Terraform as the Grounding-and-Evaluation Provisioning Foundation

Week 7 reach-back synthesis of Vertex RAG datastores, AWS event-driven state machines, Kubernetes supply-chain admission, and Bedrock Knowledge Base evaluation.

An agent that answers is easy to deploy. An agent whose answers you can trust is a system you have to provision. Terraform is where that whole system becomes one apply.

Every Friday this cycle pulls the week's four cert lessons through Terraform's lens and asks one question: how would you deploy what you learned this week as infrastructure, reproducibly, with the safety the individual lessons demanded. Week 7's four lessons share a spine tighter than most — they are all about the same thing, agent answers you can trust, seen from four vendors. Terraform is where the four become one stack.

§ IFrame

The week taught grounding and evaluation from four angles. Monday built a Vertex AI RAG datastore that grounds a generative answer in retrieved documents and injects citations. Tuesday built an AWS event-driven state machine that sequences and confirms multi-step work idempotently. Wednesday built Kubernetes supply-chain admission that refuses to run an unsigned image. Thursday built a Bedrock Knowledge Base retrieval path and a faithfulness gate that scores whether an answer is supported by its sources.

Read as a list they are four exams. Read as a system they are one production pipeline: retrieve, ground, orchestrate, admit only what is trusted, and score the result before anyone believes it. Name the Terraform discipline that provisions this pipeline the provision-the-evaluation-before-the-agent rule: the datastore, the admission policy, and the evaluation harness are declared in the same module as the agent, so an agent cannot ship into an environment that lacks the machinery to ground and score it. The evaluation is not a later addition. It is a resource the agent depends on.

§ IIWeek in Review

§ IIITerraform as Connective Tissue

Four vendors, four consoles, four ways to click the same pipeline into existence by hand — and no way to reproduce it, review it, or tear it down cleanly. Terraform's answer is a single configuration spanning all four providers, where the dependency graph enforces the pipeline's own logic: the datastore exists before the agent that grounds on it, the evaluation harness exists before the agent whose answers it scores, the admission policy exists before the workload it guards.

Remote state is the shared record the pipeline provisions against

Brikman's treatment of state (Terraform: Up and Running, 3rd ed, Ch 3, pp. 151–152) makes the point the multi-provider case depends on: state must live in shared storage with locking, or two applies race and corrupt the record of what exists. A pipeline spanning Google, AWS, and Kubernetes is exactly the case where several engineers touch the same stack, so the backend is a locked remote state — an S3 bucket with DynamoDB locking, or the equivalent — declared before anything else. The state is the ground truth of what the pipeline is, the same way the RAG datastore is the ground truth an answer is checked against. Provision the record first.

Dependency injection keeps the four providers testable

Brikman's testing chapter (Ch 9, pp. 505–506) frames dependency injection as the discipline that keeps a module testable: a module takes its dependencies as input variables rather than hard-coding them, so a test can substitute a stub and a production apply can substitute the real thing. For the grounded-agent stack, this means the evaluation harness takes the knowledge-base ID as a variable, not a literal — the same module deploys against a test datastore and a production datastore by changing one input. The evaluation is provisioned with the agent but wired by injection, so it can be exercised before the agent is trusted.

Conditionals and loops express the environment ladder

Brikman's tips chapter (Ch 5, p. 233) covers the count and for_each patterns that turn one module into a per-environment fleet. The grounded-agent stack ships to dev, staging, and prod with the same module, the retrieval threshold and the admission-policy mode varying by environment through a map input — Kyverno in Audit mode in dev, Enforce in prod; a loose dynamic-retrieval threshold in dev, a strict one in prod. One module, three environments, the safety tightening as the environment matters more.

§ IVWorked Example

The module provisions the week's pipeline across three providers. Read it as the four lessons made into one dependency graph. The backend is declared first — the shared, locked state Brikman's Ch 3 requires. Then the module fans out: a Vertex datastore (Monday), a Step Functions orchestration (Tuesday), a Kyverno admission policy (Wednesday), and a Bedrock knowledge base with its evaluation configuration (Thursday). The evaluation resource depends on the knowledge base; the agent's serving workload depends on the admission policy; nothing that answers ships before the machinery that grounds and scores it exists.

The first block declares the providers and the remote backend. The backend block names the locked shared state; the three provider blocks give the module reach into Google, AWS, and the cluster.

terraform {
  backend "s3" {
    bucket         = "hedronite-tfstate"
    key            = "grounded-agent/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "hedronite-tf-locks"
    encrypt        = true
  }
  required_providers {
    google     = { source = "hashicorp/google", version = "~> 5.0" }
    aws        = { source = "hashicorp/aws", version = "~> 5.0" }
    kubernetes = { source = "hashicorp/kubernetes", version = "~> 2.0" }
  }
}

The next block provisions the grounding datastore and the evaluation harness, and wires the harness to the datastore by reference rather than by literal, so the dependency graph applies the datastore first. The environment map sets the retrieval threshold per environment, tight in prod and loose in dev.

variable "env" { type = string }

locals {
  retrieval_threshold = {
    dev  = 0.4
    prod = 0.7
  }
}

resource "google_discovery_engine_data_store" "grounding" {
  location          = "global"
  data_store_id     = "grounding-${var.env}"
  display_name      = "Grounding datastore (${var.env})"
  industry_vertical = "GENERIC"
  content_config    = "CONTENT_REQUIRED"
}

resource "aws_bedrockagent_knowledge_base" "eval_kb" {
  name     = "eval-kb-${var.env}"
  role_arn = aws_iam_role.kb.arn

  knowledge_base_configuration {
    type = "VECTOR"
    vector_knowledge_base_configuration {
      embedding_model_arn = var.embedding_model_arn
    }
  }
}

resource "aws_ssm_parameter" "eval_config" {
  name  = "/agents/${var.env}/eval"
  type  = "String"
  value = jsonencode({
    knowledge_base_id   = aws_bedrockagent_knowledge_base.eval_kb.id
    retrieval_threshold = local.retrieval_threshold[var.env]
    score_gates         = ["retrieval_quality", "faithfulness", "citation_accuracy"]
  })
}

The evaluation configuration reads the knowledge-base ID by reference, so Terraform's graph guarantees the knowledge base is created before the harness that scores against it — the provision-the-evaluation-before-the-agent rule expressed as a dependency edge, not a comment.

The last block sets the admission policy that guards the serving workload, with its enforcement mode keyed to the environment. In dev the policy audits; in prod it enforces, refusing to admit an unsigned agent image. This is Wednesday's Kyverno lesson turned into a per-environment input.

locals {
  admission_mode = var.env == "prod" ? "Enforce" : "Audit"
}

resource "kubernetes_manifest" "verify_agent_images" {
  manifest = {
    apiVersion = "kyverno.io/v1"
    kind       = "ClusterPolicy"
    metadata   = { name = "verify-agent-images" }
    spec = {
      validationFailureAction = local.admission_mode
      rules = [{
        name  = "check-signature"
        match = { any = [{ resources = { kinds = ["Pod"] } }] }
        verifyImages = [{
          imageReferences = ["registry.hedronite.internal/agents/*"]
          attestors       = [{ entries = [{ keys = { publicKeys = var.cosign_pubkey } }] }]
        }]
      }]
    }
  }
}

Apply the module with env = "prod" and the whole week stands up in order: locked state, grounding datastore, evaluation knowledge base wired to it, admission policy in Enforce. Apply with env = "dev" and the same module stands up a looser twin for testing. The four lessons are no longer four consoles. They are one graph, one apply, one teardown.

§ VPractice Scenarios

§ VIClosing

The week taught one thing four ways: an answer is only as trustworthy as the machinery that grounds and scores it. Terraform is where that machinery becomes reproducible — the locked state that records what exists, the datastore the answer grounds on, the evaluation harness wired to it by reference, the admission policy that tightens from Audit to Enforce as the environment matters more. Declare the evaluation in the same module as the agent, wire it by reference so the graph provisions it first, and no agent ships into an environment that cannot ground or score it. That is the whole discipline: provision the evaluation before the agent, and let the dependency graph enforce the order you would otherwise have to remember.

The agent is the easy resource. The datastore, the gate, the policy, the harness — that is the system, and the system is one apply.