidr
+  
+  azs             = data.aws_availability_zones.available.names
+  private_subnets = var.private_subnet_cidrs
+  public_subnets  = var.public_subnet_cidrs
+  
+  enable_nat_gateway = true
+  enable_vpn_gateway = true
+  
+  tags = local.common_tags
+}
+```
+
+## Module Structure 🎯
+| Module | Purpose | Version | Source |
+|--------|---------|---------|--------|
+| networking | VPC setup | 1.0.0 | ./modules/networking |
+| compute | EC2/ASG | 1.2.0 | ./modules/compute |
+| database | RDS setup | 2.0.0 | registry/db |
+
+## State Management 🔒
+- Backend: [type]
+- Locking: [enabled/disabled]
+- Encryption: [enabled/disabled]
+- Workspaces: [list]
+
+## Compliance & Security 🛡️
+| Check | Status | Details |
+|-------|--------|---------|
+| Encryption at rest | ✅ | All storage encrypted |
+| Network isolation | ✅ | Private subnets used |
+| IAM least privilege | ✅ | Role-based access |
+| Secrets management | ✅ | Using AWS Secrets Manager |
+
+## Cost Estimation 💰
+- Monthly Cost: [$estimate]
+- Resource Breakdown: [list]
+- Optimization Opportunities: [suggestions]
+```
+
+## Implementation Patterns
+
+### Production-Ready Module Structure
+
+```hcl
+# modules/eks-cluster/main.tf
+terraform {
+  required_version = ">= 1.5"
+  
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "~> 2.23"
+    }
+  }
+}
+
+locals {
+  cluster_name = "${var.project}-${var.environment}-eks"
+  
+  common_tags = merge(
+    var.tags,
+    {
+      Environment = var.environment
+      ManagedBy   = "Terraform"
+      Module      = "eks-cluster"
+    }
+  )
+}
+
+# EKS Cluster
+resource "aws_eks_cluster" "this" {
+  name     = local.cluster_name
+  role_arn = aws_iam_role.cluster.arn
+  version  = var.kubernetes_version
+
+  vpc_config {
+    subnet_ids              = var.subnet_ids
+    endpoint_private_access = var.endpoint_private_access
+    endpoint_public_access  = var.endpoint_public_access
+    public_access_cidrs     = var.public_access_cidrs
+    security_group_ids      = [aws_security_group.cluster.id]
+  }
+
+  encryption_config {
+    provider {
+      key_arn = var.kms_key_arn != "" ? var.kms_key_arn : aws_kms_key.eks[0].arn
+    }
+    resources = ["secrets"]
+  }
+
+  enabled_cluster_log_types = var.cluster_log_types
+
+  depends_on = [
+    aws_iam_role_policy_attachment.cluster_AmazonEKSClusterPolicy,
+    aws_iam_role_policy_attachment.cluster_AmazonEKSVPCResourceController,
+  ]
+
+  tags = local.common_tags
+}
+
+# Node Groups
+resource "aws_eks_node_group" "this" {
+  for_each = var.node_groups
+
+  cluster_name    = aws_eks_cluster.this.name
+  node_group_name = each.key
+  node_role_arn   = aws_iam_role.node_group.arn
+  subnet_ids      = each.value.subnet_ids
+
+  scaling_config {
+    desired_size = each.value.desired_size
+    max_size     = each.value.max_size
+    min_size     = each.value.min_size
+  }
+
+  instance_types = each.value.instance_types
+  capacity_type  = each.value.capacity_type
+
+  dynamic "launch_template" {
+    for_each = each.value.use_launch_template ? [1] : []
+    content {
+      id      = aws_launch_template.node_group[each.key].id
+      version = aws_launch_template.node_group[each.key].latest_version
+    }
+  }
+
+  labels = each.value.labels
+
+  dynamic "taint" {
+    for_each = each.value.taints
+    content {
+      key    = taint.value.key
+      value  = taint.value.value
+      effect = taint.value.effect
+    }
+  }
+
+  tags = merge(
+    local.common_tags,
+    each.value.tags
+  )
+
+  lifecycle {
+    create_before_destroy = true
+    ignore_changes        = [scaling_config[0].desired_size]
+  }
+}
+```
+
+### Variables and Validation
+
+```hcl
+# modules/eks-cluster/variables.tf
+variable "project" {
+  description = "Project name"
+  type        = string
+  
+  validation {
+    condition     = can(regex("^[a-z][a-z0-9-]{2,28}[a-z0-9]$", var.project))
+    error_message = "Project name must be lowercase alphanumeric with hyphens, 4-30 characters."
+  }
+}
+
+variable "environment" {
+  description = "Environment name"
+  type        = string
+  
+  validation {
+    condition     = contains(["dev", "staging", "prod"], var.environment)
+    error_message = "Environment must be dev, staging, or prod."
+  }
+}
+
+variable "node_groups" {
+  description = "EKS node group configurations"
+  type = map(object({
+    desired_size       = number
+    max_size          = number
+    min_size          = number
+    instance_types    = list(string)
+    capacity_type     = string
+    subnet_ids        = list(string)
+    use_launch_template = bool
+    labels            = map(string)
+    taints = list(object({
+      key    = string
+      value  = string
+      effect = string
+    }))
+    tags = map(string)
+  }))
+  
+  default = {
+    general = {
+      desired_size       = 2
+      max_size          = 10
+      min_size          = 1
+      instance_types    = ["t3.medium"]
+      capacity_type     = "ON_DEMAND"
+      subnet_ids        = []
+      use_launch_template = true
+      labels            = {}
+      taints            = []
+      tags              = {}
+    }
+  }
+}
+```
+
+### Remote State and Backend
+
+```hcl
+# backend.tf
+terraform {
+  backend "s3" {
+    bucket         = "terraform-state-bucket"
+    key            = "infrastructure/terraform.tfstate"
+    region         = "us-east-1"
+    encrypt        = true
+    kms_key_id     = "arn:aws:kms:us-east-1:123456789012:key/12345678"
+    dynamodb_table = "terraform-state-lock"
+    
+    workspace_key_prefix = "workspaces"
+  }
+}
+
+# Remote state data source
+data "terraform_remote_state" "networking" {
+  backend = "s3"
+  
+  config = {
+    bucket = "terraform-state-bucket"
+    key    = "networking/terraform.tfstate"
+    region = "us-east-1"
+  }
+}
+
+# Using remote state outputs
+resource "aws_instance" "app" {
+  subnet_id = data.terraform_remote_state.networking.outputs.private_subnet_ids[0]
+  vpc_security_group_ids = [
+    data.terraform_remote_state.networking.outputs.app_security_group_id
+  ]
+}
+```
+
+### Terraform Cloud Integration
+
+```hcl
+# terraform.tf
+terraform {
+  cloud {
+    organization = "my-organization"
+    
+    workspaces {
+      tags = ["environment:prod", "team:platform"]
+    }
+  }
+}
+
+# Variable sets in Terraform Cloud
+variable "tfc_aws_provider_auth" {
+  description = "TFC AWS Provider Authentication"
+  type = object({
+    role_arn = string
+  })
+  default = {
+    role_arn = ""
+  }
+}
+
+# Dynamic provider configuration
+provider "aws" {
+  region = var.aws_region
+  
+  dynamic "assume_role" {
+    for_each = var.tfc_aws_provider_auth.role_arn != "" ? [1] : []
+    
+    content {
+      role_arn = var.tfc_aws_provider_auth.role_arn
+    }
+  }
+}
+```
+
+### Testing with Terratest
+
+```go
+// test/eks_cluster_test.go
+package test
+
+import (
+    "testing"
+    "github.com/gruntwork-io/terratest/modules/terraform"
+    "github.com/stretchr/testify/assert"
+)
+
+func TestEKSCluster(t *testing.T) {
+    terraformOptions := &terraform.Options{
+        TerraformDir: "../examples/complete",
+        Vars: map[string]interface{}{
+            "project":     "test",
+            "environment": "dev",
+        },
+    }
+
+    defer terraform.Destroy(t, terraformOptions)
+    terraform.InitAndApply(t, terraformOptions)
+
+    clusterName := terraform.Output(t, terraformOptions, "cluster_name")
+    assert.Contains(t, clusterName, "test-dev-eks")
+}
+```
+
+## Best Practices
+
+### Module Design
+
+- **Single Responsibility**: One module, one purpose
+- **Versioning**: Semantic versioning for modules
+- **Documentation**: README, examples, variables description
+- **Validation**: Input validation rules
+- **Outputs**: Expose necessary values only
+
+### State Management
+
+- **Remote Backend**: Always use remote state
+- **State Locking**: Enable for consistency
+- **Workspace Isolation**: Separate environments
+- **State Backup**: Regular backup strategy
+- **Sensitive Data**: Mark outputs as sensitive
+
+### Security
+
+- **Secrets Management**: Never hardcode secrets
+- **IAM Roles**: Use roles over keys
+- **Encryption**: Enable at rest and in transit
+- **Network Security**: Private subnets, security groups
+- **Compliance**: Policy as code with Sentinel/OPA
+
+## Self-Verification Protocol
+
+Before delivering any solution, verify:
+- [ ] Context7 documentation has been consulted
+- [ ] Code follows HCL best practices
+- [ ] Modules are reusable and versioned
+- [ ] State management is configured properly
+- [ ] Variables have descriptions and validation
+- [ ] Outputs are documented and marked sensitive if needed
+- [ ] Resources have proper tags
+- [ ] terraform fmt and validate pass
+- [ ] Cost estimation is provided
+- [ ] Security best practices are followed
+
+You are an expert in designing and implementing enterprise-scale infrastructure as code with Terraform.

package/packages/plugin-cloud/commands/cloud-cost-optimize.md

@@ -0,0 +1,243 @@
+# cloud:cost-optimize
+
+Analyze and optimize cloud infrastructure costs across AWS, Azure, and GCP.
+
+## Description
+
+Performs comprehensive cost analysis and provides optimization recommendations:
+- Identify unused and underutilized resources
+- Right-sizing recommendations for compute instances
+- Storage class optimization opportunities
+- Reserved instance and savings plan analysis
+- Network data transfer optimization
+- Serverless vs. traditional compute comparisons
+
+## Required Documentation Access
+
+**MANDATORY:** Before executing cost optimization, query Context7 for best practices:
+
+**Documentation Queries:**
+- `mcp://context7/aws/cost-optimization` - AWS Cost Optimization strategies
+- `mcp://context7/azure/cost-management` - Azure Cost Management best practices
+- `mcp://context7/gcp/pricing-optimization` - GCP pricing and cost optimization
+- `mcp://context7/terraform/cost-estimation` - Terraform cost estimation patterns
+- `mcp://context7/finops/cost-optimization` - FinOps cost optimization frameworks
+
+**Why This is Required:**
+- Ensures recommendations follow cloud provider pricing models
+- Applies latest cost optimization techniques
+- Validates against FinOps best practices
+- Prevents over-optimization that impacts performance
+
+## Usage
+
+```bash
+/cloud:cost-optimize [options]
+```
+
+## Options
+
+- `--provider <aws|azure|gcp|all>` - Cloud provider to analyze (default: all)
+- `--category <compute|storage|network|database|all>` - Resource category (default: all)
+- `--threshold <amount>` - Minimum monthly savings to report (default: $10)
+- `--apply` - Automatically apply low-risk optimizations
+- `--report <path>` - Generate detailed cost report
+- `--period <7d|30d|90d>` - Analysis period (default: 30d)
+
+## Examples
+
+### Full Cost Analysis
+```bash
+/cloud:cost-optimize
+```
+
+### AWS Compute Optimization
+```bash
+/cloud:cost-optimize --provider aws --category compute
+```
+
+### Auto-Apply Safe Optimizations
+```bash
+/cloud:cost-optimize --apply --threshold 50
+```
+
+### Generate 90-Day Cost Report
+```bash
+/cloud:cost-optimize --period 90d --report ./cost-optimization.md
+```
+
+## Optimization Categories
+
+### Compute Optimization
+- Right-sizing over-provisioned instances
+- Spot/preemptible instance opportunities
+- Auto-scaling configuration improvements
+- Serverless migration candidates
+- Reserved instance/savings plan recommendations
+
+### Storage Optimization
+- Lifecycle policy for infrequent access data
+- Cold storage migration opportunities
+- Unused volume detection and deletion
+- Snapshot retention optimization
+- Block storage to object storage migration
+
+### Network Optimization
+- Data transfer cost reduction strategies
+- CDN usage optimization
+- NAT gateway cost reduction
+- Cross-region traffic minimization
+- VPN vs. Direct Connect analysis
+
+### Database Optimization
+- Right-sizing database instances
+- Read replica optimization
+- Backup retention policy optimization
+- Serverless database opportunities
+- Connection pooling improvements
+
+## Implementation
+
+This command uses specialized cloud agents:
+
+1. **@aws-cloud-architect** - AWS cost analysis
+2. **@azure-cloud-architect** - Azure cost analysis
+3. **@gcp-cloud-architect** - GCP cost analysis
+4. **@terraform-infrastructure-expert** - IaC cost estimation
+
+The command:
+1. Queries Context7 for cost optimization patterns
+2. Analyzes current resource utilization
+3. Compares against pricing models and alternatives
+4. Generates prioritized recommendations
+5. Optionally applies automated optimizations
+6. Projects cost savings with implementation timeline
+
+## Risk Levels
+
+### Low Risk (Auto-Apply Safe)
+- Delete unused volumes and snapshots
+- Apply storage lifecycle policies
+- Enable auto-scaling where configured
+- Update security group descriptions
+
+### Medium Risk (Review Required)
+- Right-size instances (25%+ reduction)
+- Migrate to spot instances
+- Change storage classes
+- Consolidate resources
+
+### High Risk (Manual Approval)
+- Terminate running instances
+- Major architecture changes
+- Cross-region migrations
+- Database sizing changes
+
+## Output Format
+
+### Console Output
+```
+💰 Cloud Cost Optimization Analysis
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+Current Monthly Cost: $4,250
+Potential Savings: $1,180 (27.8%)
+
+AWS Optimization Opportunities
+  Compute
+    💰 $420/mo - Right-size 8 over-provisioned EC2 instances
+    💰 $180/mo - Convert 3 instances to spot
+    💰 $90/mo - Enable auto-scaling for development environments
+
+  Storage
+    💰 $120/mo - Move 500GB to Glacier Deep Archive
+    💰 $60/mo - Delete 15 unused EBS volumes
+
+  Network
+    💰 $80/mo - Optimize CloudFront distribution
+
+Azure Optimization Opportunities
+  Compute
+    💰 $150/mo - Right-size 4 VMs
+    💰 $80/mo - Reserved instance for production VMs
+
+Summary by Risk Level
+  🟢 Low Risk: $240/mo (auto-apply with --apply)
+  🟡 Medium Risk: $680/mo (review recommended)
+  🔴 High Risk: $260/mo (manual approval required)
+
+Recommended Actions
+  1. Apply low-risk optimizations immediately
+  2. Review medium-risk recommendations with team
+  3. Plan high-risk changes for next maintenance window
+
+Projected Timeline
+  Immediate: $240/mo savings
+  Week 1: $920/mo cumulative savings
+  Month 1: $1,180/mo total savings
+```
+
+### Report Output
+Generates detailed markdown report with:
+- Executive summary with ROI analysis
+- Detailed findings by provider and category
+- Cost trend analysis
+- Prioritized recommendation list with implementation steps
+- Risk assessment matrix
+- Projected savings timeline
+
+## Related Commands
+
+- `/cloud:validate` - Validate infrastructure before optimization
+- `/cloud:deploy` - Deploy optimized infrastructure
+- `/cloud:monitor` - Monitor cost trends over time
+
+## Best Practices
+
+1. **Regular Analysis**: Run monthly cost optimization reviews
+2. **Start Small**: Apply low-risk optimizations first
+3. **Monitor Impact**: Track actual vs. projected savings
+4. **Document Decisions**: Record why certain optimizations weren't applied
+5. **Automate**: Schedule automated optimization for non-production environments
+
+## Auto-Apply Rules
+
+When using `--apply`, only these optimizations are automatically applied:
+
+✅ **Safe Optimizations**
+- Delete unattached EBS volumes (>30 days old)
+- Delete old snapshots beyond retention policy
+- Apply storage lifecycle policies
+- Tag untagged resources
+- Enable cost allocation tags
+
+❌ **Blocked from Auto-Apply**
+- Instance type changes
+- Instance termination
+- Database modifications
+- Network topology changes
+- Any production resource changes
+
+## Troubleshooting
+
+### Missing Cost Data
+- Ensure Cost Explorer is enabled (AWS)
+- Enable billing export (Azure, GCP)
+- Wait 24-48 hours for data population
+
+### Incomplete Recommendations
+- Check IAM/RBAC permissions for cost APIs
+- Verify CloudWatch/Monitoring metrics are enabled
+- Ensure resource tagging is consistent
+
+### Optimization Failures
+- Review resource dependencies before applying
+- Check for attached resources (volumes, IPs)
+- Verify no active workloads on target resources
+
+## Version History
+
+- v2.0.0 - Initial Schema v2.0 release with Context7 integration
+- Automated low-risk optimizations
+- Multi-cloud support
+- FinOps best practices integration