Harrison Halperin

Designer & builder

Terragram

Diagram → compliant Terraform

A pipeline that reads architecture diagrams and emits Terraform that already satisfies org guardrails, opened as a reviewable pull request.

Harrison Halperin

Project brief

Shipped

Problem

Diagram-to-infrastructure generation is too large and too risky to trust to one prompt.

Outcome

A pipeline that reads architecture diagrams and emits Terraform that already satisfies org guardrails, opened as a reviewable pull request.

Evidence

  • Diagram-to-Terraform is too large and risky for one prompt, so it’s decomposed into explicit phases (parse, analyze, map to approved modules, scaffold, wire dependencies, validate) each leaving an inspectable artifact behind.
  • Parse, analyze, map, scaffold, and validate run as separate steps because the full conversion is too large for one prompt.
  • Validated Terraform ships as a pull request. A human or policy actor reviews before anything reaches shared infrastructure.

Key decisions

  • Compliance layer: Policy and module constraints are encoded before generation, safety is a property of the output, not a post-hoc check.
  • Phased decomposition: Parse, analyze, map, scaffold, and validate run as separate steps because the full conversion is too large for one prompt.
  • Inspectable artifacts: Every phase leaves a file on disk, so intermediate state can be read, diffed, and replayed.
  • Review gate: Validated Terraform ships as a pull request. A human or policy actor reviews before anything reaches shared infrastructure.

Overview

Diagram-to-infrastructure generation is too large and too risky to trust to one prompt. I built a pipeline that reads architecture diagrams and emits Terraform that already satisfies org guardrails, opened as a reviewable pull request. The interesting work is the compliance layer: encoding policy so generated IaC is safe by construction, not by after-the-fact linting. The conversion is decomposed into explicit phases (parse, analyze, map to approved modules, scaffold, wire dependencies, validate), each leaving an inspectable artifact behind. Long runs of this kind also forced dual channels and rule layers. Diagram output feeds the same IaC discipline as Agent CI/CD and Clear Diagrams.

Architecture

The first figure shows where the policy layer sits in the generation path; the second walks the six phases from parsed diagram to opened pull request, each leaving an artifact behind.

Compliance by construction

Org guardrails are part of the generation path. Output is eligible only when it already satisfies policy, not when a linter catches up later.

  1. 01Diagram
    architecture input

    source of intent

  2. 02Policy layerGate
    encoded guardrails · approved modules

    decides what may be emitted

  3. 03Terraform
    IaC output

    compliant by construction

Diagram to pull request

Each phase writes an inspectable artifact to disk before the next one runs. The pipeline ends with a reviewable pull request, not a direct apply.

  1. 1Parse diagram
  2. 2Analyze
  3. 3Map modules
    approved catalog
  4. 4Scaffold
    wire dependencies
  5. 5ValidateGate
  6. 6Open PR

Field notes

Compliance layerPolicy and module constraints are encoded before generation. Safety is a property of the output, not a post-hoc check.
Phased decompositionParse, analyze, map, scaffold, and validate run as separate steps because the full conversion is too large for one prompt.
Inspectable artifactsEvery phase leaves a file on disk, so intermediate state can be read, diffed, and replayed.
Review gateValidated Terraform ships as a pull request. A human or policy actor reviews before anything reaches shared infrastructure.

Capabilities applied

  • Generative AIGenerative models in Terragram sit behind evaluation and guardrails.
  • TerraformDiagram-to-infrastructure runs emit Terraform that still has to pass policy and plan review.
  • Policy as codeEligibility rules for Terragram live as reviewable policy code, not slide decks.
  • Cloud automationTerragram codifies cloud operations so provisioning and remediation stay repeatable.
  • AWSTerragram runs on AWS primitives (compute, data, and IAM) treated as coded infrastructure.
  • AgenticAgents propose Terraform from diagrams; PR validation and humans decide what merges.

Further reading

Also referenced above: Agent CI/CD, Clear Diagrams

Portfolio graph

Hover nodes · click empty canvas to zoom/pan

Maps how the work here connects. Open the Portfolio graph →

  • Professional
  • Personal
  • Skill
  • Writing