AI Can Draft IaC: Output Is a Starting Point
With Amazon Bedrock, teams can input high-level architectural descriptions and receive baseline Terraform and CloudFormation scripts tailored to organizational needs, with compliance and security best practices integrated. AWS positions these scripts as a foundational starting point that requires further refinement and validation before production.
Unguided AI output fails in predictable ways: hardcoded values, monolithic files, permissive IAM policies, missing encryption, and no automated tests or policy checks. The Terraform plan/apply cycle stays deterministic; AI accelerates the drafting phase, so what changes is how quickly configuration reaches the pipeline and how much human review remains. Because AI-generated Terraform ships faster than most teams can review it, automated policy checks, security scanning, and drift detection become more important, not less.
The effective pattern pairs AI with purpose-built IaC skills and agentic pipelines that enforce Terraform conventions, validate plans, and run security and cost checks before anything reaches production. Such a pipeline runs terraform validate, tflint, and a security scanner on each proposed change before the plan reaches a human.
Validate Before You Apply: Plan and Lint
Run terraform plan to review proposed changes and catch destructive actions before apply. AI assistants can explain failed plans and flag insecure defaults. Run tflint on AI-generated HCL to catch convention violations before the plan step. The same tension between speed and reliability appears in unit tests with AI. The plan output includes a summary of resources to be created, modified, or destroyed, giving the reviewer a clear picture of the impact before execution.
For CloudFormation, run cfn-lint on templates to catch convention violations, validate templates before using them, and create change sets before updating stacks. Drift detection catches the gap between the declared configuration and what actually exists, which matters more when AI drafts the declaration. Drift detection compares the live stack to the template and reports any differences, so a reviewer can spot changes that were made outside the pipeline. Change sets show the exact resources that will be added, modified, or removed, so the reviewer sees the full blast radius before execution.
Policy-as-Code and Security Scanning
Pair AI-generated IaC with policy-as-code tools like OPA or Checkov to enforce security and compliance rules. AWS CloudFormation Guard is a native policy-as-code option for CloudFormation that enforces compliance rules before deployment. These tools run as automated gates at the point where the plan is generated, not as post-hoc audits. For example, a policy can require that all S3 buckets have encryption enabled, catching a missing encryption flag before apply. Another policy can require that IAM policies contain no wildcard actions, preventing over-permissive roles. Checkov scans Terraform HCL and CloudFormation templates for misconfigurations before apply, while OPA policies can gate plans in CI. Apply the principle of least privilege with IAM policies.
The Human Review Loop for Stateful and Irreversible Changes
Maintain a human review loop for stateful resources and irreversible changes such as database deletion or IAM role modifications. AI can flag destructive changes, but final approval for irreversible actions must remain manual. The distinction matters: a plan that deletes a database is not the same as a plan that adds a tag. Stateful resources carry data and identity. A mistake in their configuration can cause data loss or lockout that no rollback can undo. Define the approval threshold in advance: any plan that touches a database, IAM, or a production environment requires a named human approver. That rule is simple to state and easy to enforce with a script or a ticketing step. For example, a database deletion plan triggers an automatic hold until a named approver signs off. An IAM role modification that could lock out administrators also requires the same approval.
