How to Automate Terraform v1.x Plan Validation with AI

# AI analyzes and validates Terraform configurations

# ❌ Problematic configuration with security issues
resource "aws_s3_bucket" "data_bucket" {
  bucket = "my-company-data-${random_string.suffix.result}"
  
  # AI detects: Missing encryption
  # AI detects: No versioning enabled
  # AI detects: No access logging
}

resource "aws_s3_bucket_policy" "data_bucket_policy" {
  bucket = aws_s3_bucket.data_bucket.id
  
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "PublicReadGetObject"
        Effect    = "Allow"
        Principal = "*"  # AI detects: Dangerous public access
        Action    = "s3:GetObject"
        Resource  = "${aws_s3_bucket.data_bucket.arn}/*"
      },
    ]
  })
}

# ✅ AI-secured configuration
resource "aws_s3_bucket" "data_bucket" {
  bucket = "my-company-data-${random_string.suffix.result}"
  
  tags = {
    Environment = var.environment
    Owner       = "infrastructure-team"
    CostCenter  = "engineering"
  }
}

# AI suggests: Separate encryption configuration
resource "aws_s3_bucket_server_side_encryption_configuration" "data_bucket_encryption" {
  bucket = aws_s3_bucket.data_bucket.id

  rule {
    apply_server_side_encryption_by_default {
      kms_master_key_id = aws_kms_key.s3_key.arn
      sse_algorithm     = "aws:kms"
    }
    bucket_key_enabled = true
  }
}

# AI suggests: Enable versioning
resource "aws_s3_bucket_versioning" "data_bucket_versioning" {
  bucket = aws_s3_bucket.data_bucket.id
  versioning_configuration {
    status = "Enabled"
  }
}

# AI suggests: Secure bucket policy
resource "aws_s3_bucket_policy" "data_bucket_policy" {
  bucket = aws_s3_bucket.data_bucket.id
  
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "DenyInsecureConnections"
        Effect    = "Deny"
        Principal = "*"
        Action    = "s3:*"
        Resource = [
          aws_s3_bucket.data_bucket.arn,
          "${aws_s3_bucket.data_bucket.arn}/*",
        ]
        Condition = {
          Bool = {
            "aws:SecureTransport" = "false"
          }
        }
      },
      {
        Sid       = "RestrictToVPCEndpoint"
        Effect    = "Deny"
        Principal = "*"
        Action    = "s3:*"
        Resource = [
          aws_s3_bucket.data_bucket.arn,
          "${aws_s3_bucket.data_bucket.arn}/*",
        ]
        Condition = {
          StringNotEquals = {
            "aws:SourceVpce" = aws_vpc_endpoint.s3.id
          }
        }
      }
    ]
  })
}

# AI analyzes cost implications and suggests optimizations

# ❌ Cost-inefficient configuration
resource "aws_instance" "web_servers" {
  count         = 10
  ami           = "ami-0123456789abcdef0"
  instance_type = "m5.2xlarge"  # AI detects: Oversized for workload
  
  # AI detects: No spot instance usage
  # AI detects: Always-on instances
  
  root_block_device {
    volume_type = "gp3"
    volume_size = 500  # AI detects: Oversized storage
  }
}

# ✅ AI-optimized cost configuration
resource "aws_launch_template" "web_server_template" {
  name_prefix   = "web-server-"
  image_id      = data.aws_ami.optimized.id
  instance_type = "m5.large"  # AI suggests: Right-sized instance
  
  # AI suggests: Mixed instance policy for cost savings
  instance_market_options {
    market_type = "spot"
    spot_options {
      max_price = "0.10"
    }
  }
  
  block_device_mappings {
    device_name = "/dev/xvda"
    ebs {
      volume_type = "gp3"
      volume_size = 50   # AI suggests: Right-sized storage
      throughput  = 125  # AI suggests: Optimized IOPS
      iops        = 3000
      encrypted   = true
    }
  }
  
  tag_specifications {
    resource_type = "instance"
    tags = {
      Name        = "web-server"
      Environment = var.environment
    }
  }
}

# AI suggests: Auto Scaling Group for dynamic sizing
resource "aws_autoscaling_group" "web_servers" {
  name                = "web-servers-asg"
  vpc_zone_identifier = var.private_subnet_ids
  target_group_arns   = [aws_lb_target_group.web.arn]
  
  min_size         = 2   # AI suggests: Minimum for HA
  max_size         = 10
  desired_capacity = 3   # AI suggests: Start smaller
  
  # AI suggests: Mixed instances for cost optimization
  mixed_instances_policy {
    launch_template {
      launch_template_specification {
        launch_template_id = aws_launch_template.web_server_template.id
        version           = "$Latest"
      }
      
      override {
        instance_type     = "m5.large"
        weighted_capacity = "1"
      }
      override {
        instance_type     = "m5a.large"
        weighted_capacity = "1"
      }
    }
    
    instances_distribution {
      on_demand_base_capacity                  = 1
      on_demand_percentage_above_base_capacity = 25
      spot_allocation_strategy                 = "capacity-optimized"
    }
  }
}

# AI validates compliance and governance requirements

# AI-generated compliance validation
locals {
  # AI suggests: Centralized tagging strategy
  required_tags = {
    Environment = var.environment
    Owner       = var.owner
    CostCenter  = var.cost_center
    Project     = var.project
    Backup      = var.backup_required
  }
  
  # AI suggests: Security group validation
  allowed_cidr_blocks = var.environment == "production" ? 
    ["10.0.0.0/8"] : ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
}

# AI-generated security group with validation
resource "aws_security_group" "application" {
  name_prefix = "${var.project}-app-"
  vpc_id      = var.vpc_id
  
  # AI enforces: Only required ports
  dynamic "ingress" {
    for_each = var.allowed_ports
    content {
      description = "Allow ${ingress.value.description}"
      from_port   = ingress.value.port
      to_port     = ingress.value.port
      protocol    = "tcp"
      cidr_blocks = local.allowed_cidr_blocks
      
      # AI validation: No 0.0.0.0/0 in production
      lifecycle {
        precondition {
          condition = !(var.environment == "production" && 
                       contains(ingress.value.cidr_blocks, "0.0.0.0/0"))
          error_message = "Production security groups cannot allow 0.0.0.0/0"
        }
      }
    }
  }
  
  egress {
    description = "All outbound traffic"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
  
  tags = merge(local.required_tags, {
    Name = "${var.project}-application-sg"
  })
  
  # AI validation: Ensure all required tags are present
  lifecycle {
    precondition {
      condition = alltrue([
        for tag_key in keys(local.required_tags) :
        contains(keys(merge(local.required_tags, { Name = "${var.project}-application-sg" })), tag_key)
      ])
      error_message = "All required tags must be present"
    }
  }
}

# AI-generated validation rules
resource "aws_config_configuration_recorder" "compliance" {
  count    = var.enable_compliance_monitoring ? 1 : 0
  name     = "${var.project}-compliance-recorder"
  role_arn = aws_iam_role.config_role[0].arn
  
  recording_group {
    all_supported                 = true
    include_global_resource_types = true
  }
}

# AI suggests: Config rules for compliance
resource "aws_config_config_rule" "s3_bucket_encryption" {
  count = var.enable_compliance_monitoring ? 1 : 0
  name  = "s3-bucket-server-side-encryption-enabled"
  
  source {
    owner             = "AWS"
    source_identifier = "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED"
  }
  
  depends_on = [aws_config_configuration_recorder.compliance]
}