CI Checklist for AI-Generated Terraform and OpenTofu Infrastructure

Summary

The article presents a five-part CI baseline for teams using AI to generate Terraform or OpenTofu infrastructure: formatting and validation, linting, tests, security scanning, and documentation checks. Formatting with `terraform fmt` or `tofu fmt` keeps reviews focused, while validation catches internal inconsistencies; validation must run in each relevant root-module directory and does not prove that deployment will succeed with particular credentials, values, or existing resources. The authors recommend deliberate TFLint rules, including checks for unused declarations, and say provider-specific plugins must be installed for those rules to run. Native Terraform and OpenTofu tests should protect reusable child-module behavior with normal, invalid-input, and important failure cases. The example uses a mocked AWS provider and `command = plan` to check S3 public-access settings without credentials or API calls, but live tests remain necessary for behavior that plans or mocks cannot establish. AI can generate tests, yet humans must decide which behavior matters and whether the tests provide meaningful coverage. Security checks should cover both infrastructure misconfigurations and exposed secrets, using tools such as Trivy, TruffleHog, or Checkov; the article notes that scanner dependencies also need maintenance after Trivy was affected by a supply-chain compromise in March 2026. Documentation generated by `terraform-docs` should be kept synchronized with module interfaces. The suggested setup runs checks locally and on every pull request, uses Trunk or another pre-commit framework, makes required status checks block merges, deliberately verifies that failures are detected, and pins tool versions with tools such as Aqua or mise. Passing automation provides routine feedback, but reviewers still need to assess resource necessity, access, and whether the plan matches the intended infrastructure change.