Infrastructure as Code
Your cloud account. Your Terraform. Your pipeline.
Generate Terraform modules for the decision engine runtime on AWS Lambda, EKS, GCP Cloud Run, or Azure Container Apps. The Terraform is downloaded to your repository — the platform does not manage state, does not hold credentials, and does not control the lifecycle of what it generated.
Five deployment targets
AWS Lambda
Serverless, zero cold-start with provisioned concurrency
AWS EKS
Kubernetes sidecar or standalone pod, horizontal scaling
GCP Cloud Run
Fully managed container runtime, regional deployment
Azure Container Apps
Serverless Kubernetes, KEDA-based scaling
Docker / On-prem
OCI-compatible image for any container runtime
Five-step workflow
Configure target
Register a cloud target: provider, account ID, region, and apply guard. The apply guard (allow_apply) defaults to FALSE and is enforced by a database trigger — not a UI control.
Generate Terraform
The platform generates downloadable Terraform for the decision runtime (e.g. least-privilege Lambda/ECS task roles, security groups when a mode needs them). That is operator deploy scaffolding — not a multi-cloud IAM product console. Account IAM, IRSA/Workload Identity, and mesh mTLS stay customer-owned. Product auth remains process-wide env secrets plus workspace RBAC / Bearer JWT / API keys / OIDC.
Dry-run (plan)
Run terraform plan against the generated modules. The plan output is shown in the console. Review before enabling apply.
Enable apply
Explicitly enable apply on the target — a separate action requiring typed confirmation (provider name, account, region). This is the gate the apply guard enforces.
Apply & track status
Run terraform apply. Status panel shows the apply progress, the resources created, and the endpoint URL for the decision engine. Rollback links to the previous state.
Security architecture
No credential retention
Cloud credentials are not stored by the platform after Terraform generation. Credentials are passed as environment variables at apply time.
Apply guard is a DB trigger
manager.trg_iac_run_apply_guard cannot be bypassed through the UI. It enforces the allow_apply flag at the database level.
Terraform is yours
The generated modules are in your repository. No platform state file. No managed lifecycle. The platform's job ends when the download completes.
Zero-change on unexercised runs
Leaving the Infrastructure feature entirely unexercised changes nothing in your cloud account — by design.
Infrastructure as Code is available on Business and Custom plans
Cloud target configuration, Terraform generation, and deployment status are available immediately after workspace setup.