What's Left for Infrastructure-as-Code After AI Moves In? Insights from IBM’s Rosemary Wang

“What’s left for infrastructure-as-code after AI moves in?”

Rosemary Wang, Developer Advocate at IBM, joined the Stack Overflow podcast to discuss how AI is reshaping infrastructure-as-code. She highlights that while AI can now write and deploy infrastructure code, guardrails still lag adoption.

Why This Matters

The promise of AI writing and deploying infrastructure code collides with an uncomfortable reality: most organizations still lack the guardrails needed to catch mistakes. Without mature policy enforcement or automated validation, giving anyone the ability to deploy increases the blast radius of errors. As seen historically with cloud misconfigurations causing massive data leaks (e.g., Capital One breach, $190M fine), the cost of bypassing deep systems knowledge grows when automation removes human friction but not human fallibility.

Key Insights

• Guardrails remain underdeveloped: Wang notes that organizations lack mature policies and automated safety checks for AI-generated infrastructure deployments, increasing risk of configuration errors.
• ‘Anyone can deploy’ myth: The idea that AI enables non-experts to safely manage production systems is flawed without deep systems knowledge, which Wang emphasizes as still critical.
• IBM’s Bob coding agent: Wang references Bob, IBM’s coding agent for infrastructure tasks, as a tool exploring what AI-assisted deployment looks like in practice.

Practical Applications

• • Use case (Company/system + behavior): Teams using IBM’s Bob coding agent to automate routine IaC tasks like provisioning cloud resources.
• Pitfall (Common anti-pattern + consequence): Skipping manual review of AI-generated Terraform or Pulumi scripts — leads to silent drift or security misconfiguration.

References: