Terraformdeveloper-tools

Terraform Infrastructure as Code for AI Products | SpeedMVPs

Clicking through AWS or GCP consoles to provision infrastructure is a reliable way to create environments that cannot be reproduced, configuration that cannot be reviewed in code review, and manual steps that fail at the worst possible time. Terraform defines cloud infrastructure as code: every VPC, subnet, RDS instance, ECS cluster, IAM role, S3 bucket, and security group is declared in a .tf file, committed to git, and applied with a single command. SpeedMVPs uses Terraform for AI product infrastructure deployments where reproducibility, auditability, and the ability to recreate environments from scratch are requirements, typically for production-grade deployments on AWS or GCP. For UK regulated sector AI products, infrastructure as code is not just an engineering practice: it is the foundation of the change management audit trail that NHS Digital DSPT, FCA operational resilience rules, and MHRA software as a medical device guidance all expect. When a security auditor asks which date encryption was enabled on the database, or whether a security group rule change went through a review process, the git history of your Terraform repository provides the answer. SpeedMVPs, based in Hemel Hempstead and delivering production AI infrastructure in 2-3 weeks at a GBP 8,000 fixed price, writes Terraform in reusable modules covering networking, database, container services, storage, and IAM. CI/CD plan-and-apply workflows are configured so infrastructure changes go through code review before applying. Full Terraform configuration ownership is transferred on delivery, with documentation covering how to manage state, add environments, and apply changes safely.

Get a Free QuoteSee Our Work

Why Infrastructure as Code Matters for AI Products

AI products often have more moving parts than standard SaaS: a containerised API service, a background worker for LLM processing, a vector database, a PostgreSQL database, an object storage bucket for document uploads, IAM roles for LLM API access, VPC networking for private communication between services, and CloudFront or an ALB for traffic distribution. Provisioning all of this correctly, with correct security group rules, IAM least-privilege policies, and encrypted storage, is complex enough that manual console clicks introduce errors and omissions. With Terraform, the desired state is declared in code and Terraform computes the plan to reach that state from the current state. Every change is visible as a diff before it is applied, can be reviewed in a pull request, and can be rolled back by reverting the code change. This makes infrastructure changes as safe and reviewable as application code changes.

Terraform Module Structure for AI Infrastructure

SpeedMVPs structures Terraform code in reusable modules rather than a single large configuration file. A typical AI product Terraform repository has a modules directory with modules for: networking (VPC, subnets, security groups), database (RDS PostgreSQL with pgvector support, parameter groups, backup configuration), container services (ECS cluster, ECS service, task definition, ALB, target group), storage (S3 bucket, bucket policy, CloudFront distribution), and IAM (roles and policies for ECS task execution, CI/CD deployment, developer access). Environment configurations (environments/staging and environments/production) call these modules with environment-specific variable values. This structure means adding a new environment is a matter of creating a new environment directory with the appropriate variable values, not duplicating all the module definitions.

Terraform State Management and Remote Backend

Terraform tracks the current state of managed infrastructure in a state file. This state file must be stored in a shared, versioned backend so all developers and CI/CD pipelines see the same state. SpeedMVPs configures Terraform's S3 backend with DynamoDB state locking for AWS projects: the state file is stored in an S3 bucket, and DynamoDB prevents concurrent applies from two processes simultaneously modifying the same infrastructure. For GCP projects, the GCS backend serves the same purpose. Remote state storage is configured from the start of the project, never as a retrofit, because migrating Terraform state after infrastructure has been provisioned using local state is error-prone.

IAM Least Privilege for AI Services

IAM (Identity and Access Management) configuration is where many cloud deployments introduce unnecessary security risk by granting broad permissions for convenience. An ECS task running an AI API service needs specific permissions: read access to specific S3 buckets for document retrieval, invoke permissions for Bedrock if using AWS managed LLMs, and read access to Secrets Manager for API keys. SpeedMVPs writes Terraform IAM policy documents with the minimum permissions required for each service, tested by attempting to run the service with the defined permissions rather than granting wildcard access and trusting it works. For UK financial services and NHS deployments, well-defined IAM permissions are also an auditable security control that satisfies FCA operational resilience and NHS DSPT requirements.

Terraform in CI/CD and Plan Review

SpeedMVPs integrates Terraform into the CI/CD pipeline with a plan-and-apply workflow. On a pull request that modifies Terraform files, GitHub Actions runs terraform plan and posts the plan output as a PR comment, so reviewers can see exactly what infrastructure changes will be applied before approving the PR. On merge to main, the pipeline runs terraform apply automatically (or with a required manual approval step for production). This approach ensures infrastructure changes go through the same code review process as application changes, rather than being applied from a developer's local machine without oversight. Terraform Cloud or Atlantis can provide more advanced plan management if needed.

Terraform for Compliance and Auditability

For AI products in regulated UK industries, Terraform provides auditability that console-click provisioning does not. Every infrastructure change has a git commit with an author, a timestamp, and a diff. Compliance questions such as when was encryption enabled on this database, who changed the security group rule, or can we reproduce the production environment from scratch can be answered from the git history. For NHS Digital DSPT compliance, MHRA software as a medical device guidance, and FCA operational resilience, having infrastructure defined as version-controlled code with an approval workflow is a significant compliance advantage. SpeedMVPs can provide a Terraform compliance summary on request for regulated industry deployments.

Frequently Asked Questions

Does Terraform work with both AWS and GCP?+

Yes. Terraform has official providers for AWS, GCP, Azure, and many other cloud platforms. The HCL (HashiCorp Configuration Language) syntax is the same across providers, but the resource types and configurations are provider-specific. SpeedMVPs has Terraform experience on both AWS and GCP and can provision multi-cloud infrastructure (for example, a main application on AWS with a GCP-specific ML service) by using multiple providers in the same Terraform configuration.

Can Terraform manage Vercel or Railway deployments?+

Vercel has a Terraform provider that can manage Vercel projects, deployments, and environment variables as Terraform resources. Railway also has a community Terraform provider. SpeedMVPs uses these providers when clients want to manage Vercel or Railway configuration as code rather than via the dashboard, particularly for environment variable management across multiple environments.

What is the risk of running terraform apply in production?+

Terraform plan shows exactly what will change before apply. Destructive changes (replacing or deleting resources) are flagged explicitly with destroy and replace indicators. SpeedMVPs configures lifecycle rules on critical resources (like RDS instances) to prevent_destroy, which causes Terraform to error rather than delete the resource if a configuration change would require replacement. For high-risk applies, the manual approval step in CI ensures a human reviews the plan before apply proceeds.

Does SpeedMVPs provide Terraform documentation on handover?+

Yes. The Terraform configuration is delivered with a README covering the module structure, how to add a new environment, how to run plan and apply, and how to manage state. Variable files are commented to explain what each variable controls. The documentation is sufficient for a cloud infrastructure engineer to maintain and extend the Terraform configuration without needing to return to SpeedMVPs for guidance.

Is Terraform suitable for early-stage AI MVPs or is it overkill?+

For early-stage MVPs deploying to Vercel and Railway, Terraform is overkill and SpeedMVPs does not impose it. Terraform is appropriate when the infrastructure has multiple services on AWS or GCP, when compliance or security requirements demand auditability of infrastructure changes, or when the client has an internal DevOps team that already uses Terraform and wants the AI product's infrastructure managed consistently with their existing estate.

Need reproducible, auditable cloud infrastructure for your AI product? Get a free consultation at speedmvps.co.uk

Get a Free Quote