While working on @compliancetf, I created a Claude skill called terraform-skill (terraform-best-practices + other trusted sources).

In 2026, please stop saying "AI hallucinates with #Terraform". Use HashiCorp MCP + this skill so answers are grounded in real docs and battle-tested patterns.

Feedback welcome, and shares appreciated. 🚀

github.com/antonbabenko/t…

Meet me at AWS reInvent: compliance.tf/reinvent/

#AWS #Compliance #Terraform and anything else...

New: "Know which controls your Terraform enforces. Prove it."

In post I explain why the wording changed. Also shipped: ctfkit runs same checks in your CI pipeline, AWS provider, #Azure and #GoogleCloud controls (modules for them are planned for Q1 2027).

compliance.tf/blog/why-i-cha…

Time to aggregate most of my various content into a timeline (by projects, types, dates) instead of just a "blog".

antonbabenko.com

Any feedback?

#Terraform #AWS #AI #DevOps

Introducing SubQ Snap, the first long-context decision model for real enterprise work.

Snap is the only decision model or LLM where compute per token stays constant as context grows.

• 384K tokens of multimodal context, 12x larger than Jev.
• 61.7 on Decision Index v0.2.1 vs ng on 13 of 16 enterprise benchmarks.
•Processes 100K tokens and returns a decision in under one second.
•$0.05/MM input tokens. Output is free.

Available today to anyone.

The first 10,000 sign-ups get 100M free input tokens.

We’ll likely hit capacity fast and will add users as we add compute. Compute offers welcome 🙂.

Latency will be variable as we tune the platform to this new model and category of users.

Model speeds are 80ms for minimal context, 250ms for 32k, 660ms for 100k, and 2.5 seconds for 384k.

Visit: subq.ai

A follow-up to "Meet Deliberation": what changed between v3.5.2 and v3.28.0, and why the numbers only started changing my config once I could see each run. x.com/i/article/2108…

#Deliberation now has a local dashboard: every multi-model run drawn live, one lane per model, plus an analyzer that tells you which model agrees more than it adds.

builder.aws.com/content/3EcVFg…

#consensus #multimodel

I will be presenting at AWS re:invent (COM302):
The judgment gap: when Terraform scans clean but fails the audit.

Monday @ Caesars Forum | Level 1 | Academy 414
13:30 - 14:30

More info in the official catalog: registration.awsevents.com/flow/awsevents…

#ComplianceAsCode #Terraform #AWSreinvent f

Majority of the terraform-aws-modules exists due to Terraform workarounds (e.g. lack of vars in lifecycle block).

Read my post on how you can simplify your usage by just swapping the modules source url.

This is @compliancetf and it is available for free!

compliance.tf/blog/from-fork…

* majority of the terraform-aws-modules FORKS exists… (early morning for me) :)

😎 Six months ago we shipped Operational Rules for terraform-aws-modules. The question we get most since: "what exactly will it do to my module?"

Now you can see the diff before you touch a source line. Rules Playground and six more rules.

compliance.tf/blog/rules-pre…

Since March, the most common question about Operational Rules: "show me the diff first".

Rules Playground is live. Pick a terraform-aws-modules module, tick rules, and read the diff. No account needed.

Also: 15 rules now, and org-wide Baselines on trial or paid plans.

compliance.tf/blog/rules-pre…

#Terraform #ComplianceAsCode #DevOps

Back from #AWSHeroesSummit where it was awesome to meet old and new friends from all over the world and have some fun.

My travel story ( my.flightradar24.com/antonbabenko ): 42 countries, 422 flights.

More to come...

tfpolicy (by HashiCorp) ships a policy stage that runs before Terraform downloads a module.

At that point a policy sees a source string and a version. It allows or denies a name.

Which module that name resolves to is doing a lot of the compliance work.

compliance.tf/blog/hashicorp…

Terraform best practices for AI coding agents

github.com/antonbabenko/t…

Another open-source tool from building @compliancetf

repro-lambda builds AWS Lambda zips outside Terraform: byte-identical on macOS and CI, uploaded to S3 by content hash, then promoted dev -> prod with no rebuild. Terraform reads s3_existing_package instead of rebuilding on every plan.

#Terraform #AWS #Lambda #serverless

github.com/antonbabenko/r…

"Panels of models which consistently outperforms individual models" - this is exactly the point I was chasing when working on the Deliberation.

github.com/antonbabenko/d…

Ask Codex, Gemini, Grok, and 400+ OpenRouter models (Qwen, Kimi, DeepSeek) for second opinions or arbiter-mediated consensus. One MCP server for Claude Code, Codex, Cursor, Kiro, OpenCode. Measures which models earn their seat.

#openrouter #fusion

#276 - Terragrunt structure secrets, IaC that acts like software, Lambda on your own EC2, AzAPI unlocks Azure Actions, and AI that scans your Terraform

weekly.tf/p/issue-276-te…

Was a bit skeptical reading this first but interesting part here is the agent verifying its own fixes against prod instead of trusting CI. Also funny from where I sit - a retry storm and a connection race are the kind of bugs that get provisioned wrong in Terraform on day one and surface as app bugs six months later. So you want this loop for cleanup, and you want your modules making these errors impossible in the first place.

Fascinating.

I've maintained terraform-aws-modules for years. They are general-purpose on purpose, and that leaves a gap: the module is fine, the compliant configuration is your problem.

This registry is my answer. Same modules, controls already in the code you pull.

compliance.tf/blog/complianc…

#ComplianceAsCode