Build a Terraform State MCP Server: Let AI Agents Query Your Infrastructure Without Leaking Secrets

Описание и применение

Создайте сервер MCP, который предоставляет AI‑агенту безопасный, только для чтения доступ к Terraform‑state, скрывая секреты и ограничивая IAM‑политику.

Задача

Incident responders need to answer Terraform‑related questions about live resources without exposing secrets or granting excessive permissions to AI agents.

Результат

The MCP server provides AI agents with read‑only, secret‑aware access to Terraform state, enabling rapid incident queries without leaking secrets or granting excessive permissions.

Рабочий процесс

• 1. Create an IAM role with only s3:GetObject, s3:GetObjectVersion, s3:ListBucketVersions (for a specific bucket prefix) and kms:Decrypt for the state KMS key.
• 2. Attach the role to the MCP server instance or container.
• 3. Define a fixed allowlist of stack names mapping to bucket/key pairs in the server code.
• 4. Implement the MCP server (FastMCP) with tools: recent_changes, resource_info, module_info, stack_info, and state_serial.
• 5. Deploy the server behind a secure endpoint and configure the AI agent to call the MCP endpoint with a stack name.
• 6. Verify the role cannot read or write state by attempting unauthorized S3 operations.
• 7. Use the MCP tools in incident queries; the server redacts sensitive values before returning JSON.
• 8. Monitor and audit access logs for the MCP server.
• 9. Update the allowlist and IAM policy as new stacks are added or removed.

Доказательства

The role gets read access to the state objects and their version history. That's the entire policy.

Источник

The server parses the state file directly. The on‑disk v4 format is technically internal, but it has been stable since Terraform 0.12.

Источник