13.3Prompt Pattern for IaC Review

The quality of AI review depends entirely on the prompt. A generic "review this code" prompt produces generic output. A structured prompt with specific review criteria produces actionable findings.

You are reviewing a Terraform pull request. Analyze the following changes for:

1. **Security**: Any resources without encryption? Public access? Overly permissive IAM?
   Flag any security group with 0.0.0.0/0 ingress. Flag any IAM policy with Action: "*".
2. **Cost**: Any instances larger than needed? Missing auto-scaling? Resources that should
   use spot pricing? Estimate monthly cost impact.
3. **Reliability**: Missing health checks? Single points of failure? No multi-AZ?
   Flag any RDS without multi-AZ. Flag any service with replicas < 2.
4. **Compliance**: Does this follow our tagging policy? Are resources in approved regions?
   Required tags: Environment, Team, CostCenter.
5. **Operational Risk**: Will any resources be replaced (causing downtime)?
   Will any data be lost? Are there any irreversible changes?

Terraform plan output:
```json
{plan_json}

Previous production configuration:

{existing_config}

Provide findings as a structured list with severity (CRITICAL/HIGH/MEDIUM/LOW). For each finding, include:

• What the issue is
• Why it matters
• How to fix it

### Enhanced Prompt for Complex Reviews

```markdown
You are a senior infrastructure engineer reviewing a Terraform plan that modifies
production infrastructure. This is a high-stakes review.

Context:
- Cloud provider: AWS
- Environment: production (us-east-1)
- Service: payment processing (PCI-DSS scope)
- Current state: 3 AZs, multi-AZ RDS, ECS Fargate

Review the following plan for:

1. **Data loss risk**: Will any stateful resources (RDS, S3, DynamoDB) be destroyed
   or replaced? Flag with CRITICAL severity.
2. **Downtime risk**: Will any resource replacement cause service interruption?
   Estimate duration. Flag with HIGH severity.
3. **Security regression**: Does any change weaken the current security posture?
   Compare before/after for security groups, IAM, encryption. Flag with CRITICAL.
4. **PCI-DSS compliance**: Does this change maintain PCI-DSS requirements?
   (Encryption at rest, encryption in transit, access logging, network segmentation)
5. **Cost impact**: Estimate the monthly cost delta. Flag changes > $100/month.

Plan JSON:
{plan_json}

Checkov results:
{checkov_results}

Trivy results:
{trivy_results}

Output format:
## Summary
[2-3 sentence summary of what this plan does]

## Findings
| # | Severity | Category | Finding | Recommendation |
|---|----------|----------|---------|----------------|