ARC IaC Agent Skills

Teach your AI agent to scaffold, scan, and deploy production AWS infrastructure using the SourceFuse ARC Terraform module ecosystem — in plain English.

---

What is this?

SourceFuse ARC is a collection of ~60 production-grade, opinionated Terraform modules for AWS — covering everything from VPCs and EKS clusters to Aurora databases, Lambda, S3, and more.

This repository gives your AI agent (Claude, Kiro, Cursor, Copilot, etc.) everything it needs to work with those modules fluently:

• It knows which module to use for any AWS resource
• It can scaffold a ready-to-deploy 6-file Terraform structure
• It runs security scans and explains findings
• It handles multi-environment setups, CI/CD pipelines, Git, GitHub, and GitLab

Before this skill, you'd have to look up module docs yourself, figure out the right inputs, wire up data sources, and manually run security checks.

After this skill, you just tell your agent what you want:

"Set up an EKS cluster with a private RDS Aurora database for production"

...and it handles the rest.

---

How it works

This repo contains skill files — plain markdown documents that you drop into your AI agent's config folder. The agent reads them as context and becomes an expert on ARC modules.

Optionally, you can also connect an MCP server (https://arc-iac-mcp.sourcef.us/mcp) that gives the agent live access to module data from the Terraform Registry. This makes discovery and scaffolding faster and more accurate.

No MCP? No problem — there's a standalone Python script (scripts/arc.py) that does everything the MCP server does, with zero dependencies.

Your AI Agent  +  SKILL.md  +  (optional) MCP Server  =  ARC IaC Expert

---

---

Step 1 — Pick your AI agent and load the skill

Find your agent below and follow the two steps: copy the skill file, then optionally connect MCP.

---

Kiro

Copy the skill file into your project:

mkdir -p .kiro
cp kiro-arc-iac/SKILL.md .kiro/arc-iac-skills.md

Kiro automatically reads all .md files inside .kiro/ as agent context. That's it — no restart needed.

Optionally connect the MCP server (recommended for best results):

Create .kiro/settings/mcp.json in your project root:

{
  "mcpServers": {
    "arc-iac": {
      "url": "https://arc-iac-mcp.sourcef.us/mcp",
      "autoApprove": ["*"]
    }
  }
}

Or add it to ~/.kiro/settings/mcp.json to enable it across all your projects.

Now try it:

"Scaffold an EKS cluster named my-cluster into ./infra/eks" "Which ARC module should I use for Aurora PostgreSQL?" "Scan my ./infra/db/main.tf for security issues"

---

Claude (Code CLI)

Copy the skill file into your project:

cp claude-arc-iac/SKILL.md .claude.md

Claude Code CLI reads .claude.md from your project root automatically.

Optionally connect the MCP server:

claude mcp add arc-iac --transport http https://arc-iac-mcp.sourcef.us/mcp

Now try it:

"Set up a production-ready VPC with private subnets and NAT gateways" "Generate Terraform for an S3 bucket with encryption and versioning enabled" "What does arc-db output that I can pass to arc-eks?"

---

Cursor

Copy the skill file:

mkdir -p .cursor/rules
cp cursor-arc-iac/SKILL.md .cursor/rules/arc-iac.md

Optionally connect the MCP server:

mkdir -p .cursor
cat > .cursor/mcp.json << 'EOF'
{
  "mcpServers": {
    "arc-iac": {
      "url": "https://arc-iac-mcp.sourcef.us/mcp"
    }
  }
}
EOF

---

GitHub Copilot

mkdir -p .github
cp integrations/copilot-instructions.md .github/copilot-instructions.md

Copilot reads .github/copilot-instructions.md as workspace instructions automatically.

---

Windsurf

mkdir -p .windsurf/rules
cp integrations/windsurf.md .windsurf/rules/arc-iac.md

---

Gemini CLI

cp integrations/GEMINI.md GEMINI.md

---

Step 2 — Start using it

Once the skill is loaded, talk to your agent in plain English. Here are examples of what you can ask:

Discovery

• "What ARC module should I use for an EKS cluster?"
• "Show me all ARC modules sorted by most downloaded"
• "Which modules create an aws_s3_bucket resource?"
• "Compare arc-ecs and arc-ecs-fargate — what's the difference?"

Scaffolding

• "Scaffold arc-db with instance name aurora-prod into ./infra/db"
• "Generate a production-ready Terraform setup for EKS + Aurora + VPC"
• "What inputs does arc-eks require?"

Security

• "Scan ./infra/eks/main.tf for security issues"
• "Validate arc-eks before I deploy to production"
• "Fix the CRITICAL findings in my S3 module"

Multi-environment & CI/CD

• "Set up a dev/staging/prod Terraform structure with separate state backends"
• "Create a GitHub Actions pipeline for Terraform with plan on PR and apply on merge"
• "What's the safe promotion path from staging to production?"

Git & PRs

• "Stage only the infra files and create a commit"
• "Show me the open PRs waiting for my review"

---

No MCP? Use the standalone script

If you can't or don't want to use the MCP server, scripts/arc.py is a zero-dependency Python CLI (Python 3.8+, stdlib only) that does everything the MCP server does.

Your agent will use it automatically when MCP is not available. You can also run it yourself:

# Clone this repo once
git clone https://github.com/sourcefuse/arc-iac-agent-skills.git

# Discover modules
python3 scripts/arc.py list --sort downloads
python3 scripts/arc.py search eks
python3 scripts/arc.py get arc-db

# Scaffold
python3 scripts/arc.py scaffold arc-eks --instance my-cluster --out ./infra/eks

# Scan
python3 scripts/arc.py scan --file ./infra/eks/main.tf

# Scaffold + scan in one step
python3 scripts/arc.py validate arc-eks --instance my-cluster

Full command reference:

Command	What it does
list [--sort downloads|name]	All ~60 modules
search <query>	Keyword search across names and descriptions
get <name>	Full module detail: inputs, outputs, resources
inputs <name>	Just the input variables
outputs <name>	Just the exported outputs
resources <name>	AWS resource types the module creates
versions <name>	All releases, latest first
find-by-resource <aws_type>	Every module that provisions e.g. aws_eks_cluster
compare <a> <b>	Side-by-side diff of two modules
scaffold <name> [--instance] [--out]	Generate a 6-file Terraform module
scan --file PATH	tfsec security scan + score out of 100
validate <name>	Scaffold + scan in one step

Use module short names: arc-eks, arc-db, arc-network — not the full registry path.

---

What the skill covers

Every SKILL.md contains 10 sections your agent uses automatically:

Section	What it enables
1. Setup & MCP Configuration	Agent connects to the right tools
2. ARC IaC MCP Tools	All 11 arc_* tools with examples
3. Discovery Workflow	Decision trees: which module for which need
4. Terraform Development	Module composition, state management, testing
5. Multi-Environment IaC	dev → staging → prod promotion, CI/CD pipelines
6. Security Scanning	Severity levels, auto-remediation, compliance checklists
7. Git	Safe staging rules, destructive command guardrails
8. GitHub CLI (gh)	PR review, consent-gated mutations
9. GitLab CLI (glab)	MR review, consent-gated mutations
10. Troubleshooting	Terraform errors, MCP issues, version promotion

---

Repository structure

arc-iac-agent-skills/
│
├── kiro-arc-iac/
│   └── SKILL.md                  ← Skill for Kiro
│
├── claude-arc-iac/
│   └── SKILL.md                  ← Skill for Claude Code CLI
│
├── cursor-arc-iac/
│   └── SKILL.md                  ← Skill for Cursor
│
├── integrations/
│   ├── copilot-instructions.md   ← GitHub Copilot
│   ├── GEMINI.md                 ← Gemini CLI
│   ├── windsurf.md               ← Windsurf
│   └── cursor.mdc                ← Cursor (alternative format)
│
├── scripts/
│   └── arc.py                    ← Standalone engine, no dependencies
│
└── references/
    ├── setup.md                  ← MCP connection guide per client
    └── tools.md                  ← Full API field specs and sample responses

---

Adding support for a new agent

1. Copy an existing skill directory: cp -r kiro-arc-iac my-agent-arc-iac
2. Rename it to <agent>-arc-iac/
3. In SKILL.md, update the frontmatter name and description
4. Replace Section 1 (Setup) with your agent's specific config steps
5. Sections 2–10 are universal — leave them as-is

---

License & Attribution

Licensed under the Apache License 2.0 — see LICENSE.

• ARC Terraform modules by SourceFuse
• Security scanning powered by tfsec (Aqua Security)
• MCP server: arc-iac-mcp