Introduction: The Copilot Era

From Writer to Reviewer

For the entire history of Infrastructure as Code, the engineer's job was to stare at a blank screen and type resource "aws_instance" .... Every variable, every block, every argument — typed by hand, looked up in documentation, and debugged through trial and error.

With the rise of Large Language Models (LLMs) like GPT-4, Claude, and GitHub Copilot, the workflow has fundamentally shifted. The blank page problem is largely solved. You describe what you want in plain English, and a draft appears in seconds.

You are no longer just the Writer. You are now the Architect and Reviewer.

This is not a minor productivity improvement. It changes what skills matter most. The engineer who can write Terraform from memory is less differentiated than before. The engineer who can critically evaluate generated code, catch subtle errors, and guide an AI toward production-quality output is now the scarce resource.

What AI is Good At

LLMs are excellent at two categories of IaC work: Scaffolding and Translation.

Scaffolding means generating the initial structure of something you'd otherwise build from scratch. "Write a boilerplate VPC module with 3 public subnets and 3 private subnets, with NAT gateways in each AZ" — a task that would take an experienced engineer 20–30 minutes of typing and documentation-checking — takes an LLM about 10 seconds. The output won't be perfect, but it gives you a concrete starting point to refine rather than a blank file to fill.

Translation means converting infrastructure definitions between formats or languages. "Convert this 400-line CloudFormation JSON template into Terraform HCL" is tedious, error-prone work for a human. An LLM handles it in one shot, and you spend your time verifying the output rather than doing mechanical conversion.

Policy Syntax is a third high-value use case. Languages like OPA's Rego or Sentinel have steep learning curves and sparse examples. An LLM can bridge the skill gap: "Write an OPA Rego rule that denies any Terraform plan that creates an S3 bucket without server-side encryption" produces a working starting point even if you've never written a line of Rego.

What AI Gets Wrong

AI lacks two things that are critical for production infrastructure: context and truth.

It has no context about your organization. It doesn't know your naming conventions, your tagging strategy, your network topology, or your compliance requirements — unless you explicitly provide that information in the prompt. Code generated without this context will be structurally correct but organizationally wrong.

It has no guaranteed truth. LLMs predict statistically likely text based on training data. They do not consult live documentation. They will confidently generate Terraform arguments that do not exist, reference provider versions that have been deprecated, and reproduce security anti-patterns that were common in tutorials three years ago. The output looks authoritative. It is not.