AWS Terraform reviews · for engineers and the people they report to

A second opinion on your AWS architecture, with the receipts.

ArchiBrief reads your Terraform and a short brief about the workload, then explains in plain language what's exposed, what could fail, and why each fix matters. Each finding shows the code it's based on and, where it relies on AWS guidance, the exact passage, so you can check it.

Submit your own Terraform
  • Never touches your AWS account
  • Evidence shown with each finding
  • AI mistakes shown, not hidden

One review, two readers

Built for the engineer who fixes it and the person who has to say yes.

For engineers

The evidence dashboard

Each finding with the resource it's about, the AWS guidance it cites, how sure it is, and the exact change to make.

For everyone else

The guided report

“Your proxy can be tricked into handing over its AWS credentials, and those credentials can read every bucket. That's the pattern behind the 2019 Capital One breach.”

See it, then ask it

Diagram and questions

A diagram drawn from your code with each finding pinned where it applies. Ask follow-ups and push back; every answer cites the review.

How it works

From Terraform to a review you can check

The same steps run for every review, including the real ones above.

  1. You submit Terraform and a brief

    A Terraform archive plus a few sentences about the workload: traffic, how available it must be, any data rules.

    The brief matters. "Card data must never be reachable from the internet" turns a loose role from a footnote into the top risk.

    cloud_breach_s3.tarinput
    • terraform/
    • ec2.tf
    • s3.tf
    • vpc.tf
    • variables.tf

    Workload briefA bank's card platform. One nginx proxy faces the internet; an S3 bucket holds cardholder data and must never be reachable from it. PCI-DSS applies.

  2. Checks run, guidance is retrieved

    A trusted open-source scanner (Trivy) and ArchiBrief's own rules check the Terraform. Then the matching passages are pulled from AWS Well-Architected and security best-practice docs.

    Anything outside the submitted code is marked as a gap, never assumed.

    checksdeterministic
    • FAILProxy's role has AmazonS3FullAccess
    • FAILProxy doesn't require IMDSv2 tokens
    • FAILCard-data bucket public access not fully blocked
    • GAPNo CloudTrail in the code; may exist at org level

    Retrieved: SEC03-BP02 · SEC06-BP05 · SEC05-BP02

  3. You get a review with receipts

    A model weighs every result against your brief. Each citation is checked word for word against the AWS text before anything is published.

    Each finding: what it's about, the guidance it relies on, how sure it is, and what to change.

    report · findingoutput
    High risk

    The proxy's role can read every bucket, including the card data

    Evidence
    aws_iam_role "cg-banking-WAF-Role" is used by the EC2 proxy and has AmazonS3FullAccess attached
    Cites
    SEC03-BP02 Grant least privilege access
    Recommendation
    Replace the managed policy with one that names only the actions and buckets the proxy uses.

Real reviews of AWS code

Three open-source AWS projects, reviewed by ArchiBrief and then checked by hand. Where the AI got something wrong, the review says so.

Submit your Terraform

ArchiBrief reads the code; it never runs Terraform or touches your AWS account. Each review uses a paid model, so a few run each day; if today's are used up, try again tomorrow.

Before you submit: remove secrets and customer data. Modules pulled from elsewhere aren't reviewed; they show up as gaps.
Shown as the report's title. Left blank, we use the file name.
Your Terraform
Used to find the right AWS guidance and decide what matters most. A few sentences is enough.

Complete verification to start a review. Keep this tab open to retain access to your report.

What it checks

  • Public exposureS3 public access, open security groups
  • Identity & accesswildcard IAM, unconditioned trust
  • Encryption at restS3, EBS, RDS storage
  • Recoverabilitybackups, versioning, point-in-time recovery
  • Availabilitysingle-AZ databases vs. your needs
  • Audit trailCloudTrail and log validation

Checked by Trivy's trusted rules plus ArchiBrief's own, then weighed against your brief.