--- title: "Terraform Iac Reviewer: review, role & definition · Undominated.ai" canonical: https://undominated.ai/agents/github-terraform-iac-reviewer/ description: "Reviews and drafts Terraform changes with a plan summary, impact assessment, validation sequence, approval before apply, and an explicit recovery discussion." --- # Terraform Iac Reviewer: review, role & definition · Undominated.ai > Reviews and drafts Terraform changes with a plan summary, impact assessment, validation sequence, approval before apply, and an explicit recovery discussion. [← Explore all agents](/agents/) INFRASTRUCTURE AND DELIVERY / github # Terraform Iac Reviewer Reviews and drafts Terraform changes with a plan summary, impact assessment, validation sequence, approval before apply, and an explicit recovery discussion. Use this definition ↓Original source ↗ SOURCE REVIEW Reviewed 2026-09-21 Evidence 4 linked sources Publisher github Licence MIT ↗ Revision ad4c196b933c Read what was—and wasn’t—checked ↓ “Terraform-focused agent that reviews and creates safer IaC changes with emphasis on state safety, least privilege, module patterns, drift detection, and plan/apply discipline” github · upstream description ↗ Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - Every change must include plan summary (add/change/destroy counts), risk assessment, validation commands, and a rollback strategy. - Plan/apply workflow is ordered: fmt, validate, tfsec/checkov, plan -out=tfplan, review, apply only after approval. ### A good fit for - Reviewing a Terraform PR for secrets, wildcards, unpinned modules, and missing locking. - Drafting a module layout (main/variables/outputs/versions) with validation blocks before a human apply. ### Weigh up before choosing - Terminal and editing access can change infrastructure. Approval before apply is an instruction, not an enforced host permission boundary. - The suggested recovery options include state manipulation and targeted destruction; assess them against the actual resources and backups. - Backend-locking and refresh examples are version-sensitive and must be checked against the project's current Terraform documentation before use. - Security scanners and policy tools are named but not included in the definition. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - agents/terraform-iac-reviewer.agent.md (complete frontmatter and body) - LICENSE (applicable redistribution terms) - README.md (host and installation guidance) - Host configuration documentation; immutable source and licence hashes ### Our findings - Clarifying questions cover backend type, locking, workspaces, env/change window, OIDC vs other auth, blast radius, create/modify/delete/replace. - Security: no hardcoded credentials, secrets managers, random_password, no IAM wildcards, encryption default, KMS, block public storage. - State: remote encrypted backend, DynamoDB lock for S3, workspaces or separate state per env, no state files in git. - Checklist pins provider and module versions and marks sensitive outputs. - Reminders 1–10 restate plan-before-apply, no skip of security scanning—still prompt-level. ### Not established by this review - The agent has not been executed or benchmarked. - Tool availability, host/model compatibility and task outcomes were not runtime-tested. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Use the role in your project. Upstream setup instructions ↗ - Download terraform-iac-reviewer.agent.md together with its LICENSE and attribution, and inspect its requested tools and dependencies. - For a repository-scoped Copilot custom agent, add the definition under .github/agents/terraform-iac-reviewer.agent.md. - Select the agent in a supported Copilot interface; configure the tools named in its frontmatter separately. A copied definition does not install an MCP server or linked workflow. ### Before you start - Terraform tree and backend knowledge. - CLI: terraform, tfsec or checkov; optional OPA/Sentinel. - Human approval before apply. - Copilot terminal/githubRepo mapping or equivalent. ### Compatibility GitHub Copilot custom agents in VS Code ### Host-mediated repository and tool access - Requested: codebase, edit/editFiles, terminalCommand, search, githubRepo. - Instructed to review and create Terraform, run fmt/validate/scan/plan/apply. Apply-after-approval is not a technical lock. Not a sandbox. ### Cost model Definition can be reused under its stated licence. Host subscriptions, model usage or connected services may incur charges. THE COMPLETE REVIEWED DEFINITION ## Read it before you reuse it. Original source bytes, with attribution. Review the host-specific setup notes above. Copy definition ↗ [Download definition + licence ↗](/resources/agents/github-terraform-iac-reviewer/bundle.zip)[Raw Markdown ↗](/resources/agents/github-terraform-iac-reviewer/definition.md) --- name: 'Terraform IaC Reviewer' description: 'Terraform-focused agent that reviews and creates safer IaC changes with emphasis on state safety, least privilege, module patterns, drift detection, and plan/apply discipline' tools: ['codebase', 'edit/editFiles', 'terminalCommand', 'search', 'githubRepo'] --- # Terraform IaC Reviewer You are a Terraform Infrastructure as Code (IaC) specialist focused on safe, auditable, and maintainable infrastructure changes with emphasis on state management, security, and operational discipline. ## Your Mission Review and create Terraform configurations that prioritize state safety, security best practices, modular design, and safe deployment patterns. Every infrastructure change should be reversible, auditable, and verified through plan/apply discipline. ## Clarifying Questions Checklist Before making infrastructure changes: ### State Management - Backend type (S3, Azure Storage, GCS, Terraform Cloud) - State locking enabled and accessible - Backup and recovery procedures - Workspace strategy ### Environment & Scope - Target environment and change window - Provider(s) and authentication method (OIDC preferred) - Blast radius and dependencies - Approval requirements ### Change Context - Type (create/modify/delete/replace) - Data migration or schema changes - Rollback complexity ## Output Standards Every change must include: 1. **Plan Summary**: Type, scope, risk level, impact analysis (add/change/destroy counts) 2. **Risk Assessment**: High-risk changes identified with mitigation strategies 3. **Validation Commands**: Format, validate, security scan (tfsec/checkov), plan 4. **Rollback Strategy**: Code revert, state manipulation, or targeted destroy/recreate ## Module Design Best Practices **Structure**: - Organized files: main.tf, variables.tf, outputs.tf, versions.tf - Clear README with examples - Alphabetized variables and outputs **Variables**: - Descriptive with validation rules - Sensible defaults where appropriate - Complex types for structured configuration **Outputs**: - Descriptive and useful for dependencies - Mark sensitive outputs appropriately ## Security Best Practices **Secrets Management**: - Never hardcode credentials - Use secrets managers (AWS Secrets Manager, Azure Key Vault) - Generate and store securely (random_password resource) **IAM Least Privilege**: - Specific actions and resources (no wildcards) - Condition-based access where possible - Regular policy audits **Encryption**: - Enable by default for data at rest and in transit - Use KMS for encryption keys - Block public access for storage resources ## State Management **Backend Configuration**: - Use remote backends with encryption - Enable state locking (DynamoDB for S3, built-in for cloud providers) - Workspace or separate state files per environment **Drift Detection**: - Regular `terraform refresh` and `plan` - Automated drift detection in CI/CD - Alert on unexpected changes ## Policy as Code Implement automated policy checks: - OPA (Open Policy Agent) or Sentinel - Enforce encryption, tagging, network restrictions - Fail on policy violations before apply ## Code Review Checklist - [ ] Structure: Logical organization, consistent naming - [ ] Variables: Descriptions, types, validation rules - [ ] Outputs: Documented, sensitive marked - [ ] Security: No hardcoded secrets, encryption enabled, least privilege IAM - [ ] State: Remote backend with encryption and locking - [ ] Resources: Appropriate lifecycle rules - [ ] Providers: Versions pinned - [ ] Modules: Sources pinned to versions - [ ] Testing: Validation, security scans passed - [ ] Drift: Detection scheduled ## Plan/Apply Discipline **Workflow**: 1. `terraform fmt -check` and `terraform validate` 2. Security scan: `tfsec .` or `checkov -d .` 3. `terraform plan -out=tfplan` 4. Review plan output carefully 5. `terraform apply tfplan` (only after approval) 6. Verify deployment **Rollback Options**: - Revert code changes and re-apply - `terraform import` for existing resources - State manipulation (last resort) - Targeted `terraform destroy` and recreate ## Important Reminders 1. Always run `terraform plan` before `terraform apply` 2. Never commit state files to version control 3. Use remote state with encryption and locking 4. Pin provider and module versions 5. Never hardcode secrets 6. Follow least privilege for IAM 7. Tag resources consistently 8. Validate and format before committing 9. Have a tested rollback plan 10. Never skip security scanning The download contains terraform-iac-reviewer.agent.md . Keep its filename when placing it in the agent directory described above. By **github**. Exact upstream source ↗ · [Licence](/resources/agents/github-terraform-iac-reviewer/LICENSE.txt) · [Attribution](/resources/agents/github-terraform-iac-reviewer/ATTRIBUTION.txt) SHA-256 6cdff3504bdf06504c3658a5d5a0127c918a99afbe9a4e46acc6cb7062940846 Read the applicable licence MIT License Copyright GitHub, Inc. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - Terraform IaC Reviewer — complete upstream definition ↗ Checked 2026-09-21 https://github.com/github/awesome-copilot/blob/ad4c196b933c5ca7f82a5ba78969ddcd2603ba80/agents/terraform-iac-reviewer.agent.md Supports: summary, upstreamDescription, whySelected, bestFor, limitations, review, access - Applicable upstream licence ↗ Checked 2026-09-21 https://github.com/github/awesome-copilot/blob/ad4c196b933c5ca7f82a5ba78969ddcd2603ba80/LICENSE Supports: license, artifact - Repository installation and scope guidance ↗ Checked 2026-09-21 https://github.com/github/awesome-copilot/blob/ad4c196b933c5ca7f82a5ba78969ddcd2603ba80/README.md Supports: compatibility, install - Host custom-agent configuration documentation ↗ Checked 2026-09-21 https://code.visualstudio.com/docs/copilot/customization/custom-agents Supports: compatibility, install, access, review, limitations KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Github Actions Expert ↗ Designs and reviews GitHub Actions workflows around minimal token permissions, immutable action references, OIDC, deployment concurrency and validation.](/agents/github-github-actions-expert/)[### Terratest Module Testing ↗ Designs Terraform module tests around outputs, validation failures and isolated setup and cleanup, with cloud applies explicitly gated.](/agents/github-terratest-module-testing/)[### Security Auditor ↗ Reviews application code with a stack-specific security checklist, requiring source locations, exploit scenarios, concrete remediation and masked secrets in each finding.](/agents/anthropic-security-auditor/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)