Automate Terraform Plan Compliance Checks with GPT‑4o in GitHub Actions

User avatar placeholder
Written by Tamzid Ahmed

October 9, 2026

Terraform’s declarative syntax makes infrastructure easier to version, but it also opens doors to subtle compliance violations. Adding AI‑driven checks to your pipeline lets you catch policy breaches in real time, freeing human reviewers for higher‑value tasks.

Why Automate Terraform Plan Compliance?

Traditional policy engines like OPA or Sentinel audit Terraform plans, but they rely on static rule sets. An AI model can interpret context, suggest remediation, and adapt to evolving standards without manual rule updates.

GPT‑4o: The LLM Behind Policy Enforcement

GPT‑4o can parse natural language policy statements and Terraform plan JSON, returning actionable verdicts. Its fine‑tuned text‑predicton model excels at semantic reasoning, making it ideal for safety‑critical compliance.

Prerequisites and Environment Setup

Tools required:

  • HashiCorp Terraform 1.6+ (with JSON plan output)
  • GitHub Actions runner (Ubuntu latest)
  • OpenAI API key for GPT‑4o
  • jq (JSON processor)

Store your OpenAI key as a secret OPENAI_API_KEY in the repo settings. Create a basic Terraform configuration to generate a plan.

Crafting a GPT‑4o Prompt for Terraform Plan Analysis

Design a prompt that feeds the plan and the policy text. Example template:

  • “You are a security analyst. The following JSON block is a Terraform plan. The policy states: “${POLICY_TEXT}”. Verify compliance and list failures with suggested code changes. Respond in JSON: {“compliant”: boolean, “issues”: [ {“line”: int, “reason”: string, “suggestion”: string} ] }”

Tips:

  1. Keep the prompt length under 4 K tokens.
  2. Replace placeholders (${POLICY_TEXT}) via GitHub Actions mapping.
  3. Use multiline JSON extraction to simplify downstream parsing.

Building the GitHub Action Workflow

Below is a minimal workflow that runs Terraform, posts the plan to GPT‑4o, and exits with failures if non-compliant.

name: Terraform Compliance Check
on: pull_request
jobs:
compliance:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Terraform Init
run: terraform init
- name: Terraform Plan
run: terraform plan -input=false -no-color -out=tfplan
- name: Convert Plan to JSON
run: terraform show -json tfplan > plan.json
- name: Run GPT‑4o Compliance
env:
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
run: |
RESPONSE=$(curl -s -XPOST https://api.openai.com/v1/chat/completions
-H "Authorization: Bearer $OPENAI_API_KEY"
-H "Content-Type: application/json"
-d '{"model":"gpt-4o","messages":[{"role":"system","content":"You are a security auditor.","role":"user","content": "$(cat plan.json)"}] }')
echo "$RESPONSE" > gpt_response.json
if ! jq -e '.compliant // exit 1' gpt_response.json; then
echo "Compliance check failed. See issues in gpt_response.json"
exit 1
fi
echo "Compliance passed.")

Replace the prompt payload with the refined template from the previous section. Tip: Store policy files in policies/*.tfpolicy and inject via Actions mapping.

Parsing GPT‑4o Output into Actionable Feedback

Convert the JSON response into a Jenkins‑style summary or comment.

  • Use jq to extract issues array.
  • Generate a markdown table: | Line | Reason | Suggestion |
  • Post the summary as a PR comment using the github-script Action.

Handling False Positives & Fine‑Tuning

AI models may flag benign changes. Mitigate by:

  1. Maintaining a whitelist of acceptable deviations.
  2. Re‑prompting GPT‑4o with context about broader architecture.
  3. Applying confidence thresholds in the issues array.

Monitoring, Alerting, and Audit Logging

Store every gpt_response.json with a timestamp in an S3 bucket or GitHub artifact. Use Grafana to visualize trends. Configure a Slack or Teams webhook to alert when compliance hits critical failure criteria.

Trade‑offs: Cost, Latency, Security

Cost: GPT‑4o tokens are billed per 1K token. A typical plan JSON (~2 K tokens) costs ~$0.10 per run.

Latency: API round‑trip averages 2–4 s. Add a timeout in Actions if your pipeline is strict.

Security: Never expose raw Terraform state. Present only the plan JSON, and mask private variables before sending.

Conclusion

With a simple GitHub Action and a GPT‑4o prompt, you can transform traditional IaC compliance into a dynamic, learning system. Start by integrating the example workflow, then iterate the prompt based on false‑positive data. Your next step: implement an audit log to correlate AI findings with man‑made policy changes, ensuring continuous improvement.

Leave a Comment