AI can write a working Terraform module in seconds, but “working” and “safe to apply against production” are two different bars — the fastest way to lose an afternoon is to paste AI-generated infrastructure-as-code straight into a `terraform apply` without a plan review. The prompts below are built around getting useful, reviewable Terraform out of AI while keeping the security and blast-radius checks that infrastructure code specifically demands.
Why Is AI-Generated Terraform Riskier Than AI-Generated App Code?
A bug in application code usually breaks a feature. A bug in Terraform can open a security group to the entire internet, delete a database, or provision resources that quietly rack up cost for weeks before anyone notices. AI models are also prone to generating configuration based on outdated provider syntax or deprecated resource arguments, since infrastructure providers change their schemas frequently. Treating AI-written Terraform like a junior engineer’s first pull request — never merged without review — isn’t overly cautious, it’s the baseline for infrastructure code regardless of who or what wrote it.
What’s a Good Prompt for Generating a New Terraform Module?
Be specific about provider, region, and constraints up front rather than iterating from a vague first draft:
“Write a Terraform module for [cloud provider] that provisions [specific resources, e.g. ‘an S3 bucket with versioning enabled and a CloudFront distribution in front of it’]. Requirements: use variables for anything environment-specific (region, bucket name, tags), do not hardcode any credentials or account IDs, follow the official Terraform style guide for formatting and naming, add a description to every variable and output, and default to the most restrictive security settings (private access, encryption at rest) unless I specify otherwise. After the code, list any assumptions you made that I should verify.”
That last instruction is one of the most useful — it forces the model to surface where it filled gaps with a guess, which is exactly where hallucinated arguments or deprecated syntax tend to hide. Formatting and naming conventions matter more than they might seem — HashiCorp’s own Terraform style guide is worth pointing the model at directly if your team has strict conventions it should follow.
How Do You Prompt AI to Review Terraform for Security Issues?
Before you run `terraform plan`, use a separate prompt purely for review — don’t trust the model that wrote the code to also be its only reviewer:
“Review this Terraform configuration for security issues: [paste config]. Specifically check for: open ingress rules (0.0.0.0/0) that aren’t clearly intentional, resources without encryption enabled where the provider supports it, IAM policies broader than the resource needs, hardcoded secrets or credentials, and any missing tags that would make this resource hard to track for cost or ownership. For each issue found, explain the specific risk and suggest the minimal fix.”
This mirrors the same principle behind our broader guide to AI code review prompts for catching bugs before they ship — a second, differently-scoped pass catches what the generation pass misses, because it’s looking for different things.
How Should You Make Iterative Changes Instead of Rewriting Everything?
Large single-prompt infrastructure requests are harder to review and more likely to contain a buried mistake. Smaller, incremental prompts against existing code produce diffs you can actually reason about:
- “Add KMS encryption to this RDS instance without changing anything else about the resource.”
- “Add access logging for this ALB, writing to an S3 bucket. Create the bucket if it doesn’t exist in this file.”
- “Add a lifecycle rule to this S3 bucket that transitions objects to Glacier after 90 days.”
Each of these produces a small, reviewable diff rather than a wholesale rewrite — the same discipline that makes AI-assisted container configuration manageable, covered in our guide to AI prompts for writing Dockerfiles and container configs.
Frequently Asked Questions
Is it safe to let AI run `terraform apply` directly?
No — always run `terraform plan` first and have a human review the plan output before applying, regardless of who or what generated the configuration. The plan step exists specifically to catch unintended changes before they happen, and skipping it defeats the purpose of infrastructure as code.
Why does AI sometimes generate Terraform with deprecated arguments?
Cloud provider APIs and Terraform provider schemas change frequently, and a model’s training data has a cutoff — it may not reflect the most recent provider version. Always run `terraform validate` and check the provider’s current documentation for any resource type you’re not deeply familiar with before applying.
Should I ever paste real credentials or account IDs into an AI prompt?
No. Use placeholder values or variables in any Terraform you share with an AI tool, and keep real secrets in a secrets manager or vault referenced by variable, never typed directly into a prompt or committed to the configuration itself.
