Scaffolding Modules and Policies

Beating the Blank Page

The hardest part of writing a new Terraform module is getting the initial structure right — deciding which resources to use, how to wire variables to arguments, what outputs to expose. LLMs excel at this initial scaffolding because the structural patterns for common resources are well-represented in their training data.

The workflow is: generate a complete draft, then apply your organization's standards on top of it. You are not accepting the output wholesale — you are using it as a starting point that's faster than typing from scratch.

Example Prompt:

"Create a Terraform module for an AWS S3 bucket using provider 5.x. It should support versioning, AES-256 server-side encryption via a separate resource block, and have a boolean variable enable_access_logging that conditionally creates an aws_s3_bucket_logging resource. Block all public access. Output main.tf, variables.tf, and outputs.tf."

The AI will likely generate 85–90% of the code correctly. Your job is to fill in the remaining 10–15%: applying your naming conventions, adding required tags, verifying that every argument actually exists in the provider version you're using, and checking that security defaults meet your organization's standards.

The "Rego" Shortcut

OPA's Rego policy language has a steep learning curve. The syntax is unfamiliar, the evaluation model (partial evaluation, virtual documents) is non-obvious, and examples in the wild are sparse. Generative AI significantly flattens this curve.

Example Prompt:

"Write a Rego policy for use with conftest that evaluates a Terraform plan JSON. The policy should be in the package terraform.security and deny any aws_security_group_rule or aws_security_group resource that allows ingress from 0.0.0.0/0 or ::/0 on port 22. Include a human-readable deny message."

This turns a 2-hour research-and-trial-and-error task into a 5-minute prompt-and-verify task. The critical word is verify — you still need to run the generated policy against a real Terraform plan to confirm it catches what it should and doesn't produce false positives.

Verification Is Non-Negotiable

For every piece of AI-generated IaC, the verification workflow is the same:

Generate → Read every line → terraform validate → terraform plan → policy check → peer review

terraform validate catches syntax errors and unknown arguments. terraform plan catches logical errors (wrong resource types, missing dependencies). Your policy pipeline catches security and compliance violations. Peer review catches organizational context errors that automated tools miss.

Skipping any of these steps because "the AI generated it" is how you ship a misconfigured security group to production.