Scan Terraform (HCL) for security misconfigurations and compliance failures. Call this after generating or editing any .tf content, before showing it to the user. Pass files (filename -> HCL content) to scan content that is not saved yet, or paths to scan .tf files and directories on disk. Runs locally; nothing is uploaded. Returns findings ordered by severity, each with a file, line, and whether an exact fix is available.

Get the full remediation for one finding from scan_terraform: what is wrong, the exact Terraform to fix it, and whether it is safe to apply mechanically. Call this for every finding you intend to fix instead of guessing the fix yourself.

Apply the mechanically-safe fixes from scan_terraform to Terraform source and return the patched HCL. Pass the file content plus the findings you want fixed (each as {check_id, resource_address}). Only fixes on the hand-verified allowlist are applied; everything else is returned in skipped with the reason, and must be applied by hand. Never overwrites a value that is wired to a variable or expression. Returns content — it does not write to disk.

Get a security-hardened Terraform template for a resource type (for example 'aws_s3_bucket', 'aws_db_instance', 'aws_security_group', 'azurerm_storage_account', 'google_storage_bucket'). Prefer this over writing the resource from memory: provider defaults are frequently insecure, and every template here is test-verified to contain no Critical or High findings. Returns the Terraform plus notes on what deliberately still needs the user's input.

Map Terraform findings to the compliance controls they speak to: SOC 2, ISO 27001, NIST 800-53, PCI-DSS, and the regulatory overlays DORA, NIS2, Saudi NCA Cloud Cybersecurity Controls and UAE NESA/SIA. Pass findings from scan_terraform, or files to scan and map in one call. Returns control mappings — evidence for an audit, never an attestation of compliance. Always relay the returned caveat to the user; do not present the result as a compliance verdict.

For one regulatory framework (DORA, NIS2, NCA-CCC, NESA-IAS), list every article with whether automated configuration scanning can evidence it. Use this when the user asks how much of a regulation the tool covers — the not-evidenced articles are part of the honest answer and must be shown.

Get this organization's own infrastructure policy requirements for a resource type — approved regions, required tags, mandatory settings — BEFORE writing the Terraform. Call this first whenever you are about to create a resource, so the code satisfies company policy on the first attempt rather than being corrected afterwards. Returns an empty, explanatory result when no organization policy is configured, which is normal and not an error.

Report whether this install is applying an organization's custom policy or running built-in rules only, including the org name and rule count. Use it when the user asks which rules are in force, or why a company rule is not appearing.