We investigated the capabilities of GPT-4o and Gemini 2.0 Flash for secure Infrastructure as Code (IaC) development. On the Stack Overflow dataset, which primarily contains small, simplified code snippets, the models detected at least 71% of security smells when prompted to analyze code from a security perspective (general prompt). With a guided prompt (adding clear, step-by-step instructions), this increased to 78%. In GitHub repositories, which contain complete, real-world project scripts, a general prompt was less effective, leaving more than half of the smells undetected. However, with the guided prompt, the models uncovered at least 67% of security smells and achieved promising F1 scores of 74% or higher. To assess how cautious LLMs are about security risks, we then asked the models to generate code for synthetic scenarios based on 89 insecure patterns identified from GitHub IaC scripts. For both models, only 7% of the generated scripts were secure. Adding an explicit instruction to generate secure code increased GPT-4o’s secure output rate to 17%, while Gemini 2.0 Flash changed little (8%); however, the number of warnings increased. This study highlights the need for further research to improve LLMs’ capabilities in assisting developers with secure IaC development.