Every time I opened Claude Code I was typing the same paragraph: “new post goes to _posts, file name starts with the date, front matter looks like this, build to a temp dir, don’t touch docs/”. Then I discovered that this paragraph has a proper home. It is called a skill, it is one Markdown file, and the agent loads it on its own when the task matches. This post is the five minute version: what a skill is, where it lives, and two examples worth copying.

In the previous post I compared the options for blocking egress to specific domains from an EKS cluster, and concluded that Route 53 Resolver DNS Firewall is the cheapest seatbelt you can put on a VPC. Talk is cheap though, so here is the whole thing as working OpenTofu code: a custom blocklist, the rule group, the VPC association, fail-mode configuration and query logging so you can actually see what gets blocked. Tested with OpenTofu 1.12.

A seemingly simple requirement: “pods in our EKS cluster must not be able to talk to evil-domain.com” (or the reverse - “must only be able to talk to an allowlist of domains”). Simple to say, surprisingly annoying to implement, because classic AWS network controls - security groups, NACLs - speak IP, not DNS. A domain can resolve to hundreds of rotating IPs behind a CDN, so blocking by IP is a losing game. Here is a rundown of the options that actually work with FQDNs, and what each one really gives you.

In my previous post I wrote about migrating from Terraform to OpenTofu and I mentioned that OpenTofu is not just a passive fork anymore. Today I want to show you a concrete example of that: a small feature that removes one of the oldest and ugliest hacks in the Terraform world - conditional resource creation via count. The feature is called enabled, it lives in the lifecycle block, it shipped in OpenTofu 1.11, and Terraform simply does not have it.

I have been a Terraform user since the early days - I mentioned on this blog years ago that I was an early adopter, and that has not changed. Infrastructure as Code is simply how I work. But over the last couple of years something important happened in that ecosystem, and recently I went through a full migration from Terraform to OpenTofu in a few production environments. In this post I want to share why we did it, how it went, and what surprised me along the way.