We're excited to announce that Turbot Guardrails now supports OpenTofu for cloud landing zones and governance. This enhancement enables cloud teams to deploy and manage standardized patterns across their enterprise cloud environment while leveraging the community-driven, [Linux Foundation](https://www.linuxfoundation.org/)-backed OpenTofu project. ## Why use Guardrails for deploying stacks? While teams can use OpenTofu in their own deployment pipelines, using Guardrails' Stacks to deploy OpenTofu is specifically designed for cloud teams managing enterprise-wide patterns and standards across a multi-cloud environment. Common use cases would be to deploy Landing Zone configurations, consistent networking patterns, IAM resources, resource policies, etc. Guardrails Stacks gives cloud teams additional benefits: - **Unified Governance:** Manage infrastructure standards alongside existing cloud security and FinOps guardrails. - **Policy-Driven Control:** Apply consistent patterns while supporting exceptions through Guardrails' policy engine. - **Automated Drift Correction:** Ensure configurations remain compliant with automated drift detection and correction **without managing state files**. - **Context-aware:** Dynamically bring in context from the Guardrails CMDB, audit trail, and outside data sources. Wrap the context with conditional logic using [calculated policies](https://turbot.com/guardrails/docs/concepts/policies/calculated-faq) to handle a wide variety of enterprise use cases. ## Guardrails Stack [Native] Our new governance stacks, labeled [Stack \[Native\]](https://turbot.com/guardrails/docs/concepts/guardrails/stacks), bring expanded capabilities and flexibility to cloud teams. Powered by OpenTofu, these stacks offer significant improvements over our original [Stack/Configured controls](https://turbot.com/guardrails/docs/concepts/guardrails/configured): | Feature | Stack/Configured | Stack [Native] | | ----------------------------------- | -------------------------------------- | --------------------------------------------------------------------------------------- | | **Version** | Terraform 0.15 and earlier | OpenTofu 1.8.3 and later | | **Triggering** | Resource update | Resource update, interval | | **CMDB Required?** | Yes | No | | **Resources Supported** | Only resources supported in Guardrails | Any resource supported by the [provider](https://opentofu.org/docs/language/providers/) | | **Support for `count`, `for_each`** | No | Yes | ## How to use Guardrails OpenTofu Stacks ### Update your AWS mod [Update](https://turbot.com/guardrails/docs/guides/configuring-guardrails/update-mod) the [@turbot/aws](https://hub.guardrails.turbot.com/mods/aws/mods/aws) mod to version v5.33 or later. Once the mod is installed, you will see new [Stack \[Native\] policies](https://turbot.com/guardrails/docs/concepts/guardrails/stacks#stack-policies) added to your environment. For example, `AWS > Account > Stack [Native] > *` policies:

Turbot Guardrails OpenTofu Stack Policies

### Set your first stack policy Let's start with an existing policy pack sample from the [Guardrails Hub](https://hub.guardrails.turbot.com) to [Deploy AWS IAM Stack](https://hub.guardrails.turbot.com/policy-packs/aws_iam_deploy_aws_iam_stack). This policy pack creates an IAM Role with `ReadOnlyAccess` access in each applicable AWS account. The policy pack sets the following OpenTofu HCL in the `AWS > IAM > Stack [Native] > Source` policy: ```hcl variable "trusted_principals" { description = "A list of principal ARNs that can assume the role. These wil be added to the trust policy." type = set(string) } resource "aws_iam_role" "read_only_role" { name = "read_only_role" assume_role_policy = jsonencode({ Version = "2012-10-17" Statement = [ { Effect = "Allow" Principal = { AWS = var.trusted_principals } Action = "sts:AssumeRole" } ] }) } resource "aws_iam_role_policy_attachment" "read_only" { role = aws_iam_role.read_only_role.name policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess" } ``` ### Setting conditional logic to your stack The policy pack also uses the `AWS > IAM > Stack [Native] > Variables` policy to define `.tfvar`-style variable overrides. While we can simply place a static variable(s) in the configuration, using calculated policies, we can dynamically look up values. The variable we set in the HCL source is for trusted principals. Using calculated policies we can look up a list of trusted AWS Account IDs. In this case, we will lookup the account ID the stack will apply to, essentially allowing the role to be assumed from within the same account. A calculated policy consists of a GraphQL input to pull in the account tags from the Guardrails CMDB, and a Nunjucks template in the policy to define the conditional logic: ```hcl trusted_principals = ["arn:aws:iam::{{$.account.Id}}:root"] ``` To test how the stack will apply, we can [attach the policy pack](https://turbot.com/guardrails/docs/guides/configuring-guardrails/policy-packs#attach-a-policy-pack-to-a-resource) to our `Acme` organization to see the calculated values per account:

Turbot Guardrails AWS IAM Role Policy Pack Policy Values

When ready, we can officially deploy the policy pack by changing the `AWS > IAM > Stack [Native]` policy setting from `Check: Configured` to `Enforce: Configured`. ## Automated drift correction Guardrails can also detect and correct drift of your applied stacks. By default, [drift detection](https://turbot.com/guardrails/docs/concepts/guardrails/stacks#drift-detection) policies will run automatically when a resource changes. When any changes occur in runtime affecting the stack, Guardrails will alert and auto-correct the misconfiguration. For example, if a developer modifies the AWS Principal in the policy, Guardrails will immediately identify the misconfiguration, alert, then take automated action to fix the policy. Here we can see Bob updated the resource, then within a minute, Guardrails detected the drift and updated the resource.

Guardrails Stack drift detect and correct

Exploring the control detail, we can visualize the configuration correction back to the desired state of the stack:

Guardrails Stack drift detect and correct details

## See it in Action Watch this demo to see how Turbot Guardrails manages OpenTofu stacks with automatic drift correction in real time:

## Get started with Guardrails Stacks for cloud landing zones Turbot Guardrails transforms how you manage OpenTofu deployments across AWS, Azure, and GCP. By combining OpenTofu with Guardrails' policy engine, cloud teams can ensure their cloud landing zones stay compliant and secure through context-aware deployments, automated drift detection and correction. [Start](https://turbot.com/start) your 14-day free trial to experience automated cloud landing zones with Guardrails.

Cloud landing zones using OpenTofu