Terrateam

Key features

• Plan on every pull request Plan on every pull request: opening a pull request triggers a plan whose result lands as a comment, showing resources to add, change, or destroy plus downstream stacks.[1][2]

• Apply on merge or comment Apply on merge or comment: the apply runs when the pull request merges or on an apply comment, with per-environment approval requirements such as CODEOWNERS reviews.[1][2]

• Policy gates before apply Policy gates before apply: OPA/Rego, Conftest, Checkov, and built-in checks run before anything applies, and a failing check can open a named approval gate.[1][2]

• Cost estimates in the review Cost estimates in the review: the plan comment shows the monthly cost delta, and thresholds can require another approval before an expensive apply proceeds.[1][2]

• Scheduled drift detection Scheduled drift detection: infrastructure drift is checked on a schedule, with a single schedule per repository in the Open Source Edition and multiple schedules in Enterprise.[1][2]

• Five infrastructure tools Five infrastructure tools: the same workflow drives Terraform, OpenTofu, Terragrunt, CDKTF, and Pulumi, so mixed estates share one review process.[1][2]

• Dependency-ordered layered runs Dependency-ordered layered runs: stacks and layers derive run order from dependencies, running independent layers in parallel instead of serializing everything.[1][2]

• Tag-based configuration at scale Tag-based configuration at scale: tag queries address tens or thousands of workspaces in monorepos or across repositories without per-directory repetition.[1][2]

Who will love it

• Platform teams on PR-based Terraform Platform teams on PR-based Terraform: teams that already review infrastructure changes as pull requests get plans, policy, cost, and approvals exactly where review happens.[1][2]

• Regulated teams needing gates Regulated teams needing gates: per-environment approvals, policy enforcement, and audit trails suit teams that must show who approved what before an apply.[1][2]

• Small teams starting free Small teams starting free: the Open Source Edition allows up to 3 monthly active users with unlimited runs, so a small team can run the full workflow without a contract.[1][2]

Who should avoid it

• Teams needing free-tier RBAC Teams needing free-tier RBAC: access control, CODEOWNERS enforcement, Gatekeeper, and centralized configuration are Enterprise-only, so governance-heavy teams must budget for the commercial tier.[1]

• Teams off GitHub and GitLab Teams off GitHub and GitLab: the pull-request workflow supports only those two forges, so teams elsewhere cannot adopt Orchestration without migrating.[1]

• Teams wanting zero operations Teams wanting zero operations: self-hosting means operating Docker or Kubernetes infrastructure plus a YAML config estate, which is real platform work unless they take the hosted SaaS instead.[1][2]

Alternatives and compatibility