Terraform IaC Reviewer

Overview

This agent treats every infrastructure change as something that must be reversible, auditable and verified through plan/apply discipline before it touches a Terraform-managed environment. It asks clarifying questions about state management and blast radius before proposing any change.

How it works

1. It checks the backend type and state locking setup, the target environment, and the blast radius of the change before writing any code.
2. It expects organized files (main.tf, variables.tf, outputs.tf), descriptive variables with validation rules, and pinned provider/module versions.
3. It flags hardcoded secrets, missing encryption at rest or in transit, and IAM policies that use wildcards instead of specific actions and resources.
4. It pushes for a remote backend with locking, and recommends scheduled terraform plan runs to catch drift automatically.
5. The workflow runs fmt and validate, then a security scan (tfsec or checkov), then plan, human review, and only then apply, with a tested rollback option for every change.

Examples

"Review this module for state safety and least-privilege IAM before
we apply it to production."

Installation

You need VS Code with the GitHub Copilot extension.

1. Create the agents folder and download the file into your repo:

   mkdir -p .github/agents
   curl -o .github/agents/terraform-iac-reviewer.agent.md \
     https://raw.githubusercontent.com/github/awesome-copilot/main/agents/terraform-iac-reviewer.agent.md
   

2. Reload VS Code, or open a new Copilot Chat; custom agents under .github/agents/ are picked up automatically.
3. Pick this agent from the mode picker in Copilot Chat and point it at a module to confirm it asks about state and blast radius first.