Terraform PR Agent
Insights become Terraform pull requests.
Connect your GitHub repositories and the Terraform PR agent turns actionable Insights into minimal, validated Terraform changes. Each pull request explains why, what changed and the estimated savings. Your team reviews and merges. The agent never runs terraform apply.
Early access · No Terraform state access · Human review on every change
[IaC] Migrate EBS gp2 volumes to gp3doit/iac-remediation/ebs-gp3 → mainOpen
what it does
From an Insight to a reviewed merge
Context in every PR
Why, what changed, why this way, scope, tradeoffs and estimated savings.
Validated before it opens
terraform fmt, tflint, trivy and checkov run before the pull request.
No state access
The agent finds resources in your HCL. No Terraform state shared.
Triggered from Insights
A CloudFlow flow passes actionable Insights and affected resources to the agent.
Steer it with @doit
Leave review comments with @doit and the next iteration uses them.
Multi-repo, in order
One PR per repository, opened in module dependency order with merge notes.
live in minutes
Connect the Terraform PR agent in three steps
Open the Agents tab.
In the integrations catalog, select Connect on the Terraform PR agent card.
Install the GitHub App.
Install IaC Remediation Agent and pick repositories, including private module repositories.
Review the pull requests.
Look for [IaC] titles. Review, merge, and your pipeline applies the change.
Early access. Contact your account team to request access.
Book a demoFrequently asked
questions
What does the Terraform PR agent do?
It connects your GitHub repositories to Cloud Intelligence™ and opens pull requests with proposed Terraform remediations for actionable Insights. It proposes minimal changes and your team decides what gets deployed.
Does the agent change my cloud resources?
No. It never runs terraform apply, never reads or writes Terraform state backends, and never merges pull requests. Your normal deployment pipeline applies changes after you merge.
What triggers a remediation?
During early access, a CloudFlow flow we provide selects actionable Insights and calls the Trigger automated IaC remediation for an insight action. You can use that action in any custom CloudFlow flow.
What access does the GitHub App need?
The IaC Remediation Agent app needs permission to create pull requests, push branches and read pull request comments. If you're not a GitHub organization administrator, an organization owner must approve the installation.
What's in each pull request?
The rationale, the proposed changes, why this approach was chosen, the target resources, and tradeoffs and impact, including estimated savings when available. Multi-repo remediations also list sibling PRs and the merge order.
How do I get better results?
Commit your .terraform.lock.hcl so the agent matches your exact provider versions, and include repositories with private modules your root modules reference. Leave review comments that include @doit to guide the next iteration.
Connect the Terraform PR agent. Ship fixes as code.
Early access. Read your HCL, open PRs, keep humans in the loop.