AI can draft the refactor, but a senior engineer must own the migration before it touches prod.

The structural patterns—modularizing Bash into Terraform/CloudFormation, externalizing variables, adding error handling—are well-understood and repeatable. However, every 2,000-line script has unique implicit logic, so each instance requires fresh judgment about what the original code actually does.

Success criteria sound clear (idempotency, rollback, dry-run) but are deeply ambiguous in practice: what counts as correct rollback behavior, which secrets backend to use, and whether the refactored code is functionally equivalent to the original all require human validation against a live environment.

The agent needs the full 2,000-line script, knowledge of the target AWS account topology, existing secrets management setup, and any environment-specific naming conventions—most of which are unlikely to be fully provided upfront. Without them, the output will contain placeholders and assumptions.

A subtly wrong IaC refactor applied to multi-region production infrastructure (EC2, RDS, CloudFront) can cause data loss, outages, or security regressions. Even with dry-run capabilities, a flawed rollback procedure could make a bad deployment unrecoverable.

Deciding which hardcoded values are environment-specific vs. intentional constants, how to sequence a live migration without downtime, and whether the rollback logic is actually safe all require experienced infrastructure judgment that AI cannot reliably supply from code alone.