Policy-Aware Infrastructure Generation: Using an MCP Server to Bridge OPA and AI for Terraform
summary
Claims a working prototype that connects an MCP server to an OPA REST API so LLMs receive live constraints (allowed instance types, required tags, open ports) and generate compliant Terraform by default. Uses two MCP tools: TF config assistant and validate plan, VS Code discovery plus GitHub CI checks, OPA bundles in S3 and OPA on ECS Fargate. Demo builds and applies resources (EC2 and a Lambda) with fewer validation cycles — one run replaces iterative rework.
AI-written summary · about
chapters (18)
- 0:00Policy-aware AI infrastructure
- 1:26AI needs policy enforcement
- 3:35Cloud governance with AI code
- 6:24Terraform and Open Policy Agent fundamentals
- 9:55Bridging AI with policies using MCP
- 14:08End-to-end MCP workflow
- 15:53Live demo without MCP
- 19:06Live demo with MCP
- 23:46Terraform apply with policy check
- 24:29Lambda with MCP
- 27:20Testing generated infrastructure
- 29:07OPA server setup
- 31:16MCP server details
- 32:19MCP features and resources
- 33:43Benefits for teams
- 34:26Limitations of approach
- 35:29Future outlook
- 36:32Key takeaways
related talks
28mFrom code to context: Automating secure DevOps with HashiCorp MCP servers
52mTerraform Cloud Learn Lab: Validate Infrastructure and Enforce OPA Policies
39mEnforcing Standards in CI/CD Using Open Policy Agent
31mMaking AI work for you: Terraform engineer blueprint
28mEnforcing Standards in CI/CD Using Open Policy Agent
27mGrounding AI in reality: Building reliable infrastructure development workflows
32mAI Meets IaC — Intelligent Terraform Authoring on Azure
41mModern Policy Management Putting responsibility where it belongs