kiro-steering-module-creation-workflow

kiro-steering-module-creation.md

inclusion	manual

Module Creation Workflow

When creating a fully implemented OpenTofu module, follow this workflow.

Steps

1. Ask: "What should this module do?" — get a description of AWS resources and behavior
2. Ask for a module name (kebab-case, validate against ^[a-z][a-z0-9]*(-[a-z0-9]+)*$, no conflicts with existing modules/ dirs)
3. Create all 5 files in modules/{name}/
4. Run tofu fmt on the module directory
5. Ask if deployment wiring is needed

File Generation Rules

versions.tf

• Use the standard provider pinning block from opentofu.md steering

variables.tf

• All variables needed for the resources
• Always include tags variable (map(string), default {})
• Add validation blocks for constrained inputs (CIDRs, enums, ranges)
• Use snake_case with descriptive prefixes

main.tf

• Real, production-ready resource definitions (not placeholders)
• Use this as resource name for single-resource modules
• Apply var.tags to ALL taggable resources using merge(var.tags, { Name = "..." })
• Prefer for_each over count for collections
• Use locals for computed/derived values
• Follow AWS best practices: encryption at rest, least-privilege IAM, logging where appropriate

outputs.tf

• Meaningful outputs consumers would need (IDs, ARNs, endpoints, names)
• Include description for every output

README.md

• Title-cased module name as heading
• Purpose description from user input
• <!-- BEGIN_TF_DOCS --> / <!-- END_TF_DOCS --> markers

Deployment Wiring (if requested)

• Ask for target account and region (verify live/{account}/{region}/env.hcl exists)
• Add module variables to env.hcl locals (prefixed with module context)
• Add module to skip_module map (snake_case form, value false)
• Create live/{account}/{region}/{module-name}/terragrunt.hcl:
  • source = "../../../../modules/{name}"
  • Include root.hcl
  • Include env.hcl with expose = true, merge_strategy = "no_merge"
  • Map inputs from include.env.locals.*
  • Always pass tags = include.env.locals.tags
  • Add exclude block referencing skip_module.{snake_case_name}

Additional Conventions

• Never use wildcard * in IAM policy Resource fields — scope to specific ARNs
• If the module creates IAM roles, always add a permissions_boundary variable (optional, default null)
• If creating S3 buckets, enable versioning and SSE by default
• If creating security groups, use separate aws_security_group_rule resources (not inline rules)