When you need it
Infrastructure changes are applied from laptops, or from a pipeline that holds admin keys. Nobody sees the plan before it runs, drift turns up during incidents, and state files sit where too many people can read them.
What sets the quote
- Terraform or OpenTofu, with up to 10 root modules (state files) in one cloud (AWS, Azure or Google Cloud).
- Up to 3 environments and one state backend (S3, Azure Storage or Cloud Storage).
- Up to 15 policy rules in OPA/Conftest, Checkov or Sentinel (Sentinel needs HCP Terraform or Terraform Enterprise).
- Orchestration in your CI platform, or in Atlantis, HCP Terraform or Spacelift (HCP Terraform runs Terraform only, not OpenTofu).
- Sized from your root module count; larger estates, or a second cloud, are quoted after the call.
What changes
- Every infrastructure change shows its plan in the pull request before anyone approves it.
- Changes reach the cloud only through the pipeline, after approval, with short-lived credentials instead of stored keys.
- Policy checks stop risky changes, such as public storage or open firewall rules, before apply.
- Drift between code and cloud is reported on a schedule instead of being found during an incident.
What you get
- Pipeline as code that runs plan on every pull request and posts the result for review
- Apply only after approval and only from the pipeline, never from a laptop
- Scheduled drift detection with alerts to your team channel
- Keyless access to the cloud, with a read-only identity for plan and a separate identity for apply
- One state backend with locking, versioning, encryption and restricted access, with the state of up to 10 root modules moved into it
- Up to 15 policy rules with tests, checked against every plan
- Runbook for locks, drift and state recovery, and a handover session
What we cover on each cloud
| Area | AWS | Azure | Google Cloud |
|---|---|---|---|
| State storage | S3 bucket with versioning, encryption and state locking | Azure Storage blob container with versioning and lease-based locking | Cloud Storage bucket with object versioning and built-in locking |
| State protection | Bucket policy, KMS key, S3 Block Public Access | Entra ID authentication with shared key access turned off, private endpoint or storage firewall | Uniform bucket-level access, public access prevention, optional Cloud KMS key |
| Keyless access | Separate IAM roles for plan and apply, assumed through OIDC | Federated credentials on a managed identity or app registration, one identity for plan and one for apply | Workload Identity Federation, with separate identities for plan and apply |
Not included
- Writing new modules (quoted separately)
- Importing resources that Terraform or OpenTofu does not yet manage (quoted separately)
- Subscriptions for HCP Terraform or Spacelift
- Other IaC tools, such as Bicep, CloudFormation or Pulumi
What we need from you
- Admin rights on the infrastructure repositories and permission to create pipelines and environments on your CI platform.
- For the setup only, rights to create the state backend and the plan and apply identities: AdministratorAccess in the AWS accounts in scope, Contributor and Role Based Access Control Administrator on the Azure subscriptions, or Owner on the Google Cloud projects.
- Your platform lead for design decisions and reviews, about 3 hours a week.
- A named approver for production applies.
How it works
Free 30-minute call, then a written fixed quote based on your root modules, environments and policy rules.
Design session to agree repository layout, state, identities, approvals and the policy rules to write.
Build the pipeline and move existing state into the backend, one root module at a time.
Run the policy rules in warning mode, then make them blocking.
Handover session and runbook.
At a glance
- Duration
- 2–3 weeks
- Price
- Fixed quote after a free 30-minute call
- Delivered by
- Our lead architect and a cloud engineer
Related services
DevSecOps gap check
In 1–2 weeks, a check of how your teams build and ship software, scored against OWASP SAMM and NIST SSDF, ending in a gap list and a 90-day plan.
Pipeline security check
A one-week review of one CI/CD platform, from organisation settings to runners and secrets, with findings mapped to the OWASP Top 10 CI/CD Security Risks and SLSA.
Keyless pipelines and secrets cleanup
Your pipelines move from long-lived cloud keys to short-lived federated tokens, with secret scanning and dependency gates that stop new leaks and risky dependencies before merge.