The Terraform Trust Gap: Engineering the Space Between Prompts and Production

Agents can already write Terraform. That was never the hard part. The hard part is that the context going in is stale and the apply coming out is too easy to hand over, so you get code that looks right, passes your linters, even terraform plan passed, but still it quietly does the wrong thing in production.

This talk runs one module everyone knows, terraform-aws-modules/s3-bucket, through the whole chain live. First I give the agent a real contract instead of a README and watch the hallucinated config disappear. Then I take one of the module’s own examples and turn it into a fixture that fails the moment it drifts from the module. Then I let the agent plan changes but not apply them. A human has to approve the plan first, and apply only runs on the approved one. On stage the agent tries to apply by itself and you watch it get blocked.

You leave with three things to do on Monday, every pattern working with open tooling, and an honest feedback of where the chain still breaks. No vendor account, no prompt magic.