What

Terracotta AI is an infrastructure change governance platform for teams managing infrastructure as code, especially in regulated or audit-sensitive environments. It reviews Terraform and OpenTofu pull requests in GitHub or GitLab before merge, checking for security issues, compliance gaps, drift between code and live infrastructure, and estimated cost impact.

The product is positioned as a governance layer that fits into existing repository workflows without pipeline changes or migration. Developers receive findings directly in pull requests, while security, compliance, and platform teams get a centralized dashboard and tamper-evident audit trail for approvals, findings, and policy outcomes.

Features

Pull request governance for IaC — Automatically audits each infrastructure pull request and presents findings in the PR, helping reviewers focus on meaningful risks instead of large plan diffs.
Security and IAM analysis — Flags issues such as open ports, public buckets, and overly permissive IAM settings with severity context and documented findings.
Drift detection against live infrastructure — Compares code and deployed cloud state to surface console edits, manual applies, and deleted resources that may create compliance exposure.
Cost impact analysis — Estimates per-resource cost changes and supports approval thresholds so material spend increases can be reviewed before merge.
Plain-English guardrails — Lets teams define governance rules such as private S3 requirements or cost review thresholds without requiring Rego, Sentinel, or deeper policy-as-code expertise.
Auto-remediation proposals — Generates and can apply suggested fixes directly to the PR branch so teams review a proposed compliant change rather than only a violation notice.

Helpful Tips

Start with a small set of high-impact guardrails, such as public access, IAM over-permissioning, and cost thresholds, then expand as internal control requirements mature.
Validate how much of your governance process depends on live cloud context, because some capabilities such as drift detection appear to benefit from optional cloud credentials.
Use the PR review output as the developer-facing control point and the dashboard as the compliance-facing system of record to reduce duplicate review processes.
Review how auto-remediation is governed internally; suggested fixes can accelerate adoption, but regulated teams may still want explicit approval rules around automated branch changes.
If comparing this tool to static Terraform scanners, focus on its workflow coverage: governance, auditability, drift visibility, and approval evidence appear to be the main differentiators.