Infrastructure as Code Review

Read-only access to your IaC repository (GitHub App, GitLab project token, Bitbucket or Azure DevOps PAT) and, optionally, a read-only cloud role for drift detection (AWS IAM ReadOnlyAccess, Azure Reader, GCP Viewer). We never download or copy your Terraform / OpenTofu state files - they often contain secrets, and they stay in your backend. Drift detection works by reading cloud APIs and comparing to declared resources in your code, not by exporting state.

All of the above, plus AWS CDK and CDKTF. The audit covers Terraform and OpenTofu, Pulumi (TypeScript / Python / Go), AWS CDK, CDKTF, CloudFormation, and Ansible. If you mix tools across repos or services, we cover them all in one engagement and call out the cohesion gaps between them.

Drift detection runs against cloud APIs using a read-only role and compares the live state of resources to what your IaC declares. It is fully read-only - no modifications, no plans, no applies. We use a combination of driftctl, native drift checks in Terraform Cloud / Spacelift / Env0, and our own scanner depending on what gives the cleanest signal for your stack. Running against production is safe; the only side effect is a small amount of read-API traffic.

No. Every credential we use is read-only. We do not run terraform apply, push branches, change pipeline configuration, modify cloud resources, or trigger deploys. The audit is a pure read-only review with code-level recommendations you choose if and when to implement.

We routinely audit AWS Organizations / Control Tower landing zones, Azure Management Groups, and GCP folder hierarchies. The review covers cross-account / cross-subscription role assumption, shared-services patterns, environment isolation (dev / stage / prod), and the IaC patterns that keep them consistent (root modules, workspaces, Terragrunt, stack composition). Findings are scoped per environment so production gets the priority it deserves.

Yes. Every security finding is mapped to the relevant CIS Benchmark control for AWS, Azure, or GCP, plus NIST 800-53, the SDLC and change-management controls in SOC 2 (CC6, CC8.1), ISO 27001 A.8 and A.14, and PCI-DSS 6 where applicable. The output is designed to drop directly into auditor evidence packs and to inform your next compliance cycle.

Static scanners are great at finding known misconfigurations one file at a time, but they miss cross-resource issues, drift, state-management problems, IAM blast radius, module composition smells, and pipeline-level gaps. We use the same scanners (Checkov, tfsec, KICS, Terrascan, TFLint) plus live drift checks and a senior platform engineer who reviews findings in context, removes false positives, and ranks issues by exploitability - outputs are repo-specific recommendations, not raw rule hits.

Typical turnaround is 1-2 business days from the moment read-only access is granted, plus a 45-minute live findings walkthrough at a time that suits your team. Larger estates (multi-account landing zones, thousands of resources) can take a little longer; we confirm the timeline as soon as we see the scope.