Skip the DIY and get it done right, faster

All companies share the same fundamental infrastructure needs. So why waste time building it all from scratch? Gruntwork gives you all the pieces you need.

We’ve taken the best practices from each cloud framework, and combined them with IaC best practices and Gruntwork’s opinionated defaults.

Landing Zones on any Cloud

Best-practice DevOps standards and baselines for a well-architected landing zone on AWS, Google Cloud, or Azure.

Proven Modules

Battle-tested infrastructure as code modules to set up cloud foundations, run apps, and store data.

IaC Management Platform

One set of tools to deploy, manage, update, and tear down infrastructure. And its the same workflow on every cloud.

One interface for every cloud

Gruntwork provides a common interface for provisioning and managing landing zones on AWS, Azure, and GCP.

The command surface, the config schema, and the lifecycle operations (creating an account, updating baselines, rolling out a policy change) are identical across all three clouds. The primitives underneath differ. The way your engineers work does not.

Accelerate your path to well-architected infrastructure

Gruntwork delivers a complete, fully integrated DevOps foundation built on proven patterns that just works. The workflow is the same whether you land on AWS, Google Cloud, or Azure.

•

Step

IaC tooling and best practices

Gruntwork works with you to:

Set up OpenTofu/Terraform and Terragrunt

Organize your code in a proven folder structure and pattern

Define global variables and overrides as you descend down your folder structure

Define a default set of OpenTofu/Terraform module input values used by all module instances to keep your code DRY

Establish a required tagging and naming schema so every resource is attributable back to a team, environment, and cost center

Cloud specific:

AWS

— tags and naming conventions applied across accounts and resources

Google Cloud

— label and tag schema on every project and resource

Azure

— tagging schema on every subscription, resource group, and resource

•

Step

Infrastructure architecture and repo structure

Gruntwork provides:

A git repo for your infrastructure configured following best practices for multi-environment, multi-region deployments

A flexible multi-environment pattern with Terragrunt Stacks that's proven to scale

A baseline branch protection configuration

Delegated per team repository structure

•

Step

Accounts, projects, and subscriptions

Gruntwork works with you to set up:

Code-driven environment vending

— new accounts, projects, or subscriptions created through a pull-request workflow, with baselines and guardrails applied automatically

Best-practice org hierarchy

— separation between infrastructure, security, shared services, and workloads

Centralized identity and access

— single sign-on, preconfigured roles, and least-privilege permission boundaries

Policy guardrails

— preventive and detective controls enforced across every environment

Network foundations

— private networks, subnets, routing, egress control, shared services, and hybrid connectivity

Cloud specific:

AWS

— AWS Organizations, OUs; AWS Control Tower; AWS Config, GuardDuty, CloudTrail; IAM Identity Center (SSO); VPCs, Transit Gateway, and more

Google Cloud

— orgs, folders, and projects; Organization Policies; Cloud Identity and IAM; Shared VPC networking, and more

Azure

— management groups, subscriptions, resource groups; Azure Policy; Microsoft Entra ID and Azure RBAC; hub-and-spoke networking, and more

•

Step

Infrastructure deployment and compliance

Gruntwork works with you to set up:

Pipelines

— a secure GitOps CI/CD pipeline that consolidates privileged access, enforces least-privilege, includes auditing, locking, drift detection etc

Cloud specific modules

— all IaC are versioned OpenTofu/Terraform modules that are maintained

Compliance guardrails

— mapped to your cloud's security benchmark

Cloud specific:

AWS

— aligns to best practices from AWS Well-Architected Framework and AWS Landing Zone Accelerator, coupled with Gruntwork opinionated defaults

Google Cloud

— aligns to best practices from Google Cloud Well-Architecture Framework and Fabric FAST, coupled with Gruntwork opinionated defaults

Azure

— aligns to best practices from Azure Well-Architected Framework and Azure Landing Zones, coupled with Gruntwork opinionated defaults

•

Step

Monitoring and Maintenance

Gruntwork works with you to set up:

Patcher

— scans your configurations, raises PRs for available updates, highlights breaking changes, and sequences rollouts across environments

Drift Detection

— continuously checks that live infrastructure matches your IaC, and opens a PR whenever it doesn't

•

Step

Application architecture

You deploy your application on the foundation we've built together

Get the fast track to …

Cloud Foundations

AWS, GCP, Azure

Gruntwork

IaC Foundations

GitHub/GitLab

CI/CD Pipelines

Platform

Services

Open Source

Resources

Company