Cloud infrastructure you can review and rebuild
Put cloud infrastructure into Terraform or OpenTofu with reusable modules, safe remote state, drift detection and policy checks in every pull request.
Overview
Infrastructure changed by hand in the console cannot be reviewed, repeated or reliably rebuilt. Even teams that use Terraform often end up with one huge state file, copied code between environments, and plans that nobody dares to apply.
We bring existing resources under code, split state so changes are small and safe, and write modules your team can reuse. Plans run in pull requests with policy checks, applies run from a pipeline rather than laptops, and scheduled drift detection tells you when someone changed something outside the code.
Signs you need this
- A terraform plan shows changes nobody expected
- Staging and production were built separately and differ in ways no one can list
- State files sit on a laptop or in a bucket without locking
- Applies are run by one person because others are afraid to
What you get
- Import of existing resources
- Console-built resources brought under code with import blocks, so nothing is recreated.
- Module library
- Versioned modules for networks, clusters, databases and buckets, with sensible defaults and examples.
- State layout
- State split by environment and component, stored remotely with locking and encryption.
- Plan and apply pipeline
- Plans posted on pull requests, applies run from CI with scoped credentials, using Atlantis or your existing CI.
- Policy as code
- Checkov, OPA or Sentinel rules that block public buckets, open security groups and untagged resources before merge.
- Drift detection
- A scheduled plan that reports changes made outside code to your team chat or ticket system.
How the work runs
- 1
Audit
1 to 2 weeks
Compare what exists in the cloud with what is in code, and agree the module and state structure.
- 2
Import and refactor
2 to 5 weeks
Import unmanaged resources, split state, and refactor repeated code into modules without changing live infrastructure.
- 3
Pipeline and policy
1 to 3 weeks
Set up the plan and apply workflow, add policy checks and remove direct console write access where agreed.
- 4
Handover
1 week
Pair with your engineers on real changes so they are confident running the workflow alone.
Timings depend on the size of your estate. The assessment fixes them before any build starts.
What you can check afterwards
- Production infrastructure is defined in code and a plan shows no unexpected changes
- Infrastructure changes go through pull requests with a visible plan
- State is stored remotely with locking and no one applies from a laptop
- Drift reports run on a schedule and reach a named owner
Tools we work with
- Terraform
- OpenTofu
- Terragrunt
- Atlantis
- GitHub Actions
- Checkov
- Open Policy Agent
- tflint
- Infracost
- AWS
- Microsoft Azure
- Google Cloud
From our work
OpsBreak's own product
Get Tajdeed: a bilingual compliance calendar on one server
A bilingual SaaS product run on a single low-cost server
Questions buyers ask
- Will importing resources cause outages?
- No. Import only records existing resources in state. We confirm each plan shows no destructive changes before anything is applied.
- Terraform or OpenTofu?
- Both use the same language and most modules work on either. We help you choose based on licence position, features you need and tooling you already use.
- What access do you need?
- Read access to the cloud accounts for the audit, then a pipeline role with write access. All code lands in your repositories.
- Can our developers maintain this afterwards?
- Yes. Modules are documented with examples and we pair on real changes before we finish.
Talk to us about infrastructure as code.
Tell us what you run and where. We reply within one business day with questions or a quote.