# Terracotta AI — Full Reference

> Terracotta AI is the Terraform expert for platform teams. It reviews every pull request and runs 12 automated checks — cost estimation, drift detection, security analysis, guardrail enforcement, blast radius, AI code review, architecture visualization, and more — before code is merged.

Terracotta AI is built by Enfra, inc. It integrates with GitHub and GitLab as a shift-left review layer that reviews and explains every infrastructure PR without replacing your existing CI/CD pipeline. Connect your repos in two minutes — no pipeline migration, no state backend changes, no CI/CD replacement.

Terracotta AI is SOC 2 Type II certified and HIPAA compliant. It does not use customer code or infrastructure data for model training.

## The 12 PR Checks

Every pull request that touches Terraform, Terragrunt, OpenTofu, or Kubernetes files automatically receives these checks:

### Terraform Checks (6)
1. **AI Code Review**: Context-aware review explaining what changed, why it matters, and what to fix
2. **Cost Estimation**: Per-resource cost estimates using live AWS, GCP, and Azure pricing APIs
3. **Drift Detection**: Compares Terraform state against live cloud infrastructure across 1,618 AWS resource types
4. **Security & IAM Analysis**: Checks for IAM over-permissions, open network access, unencrypted storage, and public exposure
5. **Guardrail Enforcement**: Evaluates changes against plain English policies defined by platform teams
6. **Blast Radius Analysis**: Maps downstream dependencies and assesses the impact scope of every change

### Kubernetes Checks (6)
1. **K8s Summary**: Overview of manifest changes with risk assessment
2. **K8s Review**: AI-powered code review for K8s manifests, Helm charts, and Kustomize overlays
3. **K8s Guard**: Guardrail enforcement for Kubernetes policies
4. **K8s Conflict**: Detects resource conflicts across namespaces and clusters
5. **K8s Validate**: Schema and best-practice validation
6. **K8s Resources**: Resource request/limit analysis and right-sizing recommendations
7. **K8s Security**: RBAC, pod security, network policy, and secrets management checks

### Additional Capabilities
- **Auto-Fix Proposals**: Generates and commits fix proposals directly to the PR branch
- **Architecture Visualization**: Interactive Mermaid dependency diagrams in PR comments
- **Terracotta AI Bot**: Conversational bot in PR comments for re-running checks, asking questions, and requesting specific analysis

## Product Pages

- [Platform Overview](https://www.tryterracotta.com/features): Two views — automated PR reviews and a fleet-wide command center. Every PR gets 12 checks; the command center tracks cost, drift, security, and compliance across all repos and teams.
- [Cost Analysis](https://www.tryterracotta.com/features/cost-analysis): Per-resource cost estimates with live AWS, GCP, and Azure pricing. Budget threshold enforcement as a PR check. Fleet-wide cost intelligence dashboard with trends and optimization suggestions.
- [Drift Detection](https://www.tryterracotta.com/features/drift-detection): Scheduled scans comparing Terraform state against live AWS, GCP, and Azure infrastructure. Root cause analysis explains why drift occurred. Drift lifecycle management from detection through remediation.
- [Security & IAM](https://www.tryterracotta.com/features/security): IAM least-privilege analysis, open network access detection, unencrypted storage alerts, and public resource exposure checks. Aligned with SOC 2, ISO 27001, CIS Benchmarks, and AWS Well-Architected Framework.
- [Guardrails](https://www.tryterracotta.com/features/guardrails): Write infrastructure policies in plain English (e.g., "S3 buckets must block public access"). Terracotta enforces them with AI semantic matching on every PR. No OPA, Rego, or Sentinel required.
- [Kubernetes](https://www.tryterracotta.com/features/kubernetes): 7-check deep analysis for K8s manifests including security scanning, RBAC review, resource impact analysis, conflict detection, and validation against best practices.
- [Architecture](https://www.tryterracotta.com/features/architecture): Interactive module dependency graphs rendered as Mermaid diagrams. Critical path identification, single point of failure detection, drift overlays, and service tier color-coding.
- [Beacon AI Assistant](https://www.tryterracotta.com/features/ai-assistant): Context-aware chat assistant with full knowledge of your repos, PRs, drift reports, cost data, and security findings. Available on every screen in the command center and in Slack.
- [Enterprise](https://www.tryterracotta.com/enterprise): SOC 2 Type II certified, HIPAA compliant. SSO with SAML/OIDC, self-hosted deployment on your infrastructure, audit logging, dedicated support, and custom integrations.
- [Pricing](https://www.tryterracotta.com/pricing): Free tier (50 public PRs, 1 private repo, 5 seats), Platform tier ($49/seat/month with all features), Enterprise tier (custom pricing).

## Use Cases

- [Automate Terraform PR Reviews](https://www.tryterracotta.com/use-cases/automate-terraform-pr-reviews): Your best infrastructure engineers spend half their week reviewing Terraform PRs. Terracotta runs 12 automated checks on every PR — plan summary, security, cost, drift, blast radius, guardrails, and more — so teams ship faster without sacrificing safety.
- [Control Infrastructure Cost Overruns](https://www.tryterracotta.com/use-cases/control-infrastructure-cost-overruns): A $3,800/month spike shows up three weeks after a PR merged. Terracotta puts cost estimates in every PR with live cloud pricing and budget enforcement to prevent overruns before code reaches CI/CD.
- [Detect and Fix Infrastructure Drift](https://www.tryterracotta.com/use-cases/detect-and-fix-infrastructure-drift): Console edits, local applies, unmerged changes — your Terraform state and live infrastructure are out of sync right now. Terracotta compares state against live AWS, GCP, and Azure with scheduled scans, root cause analysis, and drift lifecycle management.

## Comparisons with Other Tools

### Terracotta AI vs Terraform Cloud
- [Full comparison](https://www.tryterracotta.com/compare/terracotta-vs-terraform-cloud)
- Terraform Cloud is HashiCorp's managed platform for remote Terraform execution, state management, and Sentinel policy enforcement. Resource-based pricing ($0.47/resource/month on Standard).
- Terracotta is an AI-powered PR analysis layer. It does not replace execution or state management. Per-seat pricing at $49/seat/month.
- Key differences: Terracotta has built-in cost estimation (TFC removed it), plain English guardrails (vs Sentinel/Rego), AI-powered code review (vs raw plan output), and predictable per-seat pricing.

### Terracotta AI vs Spacelift
- [Full comparison](https://www.tryterracotta.com/compare/terracotta-vs-spacelift)
- Spacelift is a full IaC CI/CD platform with managed plan/apply, state management, OPA policies, and multi-IaC support. Starts at $399/month.
- Terracotta plugs into your existing CI/CD in two minutes. No pipeline migration required.
- They are complementary — teams can use Spacelift for execution and Terracotta for AI-powered PR intelligence.

### Terracotta AI vs Atlantis
- [Full comparison](https://www.tryterracotta.com/compare/terracotta-vs-atlantis)
- Atlantis is free, open-source Terraform plan/apply automation via PR comments. Self-hosted only.
- Terracotta is SaaS with zero infrastructure to manage. Includes cost, drift, security, guardrails, blast radius — all features Atlantis requires separate integrations for.
- They work great together: Atlantis for execution, Terracotta for intelligence.

### Terracotta AI vs env0
- [Full comparison](https://www.tryterracotta.com/compare/terracotta-vs-env0)
- env0 is an IaC automation platform with managed workflows, self-service environments, and OPA governance. Starts at $1,500/month.
- Terracotta is an analysis layer at $49/seat/month. No pipeline migration or vendor lock-in.

### Terracotta AI vs Infracost
- [Full comparison](https://www.tryterracotta.com/compare/terracotta-vs-infracost)
- Infracost is a dedicated cost estimation tool with 1,100+ resource types and usage-based modeling. Infracost Cloud starts at $1,000/month for 10 seats.
- Terracotta includes cost estimation as one of twelve checks. 10 seats costs $490/month (vs $1,000 for Infracost) and includes drift, security, guardrails, blast radius, and AI code review.

### Terracotta AI vs Checkov
- [Full comparison](https://www.tryterracotta.com/compare/terracotta-vs-checkov)
- Checkov is a free, open-source IaC security scanner with 1,000+ built-in rules across 14+ frameworks.
- Terracotta uses AI to explain why findings matter and includes cost, drift, guardrails, blast radius, and a command center alongside security.

## Alternatives Hub Pages

- [Best Terraform Cloud Alternatives in 2026](https://www.tryterracotta.com/compare/terraform-cloud-alternatives)
- [Best Spacelift Alternatives in 2026](https://www.tryterracotta.com/compare/spacelift-alternatives)
- [Best Atlantis Alternatives in 2026](https://www.tryterracotta.com/compare/atlantis-alternatives)
- [Best Infracost Alternatives in 2026](https://www.tryterracotta.com/compare/infracost-alternatives)
- [Best env0 Alternatives in 2026](https://www.tryterracotta.com/compare/env0-alternatives)
- [Best Checkov Alternatives in 2026](https://www.tryterracotta.com/compare/checkov-alternatives)
- [Best IaC Analysis Tools in 2026](https://www.tryterracotta.com/compare/best-iac-analysis-tools)

## Documentation

### Getting Started
- [Introduction to Terracotta AI](https://www.tryterracotta.com/docs/overview/getting-started): What Terracotta does and how it works
- [Why Terracotta AI?](https://www.tryterracotta.com/docs/overview/why-terracotta-ai): The problem Terracotta solves
- [Quick Start Video Tutorials](https://www.tryterracotta.com/docs/getting-started/quick-start-video-tutorials): Step-by-step video guides
- [Connect GitHub](https://www.tryterracotta.com/docs/getting-started/github): Connect your GitHub repos
- [Connect GitLab](https://www.tryterracotta.com/docs/getting-started/gitlab): Connect your GitLab repos
- [Configure Terraform Repo Type](https://www.tryterracotta.com/docs/getting-started/step-2-configure-your-terraform-repo-type): Standard or monorepo setup
- [Monorepo Support](https://www.tryterracotta.com/docs/getting-started/step-2-configure-your-terraform-repo-type-terraform-monorepo-support): Configuring multi-project repos
- [Enable AI Prompts](https://www.tryterracotta.com/docs/getting-started/step-3-enable-terracotta-ai-prompts): Activate PR analysis

### PR Analysis
- [Inside the PR](https://www.tryterracotta.com/docs/pr-analysis/inside-the-pr): How the 12-check analysis works
- [PR/MR Reviews](https://www.tryterracotta.com/docs/pr-analysis/inside-the-pr-pull-and-merge-request-reviews): AI code review details
- [Cost Estimation](https://www.tryterracotta.com/docs/pr-analysis/inside-the-pr-cost-estimation): How cost analysis works in PRs
- [Drift Detection](https://www.tryterracotta.com/docs/pr-analysis/inside-the-pr-drift-detection): Drift checks in PR context
- [Security & Compliance](https://www.tryterracotta.com/docs/pr-analysis/inside-the-pr-security-compliance-review): Security review details
- [Custom Guardrails](https://www.tryterracotta.com/docs/pr-analysis/inside-the-pr-using-guardrails-for-custom-policy-enforcement): Using guardrails in PRs
- [AI Bot in PRs](https://www.tryterracotta.com/docs/pr-analysis/inside-the-pr-using-the-terracotta-ai-bot-in-pull-requests): Conversational bot commands
- [K8s Manifest Analysis](https://www.tryterracotta.com/docs/pr-analysis/inside-the-pr-kubernetes-manifest-analysis): Kubernetes checks in PRs
- [Simulate Deployment](https://www.tryterracotta.com/docs/pr-analysis/inside-the-pr-simulate-a-deployment): Pre-merge deployment simulation

### Command Center (Platform)
- [Dashboard](https://www.tryterracotta.com/docs/platform/dashboard): Fleet-wide overview
- [Drift Dashboard](https://www.tryterracotta.com/docs/platform/drift-dashboard): Drift monitoring and lifecycle management
- [Cost Intelligence](https://www.tryterracotta.com/docs/platform/cost-intelligence): Cost trends and optimization
- [Module Intelligence](https://www.tryterracotta.com/docs/platform/module-intelligence): Terraform module usage analysis
- [Architecture View](https://www.tryterracotta.com/docs/platform/architecture-view): Dependency visualization
- [AI Guardrails](https://www.tryterracotta.com/docs/platform/guardrails): Creating and managing guardrail policies
- [AI Bot Commands](https://www.tryterracotta.com/docs/platform/terracotta-built-in-commands): Available bot commands
- [PR Status Checks](https://www.tryterracotta.com/docs/platform/pr-status-check-enforcement): Merge blocking configuration

### Configuration
- [Best Practices](https://www.tryterracotta.com/docs/configuration/interacting-with-terracotta-1): Configuration how-to guide
- [Credentials & Environment Variables](https://www.tryterracotta.com/docs/configuration/credentials-environment-variables): Managing secrets
- [CLI Tool (tc)](https://www.tryterracotta.com/docs/configuration/cli-tool): Command-line interface
- [Team Management](https://www.tryterracotta.com/docs/configuration/organization): Inviting teammates and RBAC
- [Plans & Billing](https://www.tryterracotta.com/docs/configuration/plans-and-billing): Subscription management

### Integrations
- [HCP Terraform](https://www.tryterracotta.com/docs/integrations/hcp-terraform): Terraform Cloud integration
- [TFC/TFE Run Tasks](https://www.tryterracotta.com/docs/integrations/hcp-terraform-terraform-cloudenterprise-run-tasks): Run Tasks setup
- [AWS Integration](https://www.tryterracotta.com/docs/integrations/aws): AWS connection for drift detection
- [Slack Integration](https://www.tryterracotta.com/docs/integrations/slack): Slack notifications and Beacon AI

### Public API
- [Authentication](https://www.tryterracotta.com/docs/api/authentication): API key and JWT authentication
- [Endpoints Overview](https://www.tryterracotta.com/docs/api/endpoints): Complete endpoint reference
- [Terraform Endpoints](https://www.tryterracotta.com/docs/api/terraform-endpoints): Summary, Review, Plan, Cost, Guard, Drift, Conflict, Blast Radius, Dependencies, Architecture
- [Kubernetes Endpoints](https://www.tryterracotta.com/docs/api/kubernetes-endpoints): K8s Summary, Review, Guard, Conflict, Validate, Resources, Security
- [Schemas & Responses](https://www.tryterracotta.com/docs/api/schemas): Request and response schema reference
- [Rate Limits](https://www.tryterracotta.com/docs/api/rate-limits): Rate limits and usage quotas

## Blog (Recent)

- [Your Cloud Bill Is Decided in Pull Requests](https://www.tryterracotta.com/blog/your-cloud-bill-is-decided-in-pull-requests): A developer opens a PR with 14 lines of Terraform. Three weeks later, a $3,800/month spike. The moment your cloud bill is determined isn't when the invoice arrives — it's when the PR gets approved.
- [Anatomy of an AI-Powered Terraform PR Review](https://www.tryterracotta.com/blog/anatomy-of-an-ai-powered-terraform-review): Terracotta AI runs 12 automated checks on every Terraform PR the moment it's opened. Here's what platform teams get.
- [Free Terracotta AI Pro for Open Source](https://www.tryterracotta.com/blog/free-terracotta-ai-pro-tier-for-open-source): Free Pro tier for all public Terraform repos on GitHub.
- [Top 5 Bottlenecks in Self-Service Terraform](https://www.tryterracotta.com/blog/the-top-5-bottlenecks-in-self-service-terraform-and-why-they-keep-coming-back): A single failed Terraform PR can waste 15+ engineering hours and cost over $2,000.
- [Terracotta AI x HashiCorp: Terraform Run Tasks](https://www.tryterracotta.com/blog/terracotta-and-hashicorp-integration-cloud-run-tasks): New Run Tasks integration for Terraform Cloud and Enterprise.
- [Top 5 Terraform Workflow Tools](https://www.tryterracotta.com/blog/top-5-terraform-workflow-tools-you-should-know-in-2025): Comparison of Terraform Cloud, Spacelift, Atlantis, env0, and Terracotta AI.
- [Real-Time Natural Language Guardrails](https://www.tryterracotta.com/blog/real-time-natural-language-guardrails): Write policies in English, enforce them on every PR.
- [Migrating Sentinel Policies to AI Guardrails](https://www.tryterracotta.com/blog/migrate-sentinel-policies-to-terracotta-ai): Convert Sentinel policies to plain English guardrails in under 5 minutes.
- [Terraform Drift Detection Guide](https://www.tryterracotta.com/blog/terraform-drift-checks): Complete guide to drift causes, prevention, and safe remediation.
- [KubeCon + CloudNativeCon NA 2025](https://www.tryterracotta.com/blog/terracotta-ais-guide-to-kubecon-cloudnativecon-north-america-2025): Terracotta at KubeCon.
- [New Features: API & HCP Integration](https://www.tryterracotta.com/blog/new-features-api-hcp-integration): Public API and Terraform Cloud Run Tasks.
- [Why Your AI-Powered IaC Workflow is Backwards](https://www.tryterracotta.com/blog/why-your-ai-powered-infrastructure-as-code-workflow-is-backwards): AI should review infrastructure changes, not generate them.
- [Why Good Infrastructure Processes Still Break Production](https://www.tryterracotta.com/blog/why-good-infrastructure-processes-still-break-production): The gap between process and reality.
- [Manual Terraform Reviews Don't Scale](https://www.tryterracotta.com/blog/manual-terraform-reviews-dont-scale): Why human-only Terraform review breaks down at scale.
- [Introducing Terracotta AI Guardrails](https://www.tryterracotta.com/blog/introducing-terracotta-guardrails-ai-opa): Context-aware Policy as Code for Terraform.
- [Terracotta AI and Terraform Cloud](https://www.tryterracotta.com/blog/terracotta-ai-and-terraform-cloud): Adding pre-deployment safety checks to TFC workflows.
- [How Terracotta AI Enhances Spacelift](https://www.tryterracotta.com/blog/how-terracotta-ai-enhances-spacelift): Complementary shift-left intelligence for Spacelift users.
- ["Looking Back, We Should've Caught It"](https://www.tryterracotta.com/blog/looking-back-we-shouldve-caught-it): Stories of infrastructure incidents that could have been prevented.
- [The Future of IaC PR Reviews](https://www.tryterracotta.com/blog/the-future-of-iac-pr-reviews): Letting AI handle the Terraform tax.
- [Why is Terraform Still Hard in 2025?](https://www.tryterracotta.com/blog/why-is-terraform-still-hard-in-2025): The challenges that persist in Terraform workflows.
- [AI Terraform Code Reviews: Safe and Transparent](https://www.tryterracotta.com/blog/ai-terraform-code-reviews-safe-transparent): How AI reviews make infrastructure safer.
- [Introduction to Terracotta AI](https://www.tryterracotta.com/blog/intro-to-terracotta-ai): Closing the gap between code and reality.

## Case Study

- [Laminated Labs](https://www.tryterracotta.com/case-study/laminatedlabs): How Laminated Labs uses Terracotta AI to review every Terraform pull request for cost, drift, and security before merge.

## Trust & Compliance

- [Security & Trust Center](https://www.tryterracotta.com/trust): SOC 2 Type II certified, HIPAA compliant, end-to-end encryption, zero data model training
- [Privacy Policy](https://www.tryterracotta.com/privacy): Data collection, usage, and protection practices
- [Terms of Service](https://www.tryterracotta.com/terms): Terms governing platform usage
- [Cookie Policy](https://www.tryterracotta.com/cookies): Cookie and tracking technology usage

## Frequently Asked Questions

### What is Terracotta AI?
Terracotta AI is an infrastructure intelligence platform that runs 12 automated checks on every Terraform, Terragrunt, OpenTofu, and Kubernetes pull request — including AI code review, cost estimation, drift detection, security analysis, guardrail enforcement, and blast radius assessment. It integrates with GitHub and GitLab as a shift-left analysis layer without replacing your existing CI/CD pipeline. Setup takes two minutes.

### How much does Terracotta AI cost?
Free tier: 50 public PRs, 1 private repo, 5 seats. Platform tier: $49/seat/month with all 12 checks, unlimited repos, and the command center dashboard. Enterprise: custom pricing with SSO (SAML/OIDC), self-hosted deployment, audit logging, HIPAA compliance, and dedicated support.

### Does Terracotta AI replace Terraform Cloud, Spacelift, or Atlantis?
No. Terracotta is an analysis layer, not an execution platform. It does not run terraform plan or terraform apply, and it does not manage state. It works alongside Terraform Cloud, Spacelift, Atlantis, env0, or any CI/CD system — adding AI-powered intelligence to PRs without replacing your pipeline.

### How does Terracotta AI handle security and compliance?
Terracotta is SOC 2 Type II certified and HIPAA compliant. It does not use customer code or infrastructure data for AI model training. Enterprise customers can deploy Terracotta fully self-hosted on their own infrastructure. All data is encrypted in transit and at rest.

### What cloud providers does Terracotta support?
Cost estimation supports AWS and GCP with live pricing APIs. Drift detection covers 1,618 AWS resource types, plus GCP and Azure. Security analysis covers AWS, GCP, and Azure resource patterns. The platform is cloud-agnostic for Terraform/Terragrunt analysis.

### How does drift detection work?
Terracotta compares your Terraform state against live cloud infrastructure. It runs automatically on every PR and on configurable schedules (hourly, daily, weekly). Drift items include severity ratings, AI-generated root cause analysis, and lifecycle management (active, acknowledged, suppressed, resolved). No agents or CLI tools required.

### What are guardrails?
Guardrails are plain English infrastructure policies that Terracotta enforces using AI semantic matching on every PR. For example: "S3 buckets must block public access" or "all resources must have a cost center tag." No OPA, Rego, or Sentinel required. Platform teams define policies in the dashboard and they are enforced automatically.

### Does Terracotta support Kubernetes?
Yes. Terracotta runs 7 checks on Kubernetes manifest changes: summary, AI code review, guardrail enforcement, conflict detection, schema validation, resource analysis, and security scanning. It supports raw manifests, Helm charts, and Kustomize overlays.

### How is Terracotta different from Infracost?
Infracost is a dedicated cost estimation tool with 1,100+ resource types and usage-based modeling. Terracotta includes cost estimation as one of twelve PR checks — alongside drift detection, security analysis, guardrails, blast radius, and AI code review. 10 seats cost $490/month with Terracotta (vs $1,000/month for Infracost Cloud), and Terracotta includes eleven additional checks.

### How is Terracotta different from Checkov?
Checkov is a rule-based IaC security scanner with 1,000+ built-in rules. It outputs pass/fail by rule ID. Terracotta uses AI to explain what changed, why it matters, and how to fix it — plus includes cost estimation, drift detection, blast radius, guardrails, and a fleet-wide command center alongside security analysis.

## Contact

- Website: https://www.tryterracotta.com
- Sign up: https://app.tryterracotta.com/signup
- Email: founders@tryterracotta.com
- Security: security@tryterracotta.com
- Twitter/X: https://x.com/tryterracotta
- LinkedIn: https://www.linkedin.com/company/tryterracotta
- GitHub: https://github.com/enfraxyz