@compliancetf / @weeklytf / serverless.tf / AWS Hero / Terraform influencer 🇺🇦🇳🇴
Oslo, Norway
- Tweets 2,699
- Following 664
- Followers 5,434
- Likes 7,340
Pinned Tweet
While working on @compliancetf, I created a Claude skill called terraform-skill (terraform-best-practices + other trusted sources).
In 2026, please stop saying "AI hallucinates with #Terraform". Use HashiCorp MCP + this skill so answers are grounded in real docs and battle-tested patterns.
Feedback welcome, and shares appreciated. 🚀
github.com/antonbabenko/terr…
6
39
292
20,912
I will be presenting at AWS re:invent (COM302):
The judgment gap: when Terraform scans clean but fails the audit.
Monday @ Caesars Forum | Level 1 | Academy 414
13:30 - 14:30
More info in the official catalog: registration.awsevents.com/f…
#ComplianceAsCode #Terraform #AWSreinvent #DevSecOps @compliancetf
1
4
323
Majority of the terraform-aws-modules exists due to Terraform workarounds (e.g. lack of vars in lifecycle block).
Read my post on how you can simplify your usage by just swapping the modules source url.
This is @compliancetf and it is available for free!
compliance.tf/blog/from-fork…
3
1
6
749
Anton Babenko 🇺🇦 retweeted
😎 Six months ago we shipped Operational Rules for terraform-aws-modules. The question we get most since: "what exactly will it do to my module?"
Now you can see the diff before you touch a source line. Rules Playground and six more rules.
compliance.tf/blog/rules-pre…
1
2
278
Since March, the most common question about Operational Rules: "show me the diff first".
Rules Playground is live. Pick a terraform-aws-modules module, tick rules, and read the diff. No account needed.
Also: 15 rules now, and org-wide Baselines on trial or paid plans.
compliance.tf/blog/rules-pre…
#Terraform #ComplianceAsCode #DevOps
1
5
937
Back from #AWSHeroesSummit where it was awesome to meet old and new friends from all over the world and have some fun.
My travel story ( my.flightradar24.com/antonba… ): 42 countries, 422 flights.
More to come...
Made with AI
4
470
Anton Babenko 🇺🇦 retweeted
tfpolicy (by HashiCorp) ships a policy stage that runs before Terraform downloads a module.
At that point a policy sees a source string and a version. It allows or denies a name.
Which module that name resolves to is doing a lot of the compliance work.
compliance.tf/blog/hashicorp…
1
1
247
Anton Babenko 🇺🇦 retweeted
Terraform best practices for AI coding agents
github.com/antonbabenko/terr…
2
11
60
8,212
Another open-source tool from building @compliancetf
repro-lambda builds AWS Lambda zips outside Terraform: byte-identical on macOS and CI, uploaded to S3 by content hash, then promoted dev -> prod with no rebuild. Terraform reads s3_existing_package instead of rebuilding on every plan.
#Terraform #AWS #Lambda #serverless
github.com/antonbabenko/repr…
1
1
12
1,023
"Panels of models which consistently outperforms individual models" - this is exactly the point I was chasing when working on the Deliberation.
github.com/antonbabenko/deli…
Ask Codex, Gemini, Grok, and 400+ OpenRouter models (Qwen, Kimi, DeepSeek) for second opinions or arbiter-mediated consensus. One MCP server for Claude Code, Codex, Cursor, Kiro, OpenCode. Measures which models earn their seat.
#openrouter #fusion
Introducing the Fusion API, the smartest compound model in the market.
Fusion achieves Fable-level intelligence at half the price.
How it works 👇
2
539
Anton Babenko 🇺🇦 retweeted
#276 - Terragrunt structure secrets, IaC that acts like software, Lambda on your own EC2, AzAPI unlocks Azure Actions, and AI that scans your Terraform
weekly.tf/p/issue-276-terrag…
3
3
330
Was a bit skeptical reading this first but interesting part here is the agent verifying its own fixes against prod instead of trusting CI. Also funny from where I sit - a retry storm and a connection race are the kind of bugs that get provisioned wrong in Terraform on day one and surface as app bugs six months later. So you want this loop for cleanup, and you want your modules making these errors impossible in the first place.
Fascinating.
We ran an experiment. We pointed Antimetal at our own production environment, emitting 3,000 error logs a day, with no prior guidance.
It cut our error volume by 76% in a single day.
It found six unique problems, including one we'd misdiagnosed for weeks. It diagnosed and triaged each one, resolved it, and monitored the fix to confirm stability.
Production that runs itself is no longer hypothetical.
antimetal.com/blog/clearing-…
3
522
I've maintained terraform-aws-modules for years. They are general-purpose on purpose, and that leaves a gap: the module is fine, the compliant configuration is your problem.
This registry is my answer. Same modules, controls already in the code you pull.
compliance.tf/blog/complianc…
#ComplianceAsCode
The compliance-aware Teraform Registry is now public.
- terraform-aws-modules/s3-bucket/aws
+ soc2.compliance.tf/terraform…
SOC 2 controls built in. Non-compliant values fail at terraform plan.
Free CIS tier. First pull in 5 minutes:
compliance.tf/blog/complianc…
1
7
1,721
Sponsored by Kestra (@kestra_io) #ad
Terraform is great at creating infra. It has no opinion about Day 2.
IP changes -> DNS is wrong -> cache is stale -> someone has to know. That always ends up in a shell script nobody wants to open.
So I ran the follow-up right after apply, in one Git-versioned file:
```yaml
tasks:
- id: provision
type: io.kestra.plugin.terraform.cli.TerraformCLI
commands:
- terraform apply -auto-approve
- terraform output -raw instance_ip > ip.txt
outputFiles: [ip.txt]
- id: upsert_dns
type: io.kestra.plugin.cloudflare.dns.records.Upsert
name: "{{ inputs.record_name }}"
content: "{{ read(outputs.provision.outputFiles['ip.txt']) | trim }}"
```
Terraform's output feeds the DNS update. Logs + full run history on every run. No glue script.
This is a @kestra_io flow - YAML, self-hosted, runs on cloud, on-prem, or air-gapped.
Clone this Playbook Automation Blueprint to try it now: fandf.co/4o16nCO
4
528
My recent talk "Replace Terraform Module Forks with Automatic Policy Transformation Rules" from @iac_conf
piped.video/watch?v=at56UPLF…
2
2
681
terraform-skill now ships as Kiro Powers!
Same Terraform/OpenTofu skill, no fork - the Power is generated from the skill file, so Kiro and all other AI coding agents share one source. Module reviews, tests, CI, and state ops, all of it.
⭐️⭐️⭐️ Almost 2000 stars on GitHub! THANK YOU ALL!
#terraform #opentofu #kiro #agentic
github.com/antonbabenko/terr…
1
16
72
4,842
Updated v1.16.0 ( github.com/antonbabenko/clau… ): `/consensus` is now a 3-stage loop. Stage 2 adds a blind cross-review where each external rates the others' answers, anonymized, before Claude adjudicates. Pattern from llm-council by @karpathy
1
525
Released claude-delegator v1.13.0:
- Grok (@xAI) as 3rd provider, Gemini 3 default
- New Researcher + Debugger experts (7 in total)
- Severity-graded reviews so parallel reports merge cleanly
- /consensus: Claude commits a blind verdict before dispatching GPT/Gemini/Grok, then arbiter-mediated voting
Prompts adapted from oh-my-openagent + PAL.
github.com/antonbabenko/clau…
2
370
Hey #Azure #GCP users!
Most #Terraform AI agents are quietly AWS-only. The other clouds are an afterthought.
I made `terraform-skill` to treat AWS, Azure, and GCP as equals. It diagnoses what you are doing first - backend, auth, resource - then routes to a cross-cloud `AWS | Azure | GCP` map instead of defaulting to AWS. AWS examples unchanged; ask for the Azure or GCP equivalent of anything.
github.com/antonbabenko/terr…
8
25
2,085