## agentic-workflows-blueprint.workflow.iac
### Goal
Manage Infrastructure as Code changes through deterministic plan/apply validation, policy gates, and drift-aware operations.
### Scope
- Applies to: Terraform/OpenTofu/CloudFormation-style infrastructure definitions, modules, policies, and environment state management.
- Does not cover: manual infrastructure changes that bypass IaC workflows.
### Triggers
- "Apply Terraform/OpenTofu change"
- "Review IaC plan"
- "Handle drift with Infrastructure as Code"
- "Create IaC delivery workflow"
### Inputs
- `iacTool` (Terraform, OpenTofu, etc.)
- `workspaceOrEnvironment`
- `stateBackendContext`
- `planScope`
- `policyChecks` (security/cost/compliance)
- `rollbackStrategy`
### Invariants
- No `apply` without reviewed plan output.
- Policy checks must pass or be explicitly waived with rationale.
- State operations must be serialized and auditable.
- Drift detection must be acknowledged before execution.
### Procedure
1. Initialize environment and validate backend/state lock readiness.
2. Run format/validate checks for IaC definitions.
3. Generate plan and summarize resource-level impact.
4. Run policy and security checks.
5. Obtain approval for apply scope.
6. Execute apply and capture outputs.
7. Run post-apply verification and drift snapshot.
### Outputs
- IaC validation and plan report.
- Policy/security check summary.
- Apply execution evidence.
- Drift and rollback notes for handoff.
### Review gate
- [ ] Plan is reviewed and traceable to requested change.
- [ ] Policy/security checks are passed or justified.
- [ ] Apply outputs and post-check evidence exist.
- [ ] Drift status is documented.
### References
- `../../SKILL.md`
- `../infra-operations/SKILL.md`
- `../review/SKILL.md`
