80% Faster Plans, 2x More Deployments: How Cursor Rebuilt Its Terraform Workflow with Masterpoint

The engagement opened with an audit of Cursor’s infrastructure:

• cloud environments
• Infrastructure as Code (IaC) & Terraform architecture
• CI/CD pipelines
• networking
• observability

Within a week, Masterpoint delivered an audit report, a best practices checklist, and a security scan. The findings included IAM duplication accounted for 70% of the production TF state and noisy plan diffs caused engineer fatigue.

The audit phase targeted the highest-leverage fixes first: IAM resource deduplication, workspace trigger and path filter corrections so plans only ran when relevant code changed, and initial provider alias splits to begin isolating staging and ML infrastructure from the main production workspace.

By November 25th, the IAM deduplication fixes had landed.

This was accomplished without touching the workspace structure, and without any downtime — at the speed and scale Cursor operates, downtime simply isn’t an option. Every improvement had to land safely while the platform kept growing underneath it: even as Masterpoint deduplicated and trimmed resources, Cursor was continuously adding new ones. There was still more the systems could improve on.

With the first phase complete, Masterpoint turned to the platform.

As mentioned above, TFC’s ClickOps workspace management, SSO troubles, and resource-under-management pricing were all inhibiting Cursor’s velocity and growth.

Masterpoint recommended a move to Spacelift to address these issues.

The team kicked off the Spacelift migration in mid-December, starting with the groundwork:

• naming and tagging standards
• AWS multi-account IAM role architecture
• Okta SSO configuration

Rather than migrating everything at once, a low-risk pilot Spacelift stack (the equivalent of a TFC workspace) was used to validate the approach. The end-to-end fully automated pilot project was completed within days.

Masterpoint also began evaluating a full migration from the Terraform runtime to OpenTofu.

With a plan covering a migration of dozens of TFC workspaces across four phases, the team worked systematically. By late January, the bulk of workspaces had been migrated to Spacelift stacks with no operational downtime for the Cursor engineering organization.

By February, the migration was done. All workspaces had been moved from TFC to Spacelift and the runtime was converted from Terraform to OpenTofu. Migrating to OpenTofu freed Cursor from licensing constraints and unlocked capabilities unavailable or paywalled in Terraform, such as state encryption, OpenTelemetry support, and provider iteration.

As part of the final migration work, the production workspace was reduced by splitting out various provider-aliased resources into dedicated stacks, continuing the decomposition work that had started with IAM deduplication in November.

After the migration was completed, Masterpoint continued to improved system usability and speed by:

• restructuring Route53 DNS API requests into optimized, dedicated Terraform modules to address AWS’ hardcap of 5 requests/second (further reducing critical infrastructure plan time from roughly 5 minutes to under 2 minutes)
• continuing to break up large state files into narrower root modules, allowing for faster plans and decreased blast radius
• implementing child module versioning with OCI registries to enable staged rollouts and safer change control of critical TF resources
• resolving the ECS drift issue by using the “Task Definition Template Pattern”
• implementing OpenTofu’s OTel tracing to find other performance bottlenecks and set up the Cursor team for longterm visibility into their IaC throughput

Because Cursor’s engineering team uses Cursor to write Terraform, Masterpoint embedded architectural knowledge directly into the codebase as AI agent skills and rules.

This AI context encodes the decisions that AI models cannot anticipate on their own:

• when to create a new root module vs. extend an existing one
• how to scope blast radius in a root module
• how to break up a high blast radius monolithic root module
• data source patterns and optimizations
• security practices, such as cloud networking and Terraform/OpenTofu module SHA pinning
• debugging performance bottlenecks, through methods such as logging and OpenTelemetry traces
• …and more

Every IaC optimization Masterpoint delivered was paired with instructions to prevent anti-patterns from being reintroduced.