What Happens When You Give an AI Agent Your AWS Credentials – Encore Blog
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Teams are increasingly using AI agents to write backend code, but infrastructure provisioning remains a challenge. Giving agents access to Terraform exposes the full AWS API surface, creating security risks like misconfigured IAM policies, public databases, and open security groups. Policy tools like OPA, tfsec, and Checkov help but operate as blocklists against an unconstrained space. An alternative approach — infrastructure from code — lets agents declare typed infrastructure primitives (databases, pub/sub topics, cron jobs) in application code, while the platform handles actual cloud provisioning within pre-configured guardrails. This bounds the blast radius to the type system rather than the full cloud API, reduces review burden, and eliminates the need to give agents direct AWS credentials. A comparison table weighs three approaches: human-written Terraform, agent-written Terraform with policy checks, and infrastructure from code.
