Infrastructurepipelines
Devs and agents ship more infra changes than ever. Buddy plans each one with Terraform or OpenTofu and applies it only after a person approves.
Trusted by teams at
What you approve is what ships
Apply uses the saved plan file and never plans again. What someone approved is exactly what changes.
Stale plans never apply.
Buddy applies the saved plan, never a new one. If the state changed after approval, Terraform rejects it and the run stops.
No self-approvals.
Pick the people or groups who can approve. Whoever triggered the run can't approve it.
Filter what matters.
Show only destroys, creates or changes. Sensitive values stay masked.
State hosted and locked
Buddy stores your state and locks it during every run. Or keep your S3 or GCS.
One run at a time
Two pushes never apply at once. The next run waits its turn.
Approve on destroy
Require approval only when a plan removes something.
Reviewed twice, applied once
Reviewers open the plan straight from the pull request. After merge, Buddy plans again on the current state, so the plan you approve is always fresh.
- Pull requestA dev or an agent opens or pushes to it.
- Plan on PRIts status shows in the PR.
- Review & mergeThe team reviews and merges.
- Fresh planPlanned again on current state.
- ApproveSomeone else signs off.
- ApplyExactly the approved plan.
Catch drift, then decide what runs
Alert the team
A nightly run posts to Slack only when something drifted.
Revert the change
Your usual pipeline puts the infrastructure back to what the code says.
Accept it
Apply the saved drift plan behind an approval. The state takes the real values, nothing in the cloud changes.
Your pipeline, in YAML
Plan, approve, apply
The basic pipeline: plan the change, wait for approval, then apply it. Buddy keeps your state for you.
Quick start- pipeline: Infrastructure
events:
- type: PUSH
refs:
- refs/heads/main
actions:
- action: Plan
type: TERRAFORM_PLAN
tool: OPENTOFU
version: 1.10.6
working_directory: infra
backend:
type: ARTIFACT
artifact: infra-state
artifact_version: prod
- action: Approve
type: WAIT_FOR_APPLY
description: Review the plan before applying it.
- action: Apply
type: TERRAFORM_APPLY
tool: OPENTOFU
version: 1.10.6
working_directory: infra
backend:
type: ARTIFACT
artifact: infra-state
artifact_version: prodInfra is one step in the pipeline
Terraform and OpenTofu run as native actions in the same Buddy pipeline that builds, tests and deploys your app. No separate tool just for infrastructure.
Build the image, run the tests, plan and apply the infra, roll out to Kubernetes and clear the CloudFront cache - one run, one approval, one place to look.
All Buddy actions
Frequently asked questions
Which Terraform and OpenTofu versions do you support?
Any published OpenTofu version and open-source Terraform up to 1.5.7. Need something else? Use your own Docker image.
Which state backends do you support?
Buddy can host your state and lock it for you - no bucket needed, up to 2 GB per file. Or use Amazon S3, Google Cloud Storage or any other backend Terraform supports, such as http, pg or remote.
Can I move my existing state to Buddy?
Yes. It takes a few manual steps, described in the docs.
How does Buddy connect to my cloud?
Through Buddy integrations for AWS and Google Cloud - AWS can use short-lived credentials. For Azure, Cloudflare and others, add keys as secret variables. They stay hidden in logs.
Can someone approve their own change?
Not if you block it. You can also choose who is allowed to approve.
What if things change after the plan?
Buddy applies the saved plan and never plans again. If the state changed in the meantime, Terraform stops and you run a new plan.
What does drift detection miss?
Resources created outside Terraform. It only checks what Terraform already knows about.
Does it work with many environments or a monorepo?
Yes. Give each environment its own workspace or state, and run each folder's pipeline only when that folder changes.
Is there a Terraform provider for Buddy?
Yes. To manage Buddy itself as code, use the Buddy provider from the Terraform Registry.
Buddy provider