Table of Contents
Quick Answer
Describe your infrastructure in plain English with the cloud provider name, and AI writes Terraform↗, Pulumi, or OpenTofu code. Always review IAM policies, security groups, and state backend configuration.
- AI knows major providers well (AWS, GCP, Azure, Hetzner, DigitalOcean)
- Modules, remote state, and workspaces need human architecture decisions
- Never run terraform apply from AI output without terraform plan review
What You'll Need
- Cloud provider account with API credentials
- Terraform or OpenTofu installed (tofu is the FOSS fork)
- State backend (S3, GCS, Terraform Cloud, or local for dev)
- AI IDE or CLI
Steps
- Describe desired state. Prompt: Write Terraform for a Hetzner CAX41 VPS, floating IP, and firewall allowing 22, 80, 443.
- Organize with modules. Ask: Refactor into reusable modules with clear input variables.
- Add remote state. Prompt: Add a backend block using S3 with DynamoDB locking.
- Parameterize environments. One root per env (envs/prod, envs/staging) with shared modules.
- Run terraform plan. Review every resource carefully.
- Secrets management. Inject via TF_VAR_* env vars or SOPS. Never commit .tfvars with secrets.
- Apply with approval. CI pipeline: plan on PR, apply on main merge with manual approval gate.
- Drift detection. Schedule nightly terraform plan — alert on drift.
Common Mistakes
- Hardcoded secrets in .tf. Use a secrets manager.
- count instead of for_each. for_each is safer for refactors.
- Overly permissive IAM. AI defaults to * actions. Narrow manually.
- No tags. Every resource should have environment, owner, cost-center tags.
Top Tools
Tool
Use
Terraform / OpenTofu
IaC runtime
Infracost
Cost estimation in PRs
tflint
Lint
Atlantis
PR-based workflow
Pulumi
Typed IaC (TS/Python/Go)
FAQs
Should I pick Terraform or OpenTofu? OpenTofu — FOSS, same syntax, actively developed post-license change.
Can AI write Pulumi? Yes — TypeScript Pulumi is easier for AI than HCL since it reuses its JS/TS strengths.
Does AI handle multi-region? Yes, via provider aliases. Specify regions in the prompt.
What about Kubernetes manifests? Both Terraform's kubernetes provider and kubectl manifests work. Helm charts too.
How do I test Terraform? Terratest (Go) or checkov for static analysis.
Does AI know about cost optimization? Yes — ask: Suggest cost optimizations for this architecture.
Conclusion
AI removes the cold-start problem of IaC. Start from a rough prompt, harden with a human security review, lock with a remote state backend. Misar Dev↗ scaffolds Coolify + Hetzner Terraform setups in minutes.