Govern AI agents on Terraform
Control AI agents that plan and apply Terraform changes. The Terraform pack enforces approval gates before infrastructure modifications, validates plans against policy, and ensures every IaC change is auditable.
What this pack does
- Pre-apply policy checks on Terraform plans
- Approval gates before infrastructure changes
- Blast-radius estimation from plan output
- Full audit trail of IaC modifications
Use cases
Require approval before agents apply production changes
Block agents from destroying critical resources
Audit all AI-initiated infrastructure modifications
Quick setup
- 1Install the Terraform pack: cordumctl pack install terraform
- 2Configure Terraform backend and credentials
- 3Define policy rules for resource types
- 4Enable the pack and test with terraform plan
Frequently asked questions
Can agents run a plan but not apply it?
Yes. Plan, show, validate, and output are read actions allowed by default, while apply is a write action that requires approval. An agent can produce a plan for review without being able to mutate infrastructure on its own.
How does Cordum gate a Terraform apply?
Pre-apply policy checks evaluate the plan before any apply runs, and the Safety Kernel returns Require Approval or Deny for changes that need oversight. Production applies are held until a reviewer signs off, so no infrastructure change happens unattended.
Can I keep agents out of certain directories or stop them destroying critical resources?
Yes. The worker enforces directory scoping so agents only touch the Terraform working directories you allow, and you can write policy to deny destroys of critical resource types. Blast radius is estimated from the plan output so a reviewer sees the impact before approving.
What audit trail do we get for infrastructure-as-code changes?
Every plan and apply, along with its governance decision and approver, is recorded in the audit trail. That gives you a complete, reviewable history of which agent proposed and applied each IaC change.
Ready to govern Terraform?
Other integrations
Approval notifications and agent alerts in Slack channels.
Govern AI agent actions on GitHub repositories.
Govern AI agent read and write actions against the AWS API.
Governance for AI agents managing Jira workflows.
Govern AI agents responding to Kubernetes incidents.
Feed Datadog alerts into governed agent workflows.