Skip to main content
16 production-ready modules · 60+ test gates · FOCUS 1.2+ · Apache 2.0

We reduce transformation execution risk

Enterprise AWS Terraform modules with a tested, FOCUS-tagged golden path. Onboard a new product account in under 30 minutes — copy a tenant template, plan, ship. No custom scaffolding. No copy-paste drift.

CEO pitch: "Every compliance failure and cloud-spend overrun in the market traces to the same root cause — engineers re-building the same account scaffolding, untested, every time. We solve that with a registry."

View on GitHubProject DashboardEnterprise Enquiry

Three Packages · One Paved Road

CTO pitch: "Every module is independently versioned, security-scanned, and cost-attributed before any consumer touches it."

🏗️
AWS Foundation Factory
From empty account to compliant landing zone in <30 min
NZD 15-30k SHIPPED
Buyer: Platform Engineer · CTO · CISO
16 production-ready module directories
Semver-pinned consumers; no copy-paste drift
3-tier test gate (60+ .tftest.hcl)
Zero broken releases reach the registry
CIS AWS Foundations v3.0.0 baseline
ISO 27001 Annex A + APRA CPS 234 Para 36 evidence
S3 native state locking (ADR-006)
No DynamoDB dependency; bootstrapped out-of-band
Apache 2.0 + govern:legal audit
License-clean; enterprise legal approval in 1 day
Stories: TF-19 → TF-28
💰
FinOps+FOCUS Accelerator
AWS + Azure cost attribution on a single FOCUS 1.2+ schema
NZD 10–25kIN-PROGRESS
Buyer: CFO · FinOps Engineer · COO
FOCUS 1.2+ mandatory tags on all 16 modules
CFO reconciles multi-cloud spend without spreadsheets
Infracost delta comment on every PR
Cost visibility before any terraform apply
CKV_CUSTOM_FOCUS_001 gate in CI
Zero cost-attribution drift at registry publish
Module-level cost showback CSV export
Per-module ROI visible in QuickSight / Cost Explorer
plan:cost task + evidence in tmp/
CFO-grade evidence for FinOps Foundation audit
Stories: TF-25, TF-26, TF-29
🛡️
AI-SRE / CloudOps Runbook Pack
Drift detection + AI-generated runbooks from live Terraform state
NZD 30–75kROADMAP
Buyer: SRE · COO · CISO
terraform plan -detailed-exitcode drift detection
SRE detects drift before incidents; not after
deploy:cross-validate post-apply evidence
State vs AWS CLI count cross-validated per release
AI runbook from terraform-output + describe
On-call gets tenant-scoped context in <2 min
Service map from terraform-output (output-driven)
CISO scopes blast radius; COO sees account topology
Integrates CloudOps-Runbooks inventory CLI
Unified runbook ecosystem — no new platform build
Stories: TF-32 → TF-35

CxO Promise → Evidence

CFO pitch: "Every claim on this page traces to an automated test gate, not a consultant's slide."

Persona
Promise
Evidence
👔CEOReduce transformation execution risk16 modules + 60+ test gates → zero broken releases; APRA CPS 234 evidence automated
🔧CTOOnboard any new AWS account in <30 minutestask tenant:new → terraform plan → apply; golden path verified on real sandbox account
💼CFOReconcile AWS + Azure cloud spend on one schemaFOCUS 1.2+ tags on 100% of module outputs; Infracost delta per PR; no manual tagging
🔒CISOCIS AWS Foundations v3.0.0 baseline enforced per PRcheckov + tflint + Claude semantic review on every PR; CPS 234 Para 36 evidence in tmp/
⚙️COOService map + blast-radius visibility from live stateterraform-output-driven service map; deploy:cross-validate evidence per apply (roadmap TF-35)

6-Stage SDLC: Discover → Deprecate

COO pitch: "Every stage has a Taskfile target and an evidence file in tmp/ — no stage exists only on a slide."

🔍
S1Discover
Module triage (TF-12) · legacy KEEP/PROMOTE/ARCHIVE/DELETE · AS-IS audit
📐
S2Design
ADR-003/006/023/024/025 · module API design · composition layer (web+alb+cloudfront+waf)
🏗️
S3Build
16 modules · 60+ .tftest.hcl · CI container-first · FOCUS tags · Claude DevSecOps
🚀
S4Deploy
registry:preflight → semver tag → HCP Registry publish · S3 state backend · deploy:init
📊
S5Support & Scale
Infracost delta · drift detection · SBOM+SLSA · FinOps showback · AI-SRE runbooks
🗑️
S6Deprecate
azure-devops decommission (TF-38) · legacy WIP/b2b fork retirement · SSOT reduction

16 Production-Ready Module Directories

Honest count: 16 production-grade + 1 partial (appregistry in rollout). 60+ automated test gates.

Per-module versioning (ADR-025) in rollout — release-please tracks root tf-aws 2.2.3 + github-oidc 1.0.0 today.

●acm
●alb
●ecs
●efs
●cloudfront
●foundation
●github-oidc
●kms
●organizations
●s3
●sftp
●sso
●tags
●vpc
●waf
●web
+ appregistry (17th dir — partial, under promotion via TF-37) · azure-devops legacy decommission pending TF-38

Security + FinOps Quality Gates

CISO pitch: "G1-G9 gates run container-first on every PR — no bypass, no manual step."

Container: nnthanh101/terraform:2.6.0 · 18 tools pinned · task ci:quick <60s

G1
terraform fmt
Format check on every module
G2
tflint
Provider + module lint rules
G3
checkov
CIS AWS Foundations v3.0.0 baseline
G4
Trivy
Misconfig + SBOM scan per module
G5
FOCUS tags
CKV_CUSTOM_FOCUS_001 cost-attribution gate
G6
Infracost
Cost delta on every PR
G7
govern:legal
Apache 2.0 compliance (5 checks)
G8
govern:score
Constitutional >=85% (15 checkpoints)
G9
Claude semantic
IAM wildcards + SG 0.0.0.0/0 gaps

Ideal for ANZ Regulated Enterprises

CDO pitch: "Three buyer segments, one paved road — same modules, different packages."

⚡
Energy / Metering
APRA CPS 234 + regulated multi-account AWS environments
Foundation Factory + FinOps Accelerator
🚚
B2B Freight / Logistics
Hybrid-cloud landing zones with FOCUS cost attribution
Foundation Factory + AI-SRE Pack
🏢
Regulated Mid-Market SaaS
ISO 27001 baseline IaC slice with CloudTrail-with-CMK
Foundation Factory — full bundle

Start Your Foundation Factory Engagement

From first module to a compliant, multi-tenant AWS landing zone. Packages for CFO, CTO, CISO, and Platform Engineers.

GitHub · terraform-awsProject DashboardPackage Enquiry