generate-iac

# Skill: generate-iac Author governed, best-practice Terraform/OpenTofu from a plain-language intent. The output is a deploy-ready Terraform directory with a pinned, clean `plan` — the G4 handoff to `release-loop` (or the generated human-gated pipeline where `release-loop` is absent). Apply is never in scope for this skill. ## v1 scope — governed realization, not architectural design **In scope (v1):** governed HCL generation from a pre-formed architectural intent; provider-contract, tagging, naming, state, IAM, networking, and observability standards applied; OPA/Conftest policy gate; Trivy security scan; CI pipeline wiring (GitHub Actions / Azure DevOps / GitLab) with OIDC auth; plan-based drift audit via `reconcile-iac`. **Out of scope in v1 — bring a pre-formed architectural decision:** - **Workload selection.** RDS vs Aurora vs DynamoDB, EKS vs ECS vs Lambda, VM vs container vs serverless. This skill governs and builds what you chose; it does not evaluate requirements → service fit. - **Network topology design.** Hub-spoke vs flat, Transit Gateway vs VPC peering, on-prem connectivity (DX / ExpressRoute / Interconnect), multi-region topology. This skill consumes a network; it does not design one. - **Load balancer type/tier selection.** L4 vs L7, global vs regional, health-check strategy, blue/green or canary traffic-shift. "Governed front door only" means the skill wires an LB you specify. - **Multi-account / landing-zone orchestration.** AWS Control Towe...