Work with remediations

Once you have connected the Terraform PR agent, the agent creates pull requests in response to actionable DoiT signals. Remediation pull requests are created and reviewed in GitHub, not in the DoiT console.

(Recommended) Commit the Terraform dependency lock file

The agent uses your Terraform dependency lock file (.terraform.lock.hcl) and any required_providers version constraints to tailor remediations to the provider versions in your repository. That helps it choose supported resource fields and apply known workarounds for version-specific bugs and gotchas.

Commit .terraform.lock.hcl to your repositories so the agent can resolve exact provider versions and produce more accurate changes.

Trigger the agent

During early access, DoiT provides a CloudFlow that selects an actionable Composer Insight and calls the DoiT Trigger automated IaC remediation for an insight action. The agent does not run on a schedule or on demand from the Integrations catalog. First-class Insights triggers (without CloudFlow) are planned for upcoming releases.

A typical provided flow:

1. Starts (for example, with a Manually start trigger).

2. Runs List insights, then Filter on List insights, to choose which Insights to remediate.

3. Runs List resource results for an insight to collect the affected cloud resource IDs.

4. Uses an LLM node to shape the remediation guidance for the agent.

5. Calls Trigger automated IaC remediation for an insight on a DoiT node to start the agent.

That final action requires a trigger source (the CloudFlow and Insight) and a signal payload that includes the cloud provider, Insight pillar (for example, cost or security), the affected resource IDs, and the remediation text. In the provided flow, upstream nodes supply those values.

If the agent cannot map a target resource to Terraform code in your connected GitHub repositories, it skips that resource. If no target resources can be mapped, no pull request is created.

End-to-end flow

1. Signal detected: An Insight with affected cloud resources is passed to the agent through CloudFlow.

2. Resource mapping: The agent searches your connected Terraform (HCL) codebase to find where those resources are defined.

3. Code generation: The agent generates minimal Terraform changes that implement the recommended remediation, respecting your existing code style and any configured guardrails.

4. Local validation: Before opening a pull request, the agent runs local checks on the proposed changes, including terraform fmt, tflint, trivy, and checkov when a Checkov config is present in the repository.

5. Pull request created: The agent opens a pull request on a dedicated branch in the target repository (or updates an existing remediation branch for the same Insight when one already exists).

6. Review and merge: Your team reviews the pull request in GitHub and merges it through your normal change-management process. Your usual deployment pipeline applies the Terraform changes after merge.

Find remediation pull requests

Look for pull requests that:

• Target your repository's default branch
• Originate from a doit/iac-remediation/ branch
• Use a title that starts with [IaC]

Review the pull request

Each remediation pull request includes context to help your review:

Section	What to check
Rationale ("Why")	Describes the signal, and explains why these changes address the signal.
Proposed changes ("What changed")	Summarizes the HCL code changes the agent modified.
Implementation justification ("Why this way")	Explains why the agent favored one possible implementation way over another. To help PR reviewers.
Target resources ("Scope")	References the resources modified by the PR.
Cost context & risk assessment ("Tradeoffs and impact")	Highlights dependency impact and potential downtime, also shows estimated savings or cost impact from the originating signal, when available

Note

Remediation code is generated by AI. Always verify that the proposed changes are correct and safe for your environment before you merge.

After the agent opens a remediation pull request, you can guide a later iteration by leaving review comments that include @doit. Comments without @doit are not picked up.

When the agent re-runs on the same remediation branch, it collects your @doit comments, filters out automated bot messages and short reactions, and uses the remaining feedback in its remediation plan. You can request adjustments (for example, limit a change to a specific environment), ask clarifying questions, or flag issues with the proposed changes.

Approve, merge, or dismiss

Merge remediation pull requests through your standard GitHub review process, including any required approvals and status checks configured on the repository. The agent does not merge pull requests automatically.

• Merged: Your normal deployment pipeline applies the Terraform changes after merge. The agent does not manage rollbacks.

• Closed without merge: No infrastructure changes are applied. The originating Insight remains available in DoiT for your team to investigate or address through other means.

What the agent does not do

• Access your cloud environment or run terraform apply.

• Read or write Terraform state backends.

• Force-push or bypass branch protection rules.

• Create a duplicate pull request for the same Insight and resources when an open remediation branch already exists (the existing branch is updated instead).

• Remediate resources that are not managed by Terraform in your connected repositories