Set up OpenTofu/Terraform and TerragruntOrganize your code in a proven folder structure and patternDefine global variables and overrides as you descend down your folder
structureDefine a default set of OpenTofu/Terraform module input values used by all
module instances to keep your code DRYEstablish a required tagging and naming schema so every resource is
attributable back to a team, environment, and cost centerAWS — tags and naming conventions applied across accounts and resourcesGoogle Cloud — label and tag schema on every project and resourceAzure — tagging schema on every subscription, resource group, and resource
A git repo for your infrastructure configured following best practices for
multi-environment, multi-region deploymentsA flexible multi-environment pattern with Terragrunt Stacks that's
proven to scaleA baseline branch protection configurationDelegated per team repository structure
Code-driven environment vending — new accounts, projects, or subscriptions created through a
pull-request workflow, with baselines and guardrails applied automaticallyBest-practice org hierarchy — separation between infrastructure, security, shared services, and
workloadsCentralized identity and access — single sign-on, preconfigured roles, and least-privilege permission
boundariesPolicy guardrails — preventive and detective controls enforced across every environmentNetwork foundations — private networks, subnets, routing, egress control, shared
services, and hybrid connectivityAWS — AWS Organizations, OUs; AWS Control Tower; AWS Config, GuardDuty,
CloudTrail; IAM Identity Center (SSO); VPCs, Transit Gateway, and moreGoogle Cloud — orgs, folders, and projects; Organization Policies; Cloud Identity
and IAM; Shared VPC networking, and moreAzure — management groups, subscriptions, resource groups; Azure Policy;
Microsoft Entra ID and Azure RBAC; hub-and-spoke networking, and more
Pipelines — a secure GitOps CI/CD pipeline that consolidates privileged access,
enforces least-privilege, includes auditing, locking, drift detection etcCloud specific modules — all IaC are versioned OpenTofu/Terraform modules that are
maintainedCompliance guardrails — mapped to your cloud's security benchmarkAWS — aligns to best practices from AWS Well-Architected Framework and
AWS Landing Zone Accelerator, coupled with Gruntwork opinionated defaultsGoogle Cloud — aligns to best practices from Google Cloud Well-Architecture
Framework and Fabric FAST, coupled with Gruntwork opinionated defaultsAzure — aligns to best practices from Azure Well-Architected Framework and
Azure Landing Zones, coupled with Gruntwork opinionated defaults
Patcher — scans your configurations, raises PRs for available updates,
highlights breaking changes, and sequences rollouts across environmentsDrift Detection — continuously checks that live infrastructure matches your IaC,
and opens a PR whenever it doesn't
