Terraform MCP Server + Partner-Managed Resources

The Terraform MCP Server is a Model Context Protocol (MCP) server that provides seamless integration with Terraform Registry APIs, enabling advanced automation and interaction capabilities for Infrastructure as Code (IaC) development.

This fork extends the base server with Partner-Managed Resources - enabling AI-assisted security remediation through AWS Security Hub integration and HCP Terraform.

What's New: Partner-Managed Resources

┌─────────────────────────────────────────────────────────────────────────────────┐
│                    PARTNER-MANAGED RESOURCES WORKFLOW                            │
├─────────────────────────────────────────────────────────────────────────────────┤
│                                                                                  │
│  ┌──────────────┐                                      ┌──────────────┐         │
│  │ AWS Security │   Discover    ┌──────────────┐       │ HCP Terraform│         │
│  │     Hub      │──────────────▶│   MCP Server │──────▶│  (CLI-Driven │         │
│  │  (Findings)  │               │              │       │   Workspace) │         │
│  └──────────────┘               │  • Sync      │       └──────┬───────┘         │
│                                 │  • Analyze   │              │                  │
│  ┌──────────────┐               │  • Link      │              ▼                  │
│  │    Claude    │◀─────────────▶│  • Remediate │       ┌──────────────┐         │
│  │   Desktop    │   Converse    │              │       │     AWS      │         │
│  │  or CLI      │               └──────────────┘       │  Resources   │         │
│  └──────────────┘                                      │   (Fixed!)   │         │
│                                                        └──────────────┘         │
└─────────────────────────────────────────────────────────────────────────────────┘

Key Capabilities

• Security Finding Discovery: Pull findings from AWS Security Hub automatically
• Automatic ARN → Terraform Mapping: Discovers workspaces, parses state, and auto-links ARNs to Terraform addresses
• Automated Remediation: Generate and apply Terraform fixes through HCP Terraform
• CLI-Driven Workflow: Works with CLI-driven workspaces (configuration uploaded via API)

How Automatic Resource Mapping Works

When you provide your HCP Terraform org, the system automatically discovers and links resources:

sync_recommendations(terraform_org: "my-org")
                    │
                    ▼
┌─────────────────────────────────────────────────────────────────────────┐
│ 1. DISCOVER WORKSPACES                                                   │
│    Lists all workspaces in your org (via HCP Terraform API)             │
└─────────────────────────────────────────────────────────────────────────┘
                    │
                    ▼
┌─────────────────────────────────────────────────────────────────────────┐
│ 2. INDEX TERRAFORM STATE                                                 │
│    For each workspace, parses state and extracts cloud resource IDs:    │
│    - ARNs from aws_security_group, aws_instance, aws_s3_bucket, etc.    │
│    - Builds index: ARN → Terraform address                              │
│    Example: "arn:aws:ec2:...:sg-xxx" → "aws_security_group.web"         │
└─────────────────────────────────────────────────────────────────────────┘
                    │
                    ▼
┌─────────────────────────────────────────────────────────────────────────┐
│ 3. SYNC & AUTO-LINK                                                      │
│    Fetches findings from Security Hub, matches ARNs to Terraform        │
│    Result: Each finding knows its Terraform resource automatically!     │
└──────────────────────────

... [View full README on GitHub](https://github.com/vravind1/terraform-partner-mcp-server#readme)