CLOUD CERTAINTY
← ALL SERVICES
[ 04 ] TERRAFORM & IAC

Infrastructure changes that are reviewable.

Terraform is easy to start and hard to live with. We build module libraries, state strategy and pipelines that let a junior engineer open a pull request against production infrastructure without anyone holding their breath.

DISCUSS THIS WORK →
A CHANGE FROM PULL REQUEST TO STATE — AND ONE THAT IS STOPPED TERRAFORM · OPA / SENTINEL · REMOTE STATE · DRIFT DETECTION
[ D1 ] MODULE LIBRARY[ D3 ] PIPELINE — PLAN ON PR, APPLY ON MERGE[ D2 ] STATE & BLAST RADIUSINTERNAL MODULE REGISTRYvpcdatabaseclusterobservabilityv2.4.1v1.9.0v3.1.2v0.8.4USED BY 6 TEAMS · PINNEDUSED BY 4 TEAMS · PINNEDUSED BY 3 TEAMS · PINNEDUSED BY 6 TEAMS · PINNEDOPINIONATED DEFAULTS — NOBODYREINVENTS A VPC IN ISOLATIONCONVENTIONS WRITTEN DOWNNAMING · TAGGING · REPO STRUCTURESTILL MAKES SENSE AFTER THREE NEW HIRESPEERAPPLYSTATEREVIEWON MERGEWRITTENPULLTERRAFORMPOLICYREQUESTPLANCHECKBLOCKED — POLICY VIOLATIONPLAN — 3 TO ADD · 1 TO CHANGE · 1 TO DESTROY+ aws_security_group.app~ aws_ecs_service.api− module.legacy.aws_instance.bastionPOSTED ON THE PULL REQUESTPOLICY — NO PUBLIC INGRESS · TAGS REQUIRED · APPROVED REGIONSPASSED — CHANGE CONTINUES TO REVIEWFAILED — 0.0.0.0/0 ON PORT 22. NOTHING APPLIED.DRIFT DETECTION — NIGHTLY. A DIFFERENCE OPENS A PULL REQUEST.AUDIT TRAIL — WHO CHANGED WHAT, WHEN, AND WHYSTATE — ONE PER BOUNDARYPROD / EU-CENTRAL-1STAGING / EU-CENTRAL-1SHARED / NETWORKREMOTE BACKEND · LOCKEDSEPARATE STATESEPARATE STATEONE MISTAKE CANNOT TAKE A WHOLEENVIRONMENT WITH ITEXISTING ESTATE IMPORTEDINCREMENTALLY — NO FREEZE ELSEWHERE[ D4 · D5 ] ADOPTING WHAT WAS BUILT BY HAND — WITHOUT A FREEZE ON EVERYTHING ELSEINVENTORYIMPORT BLOCKSRECONCILE PLANADOPT MODULERETIRE THE CLICK-OPS
[ A ] WHAT THE WORK COVERS
D1
Module library
Opinionated internal modules with sensible defaults, so each team is not reinventing a VPC or a database in isolation.
D2
State strategy
State separation, locking and blast-radius boundaries that keep one mistake from taking a whole environment with it.
D3
Pipelines
Plan on pull request, apply on merge, with policy checks, drift detection and an audit trail of who changed what.
D4
Existing estates
Importing infrastructure that was created by hand, incrementally, without a freeze on everything else.
D5
Conventions
Naming, tagging and repository structure written down, so the codebase still makes sense after three new hires.
[ B ] WHAT YOU GET
01
Reusable module library in your version control
02
CI/CD pipelines for plan, apply and policy checks
03
Migration of existing resources into code
04
Contribution guide and conventions for your team
Everything lands in your repositories and your accounts. Nothing depends on us staying.
[ C ] OTHER SERVICES
01
AWS solution architecture
Landing zones, multi-account structure, networking and workload design — reviewed against the way your team actually operates.
→
02
Kubernetes management
Cluster design, upgrades, autoscaling, observability and day-two operations across managed and self-hosted Kubernetes.
→
03
Cloud cost management
Find the waste, fix the architecture behind it, then leave reporting in place so the saving does not quietly reverse.
→

Tell us what you have — we make it better and cheaper

Send a short description of your current setup. We will tell you what we would improve, what it would cost, and where the savings are. A considered reply from an engineer, not a sales sequence.

[email protected]