kiro-check-best practices

kiro-check-best practices.json

{
  "enabled": true,
  "name": "Check Best Practices",
  "description": "Reviews saved Terraform and Terragrunt files against IaC best practices, checking for security issues, missing encryption, overly permissive IAM, missing tags, and other common mistakes.",
  "version": "1",
  "when": {
    "type": "fileEdited",
    "patterns": [
      "**/*.tf",
      "**/*.hcl"
    ]
  },
  "then": {
    "type": "askAgent",
    "prompt": "Review the saved file against IaC best practices. Check for:\n- Missing encryption at rest (S3, EBS, RDS, DynamoDB)\n- Overly permissive IAM policies (wildcard actions or resources)\n- Security groups with wide-open ingress (0.0.0.0/0 on sensitive ports)\n- Missing tags (all resources must have tags applied via var.tags)\n- Missing lifecycle policies or backup configurations\n- Hardcoded values that should be variables\n- Resources without descriptions on variables/outputs\n- Missing validation blocks on constrained inputs\n\nFollow the project's OpenTofu and Terragrunt conventions from steering. If issues are found, list them concisely with suggested fixes. If the file looks good, say so briefly."
  }
}