Does ops0 replace human review of IaC?

No. ops0 creates code faster, but teams still review changes through Git, approval gates, policy checks, and deployment workflows.

Can ops0 help with existing cloud resources?

Yes. ops0 can use discovery data from existing resources to help teams adopt IaC for brownfield infrastructure.

Can ops0 generate Terraform from plain-language intent?

Yes. ops0 generates Terraform, OpenTofu, or Oxid from either discovered live state or a plain-language description of what you want. Policy checks run before generation and cost is estimated before apply, so the code arrives already reviewed against your rules. When a request is missing a decision, such as provider, authentication, or network exposure, Kiwi asks before it writes any code.

How does ops0 handle secrets in generated IaC?

Secret values are never sent to the AI. ops0 injects them at apply time as Terraform variables, so credentials stay out of generated code, out of prompts, and out of your Git history.

Can ops0 import existing production infrastructure into code?

Yes. ops0 imports existing production resources into IaC without recreating them, using prevent_destroy to protect live infrastructure. You can also save reusable blueprints and replicate a project across clouds.

Infrastructure as code

Turn live cloud into reviewed code.

Name: ops0
Author: ops0

Codify discovered state or plain-language intent into Terraform, OpenTofu, or Oxid, with the guardrails you already run present from the start.

Terraform, OpenTofu, and Oxid

Policy checks before generation

Cost estimated before apply

Secrets never shown to the AI

ops0.ai/features/iac/generate

ops0 reviewed IaC: generated Terraform for a discovered finding, policy checks passed, cost estimate, and approval status

Writing Terraform for what already runs is busywork. ops0 reads the resource and writes the code.

TerraformOpenTofuOxidImport, not recreate

Live cloud to code

01 / 04 · Pick

Start from what is running.

rds-payments-ledger-prod exists in AWS, but in no Terraform file.

Ask Kiwi

Add a read replica in us-east-2

Before I write it: which subnet group, and should the replica be public? Kiwi asks when a decision is missing instead of guessing.

Policy check

publicly_accessible blocked by policy

rule: no-public-dbfix proposed in the code, reviewed before merge

to import

to destroy

#842

pull request

Generating Terraform

engine            = "postgres 15.4"
publicly_accessible = true

Going deeper

Code you would have written yourself.

From reality to code

Codify what is already running.

Codify from discovered state, or describe what you need to Kiwi.

Terraform, OpenTofu, or Oxid, your choice per project.

main.tfGenerated

import {
  to = aws_db_instance.payments_ledger
  id = "rds-payments-ledger-prod"
}

resource "aws_db_instance" "payments_ledger" {
  publicly_accessible     = false
  deletion_protection     = true
  backup_retention_period = 14

  lifecycle { prevent_destroy = true }
}

TerraformOpenTofuOxid

Brownfield safe

Import, not recreate.

Adopt existing production into code without recreating it.

prevent_destroy protects production resources.

Plan summaryprevent_destroy: on

0 to add, 2 to change, 0 to destroy.

Resource

rds-payments-ledger-prod

Action

import, no recreate

Cost change+$180 /month

Interruption≤ 5 minutes

Policy checksPassed

ApproversPayments DB owner, FinOps

Pull request#842 ready

Apply statusAwaiting approval

Under the hood

Built for the code you already have.

Four engines

Write it the way your repo already reads.

resource "aws_db_instance" "payments_ledger" {
  engine = "postgres"

TerraformOpenTofuOxidCloudFormation

One project, one engine of your choice. Generation matches what your repo already uses.

Checked on every line

Findings land on the exact line.

terraform validatepassed

publicly_accessible = trueTFLint

deletion_protectionCheckov CKV_AWS_16

terraform validate, TFLint, and Checkov run on the generated code before it reaches you.

Kiwi asks first

A missing decision stops the write.

provider? auth? public?

Kiwi asks before it writes, not after.

Bring your repo

Connect the repository you already have.

Repositoryops0-ai/payments-infra

Branchmain, PR per change

Folderenvs/prod/rds

Generated code lands in your branch and folder, and stays in sync as the repo changes.

Share a module safely

A redacted snapshot, not repo access.

Snapshot link

ops0.ai/s/8f2c···

password · ••••••expires in 7d

Secrets stay out

Never in the code, never sent to the AI.

InjectedAt apply, as TF_VAR

Shown to AINever

AWS Secrets ManagerGCP Secret ManagerAzure Key VaultOracle Vault

Common questions

ops0 uses the risk finding, user intent, project context, discovered resources, dependencies, and policy rules to generate reviewable Terraform, OpenTofu, or Oxid code.

Describe it, or discover it.
Ship reviewed code.

Start from live cloud or a plain-language request to Kiwi. Every generated change carries its policy, cost, and approval context.

Explore Deployments

Turn live cloud into reviewed code.

Start from what is running.

Code, line by line.

Checked before anyone reviews it.

Imported, not recreated.

Code you would have written yourself.

Codify what is already running.

Every generation is policy aware.

Secrets stay out of the code.

Import, not recreate.

Built for the code you already have.

Common questions

Describe it, or discover it.
Ship reviewed code.

Turn live cloud into reviewed code.

Start from what is running.

Code you would have written yourself.

Codify what is already running.

Built for the code you already have.

Common questions

Describe it, or discover it.Ship reviewed code.

Describe it, or discover it.
Ship reviewed code.