MyCoCo Reduces AI-Generated IaC Security Findings by 94% with OPA Guardrails

AI-Generated IaC Passes Syntax Checks but Fails Security Compliance

MyCoCo’s platform team generated 30 Terraform modules using AI in two weeks, only to find 47 security findings per module during pre-production checks. The AI passed terraform validate but missed required tags, encryption, and IAM policies—costing the team a major product launch.

Why This Matters

AI coding assistants excel at syntax but lack organizational context like tagging rules or encryption mandates. MyCoCo’s experience shows that 94% of security debt from AI-generated IaC stems from policy omissions, not syntax errors. Without guardrails, teams risk compliance failures and audit failures, with costs scaling as deployment frequency increases.

Key Insights

• “Only 9% of AI-generated IaC meets security compliance standards”: [dev.to, 2025]
• “OPA policies catch AI blind spots in tagging, encryption, and IAM”: [MyCoCo case study]
• “Conftest integrated with GitHub Actions by MyCoCo”: [GitHub Actions workflow]

Working Example

# policy/tags.rego
package terraform.tags
required_tags := ["Environment", "Owner", "CostCenter"]
deny[msg] {
  resource := input.resource_changes[_]
  resource.change.actions[_] == "create"
  tags := object.get(resource.change.after, "tags", {})
  missing := [tag | tag := required_tags[_]; not tags[tag]]
  count(missing) > 0
  msg := sprintf("%s '%s' missing required tags: %v", [resource.type, resource.name, missing])
}

# policy/encryption.rego
package terraform.encryption
deny[msg] {
  resource := input.resource_changes[_]
  resource.type == "aws_s3_bucket"
  resource.change.actions[_] == "create"
  not has_encryption_config(resource.address)
  msg := sprintf("S3 bucket '%s' must have encryption enabled", [resource.name])
}

# GitHub Actions integration
- name: Policy Check
  run: |
    terraform plan -out=tfplan
    terraform show -json tfplan > tfplan.json
    conftest test tfplan.json --policy policy/

Practical Applications

• Use Case: MyCoCo’s AI-generated Terraform modules with OPA guardrails reduced security findings from 47 to 3 per module.
• Pitfall: Assuming AI understands organizational policies leads to compliance gaps; manual reviews often miss AI-generated omissions.

References:

• https://dev.to/dc-shimla/guardrails-for-ai-generated-iac-how-mycoco-made-speed-sustainable-2f1k

---