How Cursor Rebuilt Its Terraform Workflow with Masterpoint: 5x Faster Plans, 2x More Deployments

The engagement opened with Masterpoint’s audit of Cursor’s infrastructure:

• cloud environments
• Infrastructure as Code (IaC) & Terraform architecture
• CI/CD pipelines
• networking
• observability

Within a week, Masterpoint delivered an audit report, a best practices checklist, and a security scan. The findings included IAM duplication accounted for 70% of the production Terraform state and noisy plan diffs caused engineer review fatigue.

The audit phase targeted the highest-leverage fixes first: IAM resource deduplication, workspace trigger and path filter corrections so plans only ran when relevant code changed, and initial breaking up of the monolithic Terraform workspace to begin isolating Staging and Machine Learning infrastructure.

Just one week later, Masterpoint had resolved the IAM duplication, with significant results:

This was accomplished without touching the workspace structure, and without any downtime. At the speed and scale Cursor operates, downtime simply isn’t an option. Every improvement had to land safely while the platform kept growing underneath it: even as Masterpoint deduplicated and trimmed resources, Cursor was continuously adding new ones. There was still more the systems could improve on.

With the first phase complete, Masterpoint turned to the platform.

As mentioned above, TFC’s ClickOps workspace management, SSO troubles, and resource-under-management pricing were all inhibiting Cursor’s velocity and growth.

Masterpoint recommended a move to Spacelift to address these issues.

The team kicked off the Spacelift migration in mid-December, starting with the groundwork:

• naming and tagging standards
• AWS multi-account IAM role architecture
• Okta SSO configuration

Rather than migrating everything at once, a low-risk pilot Spacelift stack (the equivalent of a TFC workspace) was used to validate the approach. The end-to-end fully automated pilot project was completed within days.

Masterpoint also began evaluating a full migration from the Terraform runtime to OpenTofu.

With a plan covering a migration of dozens of TFC workspaces across four phases, the team worked systematically. By late January, the bulk of workspaces had been migrated to Spacelift stacks with no operational downtime for the Cursor engineering organization.

By February, the migration was done. All workspaces had been moved from TFC to Spacelift and the runtime was converted from Terraform to OpenTofu. Migrating to OpenTofu freed Cursor from licensing constraints and unlocked capabilities unavailable or paywalled in Terraform, such as state encryption, OpenTelemetry support, and provider iteration.

In parallel, Masterpoint also continued to decompose the Terraform monolith into more product and domain scoped root modules.

After the migration was completed, Masterpoint continued to improved system usability and speed by:

• restructuring Route53 DNS API requests into optimized, dedicated Terraform modules to address AWS’ hardcap of 5 requests/second (further reducing critical infrastructure plan time from roughly 5 minutes to under 2 minutes)
• continuing to break up large state files into narrower root modules, allowing for faster plans and decreased blast radius
• implementing child module versioning with OCI registries to enable staged rollouts and safer change control of critical TF resources
• resolving the ECS drift issue by using the “Task Definition Template Pattern”
• implementing OpenTofu’s OTel tracing to find other performance bottlenecks and set up the Cursor team for longterm visibility into their IaC throughput

Because Cursor’s engineering team uses Cursor to write Terraform, Masterpoint embedded architectural knowledge directly into the codebase as AI agent skills and rules.

This AI context encodes the decisions that AI models cannot anticipate on their own:

• when to create a new root module vs. extend an existing one
• how to scope blast radius in a root module
• how to break up a high blast radius monolithic root module
• data source patterns and optimizations
• security practices, such as cloud networking and Terraform/OpenTofu module SHA pinning
• debugging performance bottlenecks, through methods such as logging and OpenTelemetry traces
• …and more

Every IaC optimization Masterpoint delivered was paired with instructions to prevent anti-patterns from being reintroduced.