Ship it

Change infrastructure

Turn a plain-language infrastructure request into reviewed Terraform or OpenTofu, and keep your environment in sync with it.

Tell your agent what infrastructure you need, and it stops at a plan for you to read.

Describe what you need

Say what you want in plain words:

Provision an S3 bucket with versioning enabled and a lifecycle policy that moves objects to Glacier after 90 days.

The agent runs the generate-iac skill and first checks that your team has recorded the decisions that govern this area, such as network exposure or how pipelines get permission. Deciding before generating explains why.

Approve the decision

If nothing governs the area yet, the agent stops and asks instead of inventing a policy. Answer its question, then approve:

Record that decision as an ADR and continue.

The agent writes the decision record, such as docs/adr/0042-vpc-design.md, and moves on to the code.

Review the plan

The agent writes the .tf files, runs terraform fmt, terraform validate, a policy check, and a security check, then saves a terraform plan with a fingerprint so it cannot change after you read it. Ask to see it:

Show me the plan and anything it will destroy.

The agent summarises each change and flags anything that deletes data or cannot be undone. A clean plan shows a change will apply, not that the result works. What the preview cannot tell you covers the gaps. You run terraform apply yourself, or your pipeline does. The agent never applies, never reads secrets, and never touches state files.

Check for drift

Before the next change, or on a schedule, ask whether the real environment still matches your code:

Check whether my infrastructure has drifted from the last plan.

The agent runs reconcile-iac, lists each drifted resource, and proposes to accept, correct, or defer it. You choose, and nothing is applied. Infrastructure in the release loop shows how this fits the rest of your release.

Next, release the change.