Welcome to the Agentic Age. No question is bad. No topic is off limits. We are here for you — to help every engineer ship faster, think bigger, and build with confidence.
How we teach Claude to think like an Ally engineer — using MCP servers, Claude rules, and the PCE pipeline to produce compliant, production-ready infrastructure every time.
Ally's private Terraform module registry, wired directly into Claude
Guardrails that enforce Ally standards on every AI-generated line
CI/CD that validates, scans, and deploys — the safety net
Why our starter still beats raw Claude — even today
Model Context Protocol — a standard that lets Claude call external tools in real time. Instead of guessing, Claude asks our systems for the right answer.
Every AWS service you need, pre-hardened with Ally security, tagging, and compliance baked in. Claude discovers these at query time via MCP.
Source: module-registry.services.ally.com/ally/. Public registry modules are FORBIDDEN.
Version: ~> 9.0 (latest major). Never pin minor versions like ~> 9.17.0.
If an Ally module exists for a service, Claude must use it. No raw resource blocks.
Rules files in ~/.claude/rules/ are injected into every conversation. They're not suggestions — they're hard constraints Claude cannot override.
terraform-aws-modules/* or hashicorp/* from the public registryaws_security_group resources that bypass module controls*.tf or terraform.tfvars file triggers the full ruleset. Claude literally cannot write Terraform without reading these first.
CLAUDE.md is loaded into every single conversation. These are the global rules that keep Claude safe across all operations.
Read-only: always OK (describe, get, list). Write commands require explicit approval in THAT message. No carryover. Workflow: diagnose → present fix → wait for "do it" → execute.
NEVER output tokens, API keys, passwords, .env contents, AKIA* values. NEVER run env or printenv. Check existence only: [ -n "$VAR" ] && echo "set"
Always test-driven: write failing tests first, implement minimum code, refactor green. For bugs: reproduce in a test before fixing.
NEVER pass tarballs as GitLab artifacts (>1GB). Use Kaniko --tarPath + --no-push for images known <1GB. Fix by slimming, not compressing.
Always in central-core-db repo. Always both up+down. FK with CASCADE, indexes, update triggers. NEVER in service repos.
One ticket per repo. Branch: feature/<PROJECT>-<NUMBER>. MR format enforced: Summary → Changes → Test Plan with ## headings.
Even if AI writes perfect Terraform, the pipeline validates it. Claude knows these rules too — it generates CI configs that comply from the start.
.aws-oidc-assume-role with .global-before-scriptInnovation-federated-docker, not approximationsregistry.services.ally.com/ — never Docker Hubwhen: manual — never auto-triggered.secret-analyzer on secret_detectionentrypoint: [""]AWS_ENVIRONMENT set globallyMCP, Rules, and Pipeline work together. Each layer catches what the others miss.
What it does: Gives Claude real-time access to Ally's module registry. Claude reads actual docs, not cached training data.
What it catches: Wrong module names, deprecated versions, missing inputs, hallucinated parameters.
What it does: Injects Ally-specific constraints into every conversation. Fires automatically on file type.
What it catches: Public modules, missing backend/tfvars, write commands without approval, secrets exposure.
What it does: Validates everything at merge time. Security scans, Terraform plan, manual approval gates.
What it catches: Anything that slipped through — vulnerable deps, misconfigured resources, unapproved changes.
Claude + MCP + Rules is powerful. But the Terraform Starter represents years of accumulated institutional knowledge that no AI can replicate from scratch.
| Capability | Raw Claude (No Rules) | Claude + MCP + Rules | Ally Terraform Starter |
|---|---|---|---|
| Uses Ally private modules | ✗ Uses public registry | ✓ Via MCP | ✓ Pre-configured |
| Correct backend.tf (5 fields) | ✗ Generic or missing | ✓ Rules enforce | ✓ Template included |
| 9 mandatory tfvars | ✗ Doesn't know them | ✓ Rules enforce | ✓ Pre-filled template |
| Full CI/CD pipeline | ✗ Generic YAML | ~80% — knows rules | ✓ Battle-tested YAML |
| Prod pipeline (separate) | ✗ Doesn't know pattern | ~70% — complex rules | ✓ .prod-gitlab-ci.yml included |
| OIDC auth wiring | ✗ No context | Knows rules, can miss edge cases | ✓ Pre-wired correctly |
| Kaniko + Crane image flow | ✗ Suggests docker build | ✓ Rules guide it | ✓ End-to-end working |
| Runner tag accuracy | ✗ Guesses tag names | ✓ Exact strings in rules | ✓ Already correct |
| Time to first deploy | Hours of debugging | ~30 min with iteration | ~5 min — clone & go |
No matter the effort we put into teaching Claude, a battle-tested scaffold still represents the fastest, safest path to production. Claude is the accelerant — the Starter is the launchpad.
Clone the starter, fill in your app details, push. Pipeline runs. Infrastructure deploys. No iteration needed.
Every decision — runner tags, scan configs, image flows, OIDC wiring — has been validated in production across dozens of teams.
The real power? Use both. Start from the Starter, then let Claude customize for your specific service. Best of both worlds.
What do you want to see? A deep-dive on rules authoring? MCP server development? Agentic CI/CD? Claude Code tricks? You decide.
Add the Terraform MCP server to your ~/.mcp.json. Copy the rules to your ~/.claude/rules/. Watch Claude level up instantly.