Infrastructure-as-Code Review

Produce a structured infrastructure-as-code review that applies security, reliability, and operational quality standards to a specific body of IaC code. The output serves two purposes: an actionable review report for the code at hand (with findings by severity and specific remediation steps), and a reusable checklist the team can apply to every future IaC change. If the user provides actual code, analyze it and populate the findings table with real issues. If no code is provided, produce the checklist and a template findings report.

Required Inputs

Ask for these if not already provided:

• IaC tool — Terraform, CloudFormation, Pulumi, Ansible, or CDK
• Cloud provider — AWS, GCP, Azure, or multi-cloud
• What the code provisions — a brief description (e.g., "VPC, EKS cluster, and RDS instance for the payments service")
• Security policies or naming standards in use — any existing org standards to check against; if none, use sensible defaults
• The IaC code itself — paste or describe it; if not provided, produce the checklist template only and note findings require code

Output Format

IaC Review Report: [What Is Being Provisioned]