Agents can already write Terraform. That was never the hard part. The hard part is that the context going in is stale and the apply coming out is too easy to hand over, so you get code that looks right, passes your linters, even terraform plan passed, but still it quietly does the wrong thing in production.

This talk runs one module everyone knows, terraform-aws-modules/s3-bucket, through the whole chain live. First I give the agent a real contract instead of a README and watch the hallucinated config disappear. Then I take one of the module's own examples and turn it into a fixture that fails the moment it drifts from the module. Then I let the agent plan changes but not apply them. A human has to approve the plan first, and apply only runs on the approved one. On stage the agent tries to apply by itself and you watch it get blocked.

You leave with three things to do on Monday, every pattern working with open tooling, and an honest feedback of where the chain still breaks. No vendor account, no prompt magic.

Target Audience:
Mid to senior DevOps, platform, SRE, and AI-engineering practitioners who run Terraform daily and have used coding agents on real modules. Best fit for people who have seen an agent make a confident Terraform mistake and are now deciding where agents belong in infrastructure delivery.

Prerequisites:
Comfort with Terraform modules, plan/apply, CI/CD, and basic review workflows. Some exposure to a coding agent (Claude, Cursor, Copilot). No AI or ML background required.

Preferred session duration: 45 minutes + Q&A