Skip to main content

Terraform PR agent

Infrastructure-as-code (IaC) teams often need to translate FinOps recommendations into Terraform changes, review them, and merge them through existing change-management workflows. The Terraform PR agent connects your GitHub repositories to Cloud Intelligence and opens pull requests with proposed Terraform remediations via any custom CloudFlow flow using the appropriate CloudFlow action node.

The agent does not apply changes directly to your cloud environment. Instead, it proposes minimal Terraform changes through GitHub pull requests so your team stays in control of what gets deployed.

Early access

  • The Terraform PR agent is available as an early access feature. Contact your DoiT account team to request access.

  • During early access, you can trigger remediations directly from a Composer Insight detail page or through a DoiT-provided CloudFlow. See Work with remediations for details on both trigger methods. Note that only specific insights are supported, some will not offer the ability to trigger the remediation through the Terraform PR agent.

Benefits​

  • Faster time to remediate: Reduce the handoff time between identifying a cost or configuration issue and delivering a reviewable code change.

  • IaC-native workflow: Remediations arrive as pull requests in your existing Terraform repositories, aligned with how CloudOps teams already manage infrastructure changes.

  • Human in the loop: All changes go through your standard GitHub review and merge process. The agent never runs terraform apply or modifies cloud resources directly.

  • Signal-driven automation: The agent responds to actionable DoiT signals you already monitor, including Insights. During early access, those signals reach the agent through a DoiT-provided CloudFlow or directly from the Insight detail page.

  • Privacy first by design: No sensitive Terraform state data access required.

Key features​

  • GitHub integration: Connect Terraform repositories through the DoiT GitHub App so the agent can read your codebase and open remediation pull requests.

  • No Terraform state access: The agent infers where cloud resources are defined in your HCL codebase. No sensitive Terraform state data sharing is required.

  • Context-aware pull requests: Remediation pull requests include the originating signal context, proposed changes, tradeoffs, and cost context when available, so reviewers do not need to leave the PR.

  • Interactive feedback: After you leave a @doit comment on a remediation pull request, the agent processes your feedback and replies in the pull request thread with a summary of the changes it made or an explanation if it could not act on the request.

  • Local validation: The agent runs local checks (such as formatting and linting) on proposed changes before opening a pull request.

  • Provides official support for all published Terraform provider versions across the major hyperscalers (AWS, Google Cloud, and Azure) dating back up to four years, including workarounds for known bugs and gotchas.

See Connect and disconnect to set up GitHub access, and Work with remediations to understand the end-to-end workflow.

Last updated on