infra-code-review

# Reviewing Infrastructure-as-Code Changes

This skill reviews IaC changes in the local working tree — before they hit `plan`/`apply`/`deploy`. One bad infra change can take down production, expose data to the internet, or run up a six-figure cloud bill. The blast radius is higher than application code.

**Review philosophy:** Infra changes are high-leverage. A one-line security group change can expose every instance in a VPC. Focus on: blast radius, network exposure, IAM/RBAC scope, data destruction, cost impact, and secret leakage. Explain risk in operational terms — "this opens port 22 to 0.0.0.0/0 on all production instances" not "this security group is too open."