@compliancetf / @weeklytf / https://xitter.cf/t.co/Vc9f4Hxe06 / AWS Hero / Terraform influencer 🇺🇦🇳🇴
Oslo, Norway
Joined February 2009
- Tweets2.7K
- Following666
- Followers5.4K
- Likes7.3K
Pinned Tweet
While working on @compliancetf, I created a Claude skill called terraform-skill (terraform-best-practices + other trusted sources).
In 2026, please stop saying "AI hallucinates with #Terraform". Use HashiCorp MCP + this skill so answers are grounded in real docs and battle-tested patterns.
Feedback welcome, and shares appreciated. 🚀
github.com/antonbabenko/terr…
Anton Babenko 🇺🇦 retweeted
Introducing SubQ Snap, the first long-context decision model for real enterprise work.
Snap is the only decision model or LLM where compute per token stays constant as context grows.
• 384K tokens of multimodal context, 12x larger than Jev.
• 61.7 on Decision Index v0.2.1 vs Jev’s 57.9, outperforming on 13 of 16 enterprise benchmarks.
•Processes 100K tokens and returns a decision in under one second.
•$0.05/MM input tokens. Output is free.
Available today to anyone.
The first 10,000 sign-ups get 100M free input tokens.
We’ll likely hit capacity fast and will add users as we add compute. Compute offers welcome 🙂.
Latency will be variable as we tune the platform to this new model and category of users.
Model speeds are 80ms for minimal context, 250ms for 32k, 660ms for 100k, and 2.5 seconds for 384k.
Visit: subq.ai/
A follow-up to "Meet Deliberation": what changed between v3.5.2 and v3.28.0, and why the numbers only started changing my config once I could see each run.
#Deliberation now has a local dashboard: every multi-model run drawn live, one lane per model, plus an analyzer that tells you which model agrees more than it adds.
builder.aws.com/content/3EcV…
#consensus #multimodel
I will be presenting at AWS re:invent (COM302):
The judgment gap: when Terraform scans clean but fails the audit.
Monday @ Caesars Forum | Level 1 | Academy 414
13:30 - 14:30
More info in the official catalog: registration.awsevents.com/f…
#ComplianceAsCode #Terraform #AWSreinvent #DevSecOps @compliancetf
Majority of the terraform-aws-modules exists due to Terraform workarounds (e.g. lack of vars in lifecycle block).
Read my post on how you can simplify your usage by just swapping the modules source url.
This is @compliancetf and it is available for free!
compliance.tf/blog/from-fork…
Anton Babenko 🇺🇦 retweeted
😎 Six months ago we shipped Operational Rules for terraform-aws-modules. The question we get most since: "what exactly will it do to my module?"
Now you can see the diff before you touch a source line. Rules Playground and six more rules.
compliance.tf/blog/rules-pre…
Since March, the most common question about Operational Rules: "show me the diff first".
Rules Playground is live. Pick a terraform-aws-modules module, tick rules, and read the diff. No account needed.
Also: 15 rules now, and org-wide Baselines on trial or paid plans.
compliance.tf/blog/rules-pre…
#Terraform #ComplianceAsCode #DevOps
Back from #AWSHeroesSummit where it was awesome to meet old and new friends from all over the world and have some fun.
My travel story ( my.flightradar24.com/antonba… ): 42 countries, 422 flights.
More to come...
🤖 Made with AI
Anton Babenko 🇺🇦 retweeted
tfpolicy (by HashiCorp) ships a policy stage that runs before Terraform downloads a module.
At that point a policy sees a source string and a version. It allows or denies a name.
Which module that name resolves to is doing a lot of the compliance work.
compliance.tf/blog/hashicorp…
Anton Babenko 🇺🇦 retweeted
Terraform best practices for AI coding agents
github.com/antonbabenko/terr…
Another open-source tool from building @compliancetf
repro-lambda builds AWS Lambda zips outside Terraform: byte-identical on macOS and CI, uploaded to S3 by content hash, then promoted dev -> prod with no rebuild. Terraform reads s3_existing_package instead of rebuilding on every plan.
#Terraform #AWS #Lambda #serverless
github.com/antonbabenko/repr…
"Panels of models which consistently outperforms individual models" - this is exactly the point I was chasing when working on the Deliberation.
github.com/antonbabenko/deli…
Ask Codex, Gemini, Grok, and 400+ OpenRouter models (Qwen, Kimi, DeepSeek) for second opinions or arbiter-mediated consensus. One MCP server for Claude Code, Codex, Cursor, Kiro, OpenCode. Measures which models earn their seat.
#openrouter #fusion
Anton Babenko 🇺🇦 retweeted
#276 - Terragrunt structure secrets, IaC that acts like software, Lambda on your own EC2, AzAPI unlocks Azure Actions, and AI that scans your Terraform
weekly.tf/p/issue-276-terrag…
Was a bit skeptical reading this first but interesting part here is the agent verifying its own fixes against prod instead of trusting CI. Also funny from where I sit - a retry storm and a connection race are the kind of bugs that get provisioned wrong in Terraform on day one and surface as app bugs six months later. So you want this loop for cleanup, and you want your modules making these errors impossible in the first place.
Fascinating.
We ran an experiment. We pointed Antimetal at our own production environment, emitting 3,000 error logs a day, with no prior guidance.
It cut our error volume by 76% in a single day.
It found six unique problems, including one we'd misdiagnosed for weeks. It diagnosed and triaged each one, resolved it, and monitored the fix to confirm stability.
Production that runs itself is no longer hypothetical.
antimetal.com/blog/clearing-…
I've maintained terraform-aws-modules for years. They are general-purpose on purpose, and that leaves a gap: the module is fine, the compliant configuration is your problem.
This registry is my answer. Same modules, controls already in the code you pull.
compliance.tf/blog/complianc…
#ComplianceAsCode
The compliance-aware Teraform Registry is now public.
- terraform-aws-modules/s3-bucket/aws
+ soc2.compliance.tf/terraform…
SOC 2 controls built in. Non-compliant values fail at terraform plan.
Free CIS tier. First pull in 5 minutes:
compliance.tf/blog/complianc…
Sponsored by Kestra (@kestra_io) #ad
Terraform is great at creating infra. It has no opinion about Day 2.
IP changes -> DNS is wrong -> cache is stale -> someone has to know. That always ends up in a shell script nobody wants to open.
So I ran the follow-up right after apply, in one Git-versioned file:
```yaml
tasks:
- id: provision
type: io.kestra.plugin.terraform.cli.TerraformCLI
commands:
- terraform apply -auto-approve
- terraform output -raw instance_ip > ip.txt
outputFiles: [ip.txt]
- id: upsert_dns
type: io.kestra.plugin.cloudflare.dns.records.Upsert
name: "{{ inputs.record_name }}"
content: "{{ read(outputs.provision.outputFiles['ip.txt']) | trim }}"
```
Terraform's output feeds the DNS update. Logs + full run history on every run. No glue script.
This is a @kestra_io flow - YAML, self-hosted, runs on cloud, on-prem, or air-gapped.
Clone this Playbook Automation Blueprint to try it now: fandf.co/4o16nCO
My recent talk "Replace Terraform Module Forks with Automatic Policy Transformation Rules" from @iac_conf
youtube.com/watch?v=at56UPLF…