Terraform / OpenTofu AI Agent Directives

Terraform and OpenTofu are the language most teams use to describe infrastructure, which makes the code, the plan, and the state the perfect targets for an AI agent. These directives turn an agent into a reviewer that sits between the plan and the apply: scanning a terraform plan for security risks, detecting state drift against live infrastructure, planning module and provider upgrades with breaking-change analysis, validating plans against OPA policy, estimating cost, catching refactor mistakes that would destroy resources, and staging imports for brownfield estates. Each windsurf terraform or cursor rules terraform directive is written to run against the real CLI, from opentofu plan and terraform show to opa eval, and it always keeps the agent read-only unless a change is explicitly authorized. The central idea is that terraform drift and plan risks are reproducible analyses an agent can do reliably rather than mysteries to be feared. Teams collecting cursor rules terraform or opentofu directives get prompts that produce a diff table, a severity list, and a safe migration order instead of a vague summary. Save these for any branch that changes terraform, and the review writes itself against the plan. Put them in a rules file and re-run whenever a PR touches IaC, and the most fragile part of infrastructure change becomes the part an agent checks first and consistently.