GPT-6.1 Terra on iac-bench 2026-10

Every model evaluated on the 2026-10 fixtures side by side, with a sortable leaderboard, picks by use case and the cost of each: LLM rankings.

Summary

GPT-6.1 Terra places eighth of 16 by composite (84.9), with a 95% rank interval of 6–12. In the bootstrap it finishes ahead of each of the seven models above it in under 8% of resamples (Claude Sonnet 5.5 7%, GPT-6.1 Sol 4%, GPT-6 Astra under 1%), and ahead of Kimi K3 in 73%, GLM-5.3 in 66% and GPT-6 Luna in 91%. All 9 attempts cost $0.42, less than half of Sol ($1.02) and a seventeenth of Astra ($7.26); Luna is cheaper at $0.05.

All 9 attempts planned. One has a security finding: G003 e3 leaves basic-auth publishing on (H2). App Service (G003) is its strongest fixture, fourth in the field by median composite. S3 (G001) is its weakest, twelfth, with a median mechanical score of 0.667.

Scores

Rubric items not at full credit, counted over attempts that planned: G001: B1 3/3, H6 3/3, H7 3/3, H9 3/3, H12 3/3, H13 3/3, H14 1/3, H15 3/3; G002: A3 1/3, A4 2/3, A5 1/3, B1 3/3, H3 1/3, H4 3/3, H5 3/3, H11 3/3; G003: B2 1/3, H2 1/3, H7 1/3. Definitions are in Scoring criteria.

Strengths

• Fast and short. Median wall time is 100 seconds per attempt, the lowest in the field, and its median S3 attempt writes 2,480 output tokens, also the lowest.
• App Service near the top. Median composite 93.2, behind only Claude Fable 5.2, GPT-6 Astra and GPT-6.1 Sol. Every attempt has autoscale rules and sets the container port (E1, E2, 3/3), and two define a 5xx metric alert (E3). Two validate that zone balancing comes with at least 3 instances.
• Registry pulls ordered correctly in G003 e1. A user-assigned identity is created and granted AcrPull before the app, which depends_on the role assignment, so the first image pull does not wait on a system-assigned identity that does not yet exist.
• Fixed security posture on S3 and Cloud SQL. All S3 attempts block public access, enforce BucketOwnerEnforced ownership and deny non-TLS requests (E1, E4, 3/3). Cloud SQL attempts disable public IPv4, set ssl_mode = "ENCRYPTED_ONLY" and force the cloudsql.iam_authentication flag, which database_flags cannot override.
• The judge rates it highly. Judge-only score 93.9 (sixth), with a median of 100 on S3, matched only by Claude Fable 5.2 and Claude Haiku 5.5.

Weaknesses

• Minimal S3 buckets. The only lifecycle rule aborts incomplete multipart uploads, so transition, expiration and noncurrent-version rules are missing (H6, H7, 3/3), and no attempt offers access logging (H9, H13, 3/3). GPT-6 Astra and GPT-6 Luna lose the same three items in 3/3; Claude Fable 5.2 and Kimi K3.1 Pro lose none of them. With 2–4 inputs, there is also no region input (H15, 3/3).
• IAM database users that cannot log in. No Cloud SQL attempt grants roles/cloudsql.instanceUser (E6, 0/3), which GPT-6.1 Sol grants in 3/3. The judge cites it under Scope in G002 e3.
• Data loss and lock-in on Cloud SQL. No google_sql_database sets deletion_policy (H11, 3/3), and backups and point-in-time recovery cannot be turned off (H4/H5 at 0.75 in 3/3). G002 e3 also hardcodes deletion_protection = true (H3) and availability_type = "REGIONAL".
• Basic auth left on in G003 e3. Neither ftp_publish_basic_authentication_enabled nor webdeploy_publish_basic_authentication_enabled is set on the app or the slot, so both stay at the provider default of on. The other two attempts disable both.
• Provider constraints that admit a new major in 6 of 9 attempts (B1): >= 5.0, < 7.0 in all S3 modules and >= 5.30, < 7.0 or < 8.0 in all Cloud SQL modules. The App Service modules use ~> 4.0 or an upper bound of < 5.0.0.
• Duplicate registry inputs on App Service, as with Sol and Astra: acr_resource_id and container_registry_url can disagree. Data sources vs inputs 1 in G003 e1 and e3.

Characteristic patterns

• The judge and the rubric disagree most on S3. Two S3 modules score 100 with the judge, which reads the 4-input interface as right for app developers, while the rubric median is 0.674. The gap puts Terra sixth on judge-only score and ninth on mechanical score (81.1).
• Variables outside variables.tf. G002 e2 puts deletion_protection alone in protection.tf, G003 e1 puts one in registry.tf, and G003 e2 mixes variables with an alert in rollouts.tf (File layout 1 in each).
• Cloud SQL interfaces shrink across samples: 17, 15 and 11 inputs. The 11-input attempt hardcodes backups and the maintenance window and is its lowest Cloud SQL score (76.9).

Representative excerpt

G001/gpt-6.1-terra-e1/main.tf lines 44–58

# Clean up abandoned multipart uploads, but never expire completed objects or versions.
resource "aws_s3_bucket_lifecycle_configuration" "assets" {
  bucket = aws_s3_bucket.assets.id

  rule {
    id     = "abort-incomplete-multipart-uploads"
    status = "Enabled"

    filter {}

    abort_incomplete_multipart_upload {
      days_after_initiation = 7
    }
  }
}

The whole lifecycle configuration of an S3 attempt: one rule that aborts incomplete multipart uploads, with a comment promising never to expire completed objects or versions. Versioning is on, so old versions accumulate with no expiry. All three S3 attempts ship this single rule, which loses the lifecycle and noncurrent-version items (H6, H7) while the judge scores two of the modules 100.

Results · Methodology · Scoring criteria