Build a Terraform State MCP Server: Let AI Agents Query Your Infrastructure Without Leaking Secrets

Description and use

Build a Terraform State MCP server that gives AI agents read‑only, secret‑aware access to Terraform state, with minimal IAM permissions.

Problem

Incident responders need to answer Terraform‑related questions about live resources without exposing secrets or granting excessive permissions to AI agents.

Outcome

The MCP server provides AI agents with read‑only, secret‑aware access to Terraform state, enabling rapid incident queries without leaking secrets or granting excessive permissions.

Workflow

• 1. Create an IAM role with only s3:GetObject, s3:GetObjectVersion, s3:ListBucketVersions (for a specific bucket prefix) and kms:Decrypt for the state KMS key.
• 2. Attach the role to the MCP server instance or container.
• 3. Define a fixed allowlist of stack names mapping to bucket/key pairs in the server code.
• 4. Implement the MCP server (FastMCP) with tools: recent_changes, resource_info, module_info, stack_info, and state_serial.
• 5. Deploy the server behind a secure endpoint and configure the AI agent to call the MCP endpoint with a stack name.
• 6. Verify the role cannot read or write state by attempting unauthorized S3 operations.
• 7. Use the MCP tools in incident queries; the server redacts sensitive values before returning JSON.
• 8. Monitor and audit access logs for the MCP server.
• 9. Update the allowlist and IAM policy as new stacks are added or removed.

Evidence

The role gets read access to the state objects and their version history. That's the entire policy.

Source

The server parses the state file directly. The on‑disk v4 format is technically internal, but it has been stable since Terraform 0.12.

Source