TerraRepair: A Tool-Grounded LLM Agent for Infrastructure-as-Code Repair

Jul 16, 2026

Infrastructure-as-Code (IaC) scanners can detect cloud misconfigurations in Terraform, yet repairing flagged issues often remains manual. Tool-grounded LLM repair can generate invalid or unsupported constructs and may suppress warnings without addressing the underlying security problem. TerraRepair explores whether grounding improves Terraform repair by retrieving dependency context, consulting provider schemas, re-running scanners, and escalating when deployment-specific context is missing. Evaluations on Checkov and Trivy show large increases in scanner-verified fix rates across AWS, Azure, and GCP.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages13

Reading Time33 min

Introduction

Motivation and Problem Setting

Limitations of LLM-Based Repair

TerraRepair Approach

arXiv :2607 . 1 1390v 1 [ cs . SE] 13 Jul 2026 TerraRepair: A Tool-Grounded LLM Agent for Infrastructure-as-Code Repair Minase Mekete Mengistu \# University of L’Aquila, Italy Juri Di Rocco \# University of L’Aquila, Italy Phuong T. Nguyen \# University of L’Aquila, Italy Davide Di Ruscio \# University of L’Aquila, Italy ~~ Abstract ~~Background: Infrastructure-as-Code (IaC) scanners detect cloud misconfigurations in Terraform and other IaC languages before deployment, but repairing the flagged configurations remains largely manual. Recent Large Language Model (LLM)-based repair approaches can repair some findings, but may hallucinate unsupported constructs or suppress warnings without fixing the issue. Aims: We study whether tool grounding can improve LLM-based Terraform repair, and when a finding should be escalated because the required deployment-specific context is not available. Method: We present TerraRepair, a prototype of a tool-grounded LLM agent for Terraform repair with structured escalation. TerraRepair retrieves dependency context from Terraform references, consults the installed provider schema, and re-runs the scanner before returning a candidate repair. When the required context is absent, TerraRepair escalates instead of fabricating a plausible fix. Results: We evaluate our tool on two vulnerable-by-design Terraform repositories using two IaC security scanners, Checkov and Trivy, across AWS, Azure, and GCP. On the combined AWS benchmark, TerraRepair improves scanner-verified fix rates from 26.6% to 78.4% on Checkov and from 44 .8% to 72 .4% on Trivy, compared with a controlled one-shot baseline. It also reduces the baseline’s 44.8–73.6 percentage point (pp) claimed-vs-verified repair gap to under 5 pp. In a sampled semantic audit, 78.9% of TerraRepair’s scanner-verified AWS repairs are labeled as correct under a majority-vote protocol. Conclusions: These emerging results show that tool grounding can substantially improve scannerverified LLM-based IaC repair on the studied benchmarks, while missing deployment-specific context remains the main knowledge boundary for full autonomy. 2012 ACM Subject Classification Software and its engineering → Software maintenance tools; Software and its engineering → Software defect analysis; Security and privacy → Software security engineering Keywords and phrases Infrastructure as Code, automated repair, large language models, cloud security Digital Object Identifier 10.4230/LIPIcs.ESEM.2026.XX 1 Introduction Infrastructure as Code (IaC) is widely used to provision and manage cloud infrastructure through declarative configuration files, such as Terraform modules written in HashiCorp Configuration Language (HCL) [15, 8] . This practice improves repeatability, reviewability, and automation, but it also moves cloud security and reliability risks into code [6] . Misconfigured IaC can expose storage buckets, grant overly broad Identity and Access Management (IAM) permissions, disable encryption, or leave network access unrestricted. Prior work has studied such recurring weaknesses as IaC security smells [20] . © Author: Please provide a copyright holder; licensed under Creative Commons License CC-BY 4.0 International Symposium on Empirical Software Engineering and Measurement (ESEM 2026) . Editor: Anonymous; Article No. XX; pp. XX:1–XX:13 Leibniz International Proceedings in Informatics Schloss Dagstuhl – Leibniz-Zentrum für Informatik, Dagstuhl Publishing, Germany XX:2 TerraRepair: A Tool-Grounded LLM Agent for Infrastructure-as-Code Repair IaC security scanners detect many of these issues before deployment by reporting policy violations over Terraform resources [6, 17 , 3] . However, detection is only the first step. Developers must still determine how to modify the affected resource, whether related resources must also be changed, and whether the repair is valid for the installed Terraform provider version. Many repairs also require

FAQs

What problem does TerraRepair address in Infrastructure-as-Code repair?

IaC scanners report Terraform misconfigurations, but turning findings into correct repairs is largely manual. Existing LLM repair methods can hallucinate unsupported constructs or clear warnings without fixing the real security issue.

How does TerraRepair ground LLM repairs for Terraform?

TerraRepair retrieves dependency context from Terraform references, consults the installed provider schema, and re-runs the scanner on candidate repairs to validate the outcome.

When does TerraRepair escalate instead of producing a fix?

When required deployment-specific context is absent, TerraRepair escalates rather than fabricating a plausible repair that cannot be grounded in the available information.

Jul 16, 2026

Upload by Theodora