Claude Code for Infrastructure as Code: A Practical Guide
· via Spacelift
Why this matters now: This is the piece closest to what this site is about. IaC is a good match for coding agents because plans give you a review gate before anything applies, and this guide turns that observation into a full working model for Claude Code against a Terraform estate. It is specific where most agent content stays vague: real CLAUDE.md examples, real permission rules, and an honest section on where the tool breaks, from context limits on large codebases to mishandled secrets.
Three takeaways:
- The mental model is a strict split between drafting and deploying. The agent’s job ends at the diff. Every change travels through a pull request and CI before production, and the operator who merges stays accountable for the result. Nothing the agent writes reaches infrastructure without a human in the merge path.
- Start with the boring work: module generation, splitting monolithic configs, updating deprecated syntax, writing tests and OPA policies. Small scoped changes are easier to review and cheaper to roll back when the agent hallucinates a provider argument, which it still does on less common resources.
- Guardrails come in layers. CLAUDE.md carries repo conventions, permission rules deny apply and destroy while allowing fmt and validate, hooks run scanners and validators on every edit, and OS-level sandboxing sits underneath. For reaching cloud APIs and live context, the article leans on MCP servers instead of handing the agent raw credentials.
What I’d add today: Figure out how to use AI coding assistants safely within your IaC workflows. The tools are here to stay and will only get better.
Who should read it: platform engineers who want to try an agent against a Terraform estate without gambling production on it. Give the agent plan-only permissions first and let it earn trust per repo, the same way a new team member would. When the agent itself becomes the workload, deploying it with IaC is the follow-up read.