Infrastructure drift takes hours to patch manually. However, delegating root cloud authority to an LLM agent is an unacceptable security risk in a production environment. Traditional autonomous agents are too dangerous to automatically write and deploy Terraform directly into AWS or GCP.
The thesis: How do we achieve the speed of AI automation without surrendering the deterministic safety of GitOps?
Engineered a Python-based Abstract Syntax Tree (AST) parser to statically analyze Terraform modules prior to execution, accurately calculating the deployment blast radius to guarantee zero automated breakages.
Architectural Caveat
"AST analysis acts as a strict safety control and blast-radius estimator, not a mathematical guarantee against all arbitrary infrastructure failures. It strictly verifies syntax and state file intent before routing to a human."
Designed an asynchronous pipeline leveraging Server-Sent Events (SSE) that streams proposed infrastructure changes in real-time, requiring explicit human approval before triggering CI/CD merges.
The AI is isolated to generation and proposal. Server-Sent Events (SSE) stream the proposed Terraform plan directly to the SRE dashboard. Execution authority remains strictly on the human side of the boundary, leveraging GitLab's MCP for merge verification.
Message Dropping (Pub/Sub)
If Cloud Pub/Sub drops a drift event, the system degrades safely (no action taken). The next scheduled cron sync will catch the drift.
AST Parser Failure
If the parser encounters an unsupported or overly complex Terraform module, it defaults to a 'High Blast Radius' state and halts the pipeline automatically.
Drift Resolution
Methodology
Event-driven architecture drastically reduces time to remediate drift vs manual intervention.
Hardcoded Creds
Methodology
Elimination of static credential risk via federated identity.
FinOps Audits
Methodology
Shift from manual quarterly audits to continuous autonomous process.