Why I Still Don't Trust AI to Fix My Infrastructure (But I'm Starting to See Its Point)

Last month, I watched a junior developer on my team confidently merge a Terraform change because GitHub Copilot said it was "secure." It wasn't. The change removed encryption configuration and the pipeline didn't catch it. That moment stuck with me, and when I read about using AI to assist with infrastructure security reviews, I realized I'd been thinking about this entirely wrong.

I've been defensive about AI in infrastructure code. It feels too risky, too final, too easy to miss something critical. But the real insight here isn't about letting Copilot make decisions, it's about using it as a thinking partner while humans stay in control. That's a distinction that matters more than I initially gave it credit for.

The Setup: What Actually Happened in This Experiment

The experiment itself was straightforward but revealing. Someone took an intentionally insecure Terraform configuration for Azure Storage (public blob access, weak TLS, shared key authentication), ran it through Azure Pipelines with Checkov scanning, then used GitHub Copilot in VS Code to work through what the findings meant and propose fixes.

The results were honest about limitations: warnings dropped from seven to three, but errors stayed at three. The pipeline passed anyway. That's the kind of detail that separates real infrastructure work from tutorials, the scan finishing and the pipeline succeeding don't mean your security posture actually improved.

What impressed me was how the workflow was structured. The security scanner (Checkov) generated a SARIF report (a machine-readable format), that fed into Microsoft Defender for Cloud for visibility, and then Copilot helped interpret and fix the issues. Each component did one thing well, and humans remained the decision makers at every step.

How I'd Actually Use This in Production

Here's where I'm being honest about what changed my mind: I have teams regularly misinterpreting security findings. Someone sees "enable encryption" in a Copilot suggestion and applies it without understanding the performance implications or checking application compatibility. That happens with humans too, obviously, but it happens faster with AI.

The original article gets this right by distinguishing between a plausible suggestion and a valid solution. Copilot can explain why a finding matters and propose a fix. But that fix needs:

• A code review (someone who understands your infrastructure)
• Compatibility testing (does your app still work?)
• Provider version verification (is this argument actually supported?)
• A second pipeline run to confirm the finding is resolved

I'd use Copilot for the interpretation and initial suggestion phase. Where I wouldn't trust it is as a final arbiter. If I'm implementing a security change Copilot suggested, I'm checking three additional things before merge.

A Practical Example from My Own Work

Here's a pattern I'm adopting now:

# Before: Copilot identifies this is risky
resource "azurerm_storage_account" "example" {
 account_replication_type = "LRS" # Local redundancy
 https_traffic_only_enabled = false # Copilot flags this
}

# After: Copilot suggests this
resource "azurerm_storage_account" "example" {
 account_replication_type = "LRS"
 https_traffic_only_enabled = true
}

# But I verify:
# 1. Check if existing clients support HTTPS-only
# 2. Confirm the Azure provider version supports this argument
# 3. Run terraform plan to inspect actual changes
# 4. Rerun the security scan to confirm the finding resolved

The Copilot suggestion isn't wrong here, it's actually correct. But my job as an engineer is confirming it's correct in my context, not just in general.

My Take: Assistance ≠ Automation

I think this article's biggest contribution is actually what it didn't do. It didn't build an autonomous agent that approved its own fixes. It didn't skip the pull request process. It didn't assume that a passing pipeline means security requirements were met.

That's the distinction I was missing. I'd been treating "AI in infrastructure" as an all-or-nothing proposition: either you trust it completely or you don't use it at all. The real value is in the middle ground, using AI to make security reviews faster while keeping humans in the decision loop.

Where I'd push back: the article doesn't deeply explore what happens when Copilot's suggestion conflicts with your organizational policy or architectural constraints. I've seen that happen, and it requires real expertise to push back against. That's where the human reviewer becomes critical.

What I'm Going to Test

I'm going to implement this in one project, Terraform + Checkov + Copilot for interpretation, but with mandatory code review and a verification step. I want to see if this actually saves time on infrastructure review cycles without introducing blind spots.

My question for you: Have you used Copilot for infrastructure code? What went wrong? More importantly, what went right that surprised you?

Source: This post was inspired by "AI-Assisted Terraform Security Reviews with Azure DevOps and GitHub Copilot" by Dev.to. Read the original article