Does ops0 replace human review of IaC?

No. ops0 creates code faster, but teams still review changes through Git, approval gates, policy checks, and deployment workflows.

Can ops0 help with existing cloud resources?

Yes. ops0 can use discovery data from existing resources to help teams adopt IaC for brownfield infrastructure.

Can ops0 generate Terraform from plain-language intent?

Yes. ops0 generates Terraform, OpenTofu, or Oxid from either discovered live state or a plain-language description of what you want. Policy checks run before generation and cost is estimated before apply, so the code arrives already reviewed against your rules.

How does ops0 handle secrets in generated IaC?

Secret values are never sent to the AI. ops0 injects them at apply time as Terraform variables, so credentials stay out of generated code, out of prompts, and out of your Git history.

Can ops0 import existing production infrastructure into code?

Yes. ops0 imports existing production resources into IaC without recreating them, using prevent_destroy to protect live infrastructure. You can also save reusable blueprints and replicate a project across clouds.

Infrastructure as code

Turn findings into reviewed IaC.

Name: ops0
Author: ops0

Codify discovered state or plain-language intent into Terraform, OpenTofu, or Oxid, with the guardrails you already run present from the start.

Terraform, OpenTofu, and Oxid

Policy checks before generation

Cost estimated before apply

Secrets never shown to the AI

ops0.ai/features/iac/generate

ops0 reviewed IaC: generated Terraform for a discovered finding, policy checks passed, cost estimate, and approval status

How it works

From live cloud or plain language to approved code.

Discover or describe

Start from a discovered resource, or describe the change you want in plain language.

Policy-aware generate

Terraform, OpenTofu, or Oxid is generated with policy checks run before generation, not after.

Cost and plan preview

See the per-resource cost change and the full plan summary before anything is applied.

Approve and apply

Every change ships as a pull request, reviewed and approved before it touches production.

main.tfGenerated

import {
  to = aws_db_instance.payments_ledger
  id = "rds-payments-ledger-prod"
}

resource "aws_db_instance" "payments_ledger" {
  publicly_accessible     = false
  deletion_protection     = true
  backup_retention_period = 14

  lifecycle { prevent_destroy = true }
}

TerraformOpenTofuOxid

From reality to code

Codify what is already running.

Codify from discovered state or from plain-language intent.

Terraform, OpenTofu, or Oxid, your choice per project.

The guardrails you already run are present from the start.

Policy and costPolicy aware

Policy checksPassed

Cost change+$180 /month

Secret valuesExcluded from model

Public access

Removed

Ingress

10.42.0.0/16 only

Deletion protection

Enabled

Multi-AZ

Staged, cost-approved

Guardrails first

Every generation is policy aware.

Policy checks run before code is generated.

Cost is estimated up front, not after apply.

Secret values are never sent to the model.

Variables and secrets0 in code

SourceExternal vault

InjectedAt apply, as TF_VAR

Shown to AINever

RotationPicked up automatically

AWS Secrets ManagerGCP Secret ManagerAzure Key VaultOracle Vault

Secrets

Secrets stay out of the code.

Values are injected at apply time, as Terraform variables, never written into generated code.

Secret values are never shown to the AI.

Encrypt inline, or reference an external vault: AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, or Oracle Vault.

Plan summaryprevent_destroy: on

0 to add, 2 to change, 0 to destroy.

Resource

rds-payments-ledger-prod

Action

import, no recreate

Cost change+$180 /month

Interruption≤ 5 minutes

Policy checksPassed

ApproversPayments DB owner, FinOps

Pull request#842 ready

Apply statusAwaiting approval

Brownfield safe

Import, not recreate.

Adopt existing production into code without recreating it.

prevent_destroy protects production resources.

Approval is required before any apply.

IaC engines

Terraform · OpenTofu · Oxid

Secrets in code

injected at apply

Policy checkpoints

before generate, before apply

Per-resource

Cost preview

before apply

Every change

ships for review

Common questions

ops0 uses the risk finding, user intent, project context, discovered resources, dependencies, and policy rules to generate reviewable Terraform, OpenTofu, or Oxid code.

Find the risk.
Ship the reviewed fix.

Reviewed IaC is the next move after discovery. Every generated change carries policy, cost, and approval context.

Explore Deployments