How to Safely Review AI-Generated Terraform Code Before It Destroys Your Infrastructure

AI tools like GitHub Copilot can assist with writing Terraform configuration, but accepting generated code without review risks serious infrastructure damage, including accidental database deletion. Running terraform validate only checks schema correctness and does not flag insecure settings like open S3 buckets or permissive IAM policies, so additional scanners such as checkov or tfsec are essential in CI pipelines. Engineers should always search plan output for the phrase 'forces replacement', which signals a delete-then-recreate operation that can cause data loss on stateful resources like RDS instances or EBS volumes. Copilot tends to default to count-based resource iteration, which tracks resources by index and can silently destroy and re-create infrastructure when list items are removed, whereas for_each tracks by key and is safer for collections. Other common pitfalls include omitting validation blocks on bounded variables and misplacing checkov skip comments outside resource blocks, where they are silently ignored by the scanner.