{"slug": "show-hn-orchesterra-generate-terraform-from-a-repo-then-catch-drift", "title": "Show HN: OrchesTerra – Generate Terraform from a repo, then catch drift", "summary": "OrchesTerra launched a Show HN tool that scans a code repository to discover services and dependencies, generates Terraform/OpenTofu infrastructure-as-code, and then reconciles declared state against live AWS, Azure, GCP and OCI resources to flag drift. The self-serve platform starts at $99 a month with a 14-day trial, and a live read-only sample workspace (Acme Retail) requires no signup. The tool also prices plans against live cloud price lists, enforces OPA policy packs and Checkov scanning in one approval pipeline, and includes an AI agent named Orbit that answers questions about an estate and bill and asks before making changes.", "body_md": "AWS\n\nDrift\n\naws_security_group.app_sg\n\nIngress 0.0.0.0/0:443 added outside Terraform\n\nSecurity group drift\n\nAI Operating System for Cloud Infrastructure\n\nPaste a repository and OrchesTerra automatically discovers services, maps dependencies, generates architecture, estimates cloud costs, validates governance, and creates deployment-ready infrastructure.\n\nReduce architecture discovery from weeks to minutes.\n\nThe live demo opens a read-only sample workspace (Acme Retail). No signup.\n\nAnalysis output\n\nTwo ways to work with us\n\nSame platform, same approvals, same audit trail. You choose who operates it.\n\nPlatform\n\nSelf-serve OrchesTerra\n\nYour platform team uses OrchesTerra to generate, govern and reconcile infrastructure. From $99 a month, with a 14-day trial.\n\nManaged service\n\nManaged DevSecOps\n\nA dedicated team of our engineers runs your cloud on OrchesTerra: pipelines, patching, drift fixes, DR drills and cost reviews. Every change still waits for your approval.\n\nThe platform\n\nScans a repository and finds its services, dependencies, Docker Compose, Helm charts, Kubernetes manifests, Terragrunt and CI pipelines, then draws the topology.\n\nWrites reviewable IaC from that topology, provisions through CloudFormation change sets when you prefer, and imports the resources you already run.\n\nPrices every plan against live AWS, Azure, GCP and OCI price lists, and flags savings in what is already running.\n\nScheduled and predictive scans compare state with the cloud; restore, accept or forget each drift through an approval.\n\nOne inbox for every change, with reviewer groups, delegation and maintenance windows. Nothing applies until the chain is complete.\n\nOPA policy packs, a simulator to test them, Checkov config scanning and compliance packs, all enforced in the same pipeline.\n\nPlan replication and standby regions, run failover, and check readiness before the day you need it.\n\nAn AI agent that reads your estate and your bill, answers in plain words, and asks before it changes anything.\n\nMULTI-CLOUD STATE RECONCILIATION\n\nDetect infrastructure drift before it becomes an incident.\n\nMulti-cloud reconciliation\n\nTerraform · OpenTofu vs live cloud state\n\n4\n\nCritical drift events detected\n\n12\n\nWorkloads potentially impacted\n\n23\n\nResources outside declared state\n\nDrift findings listed below\n\nDrift findings\n\nDifferences between Terraform/OpenTofu state and live cloud resources.\n\naws_lb_listener_rule.public_alb\n\nCatch-all listener rule rerouted to public target group\n\nLoad balancer drift\n\nAzure\n\nazurerm_network_security_rule.aks_api\n\nAKS API endpoint opened to broad source CIDR block\n\nNetwork rule drift\n\nOCI\n\noci_load_balancer_listener.public\n\nPublic listener certificate policy downgraded outside IaC\n\n4 drift events identified during state reconciliation.\n\nConversational Orchestration\n\nOrchesTerra understands your intent, asks the right questions, and builds the optimal infrastructure—ready for you to review and launch.\n\n01\n\nDescribe what you need in natural language.\n\nWhat matters most to you?\n\nHow would you like to deploy?\n\n02\n\nOrbit designs the best-fit architecture in real time.\n\nEKS Cluster\n\nMulti-AZ\n\nWorker Nodes\n\nAuto Scaling\n\nPrivate ALB\n\nInternal\n\nNode Groups\n\nPostgreSQL\n\nPrimary / Read Replica\n\nRedis Cluster\n\n03\n\nReview the pre-filled configuration.\n\nGenerated from your conversation\n\nIntelligent by default\n\nBest practices built-in at every step.\n\nContinuously optimized\n\nAdapts to your inputs in real time.\n\nSecure & compliant\n\nSecurity, reliability and compliance first.\n\nReady in minutes\n\nFrom idea to launch—faster.\n\nProduct Demo\n\nShort clips from a live sample workspace: from repository to governed infrastructure, with cost, drift and approvals along the way.\n\nReopen a scanned repository and land on the architecture OrchesTerra generated from it.\n\nClick around a read-only sample workspace for Acme Retail. No signup needed.\n\nOperate\n\nOrbit answers questions about your estate and your bill, and drafts changes for approval. Disaster recovery keeps standby regions ready and drills on record.\n\nOrbit AI assistant\n\nacme-prod · AWS\nWhy did our AWS bill go up last month?\n\nDisaster recovery checkout\n\nus-east-1 → eu-west-1\nLast drill\n\nRTO 11 min\n\nReplication lag\n\n2.1 s\n\nInfrastructure Governance\n\nDetect infrastructure drift, route approvals, and enforce controlled execution before changes reach production.\n\nSwipe to view approval flow →\n\nDrift Detected\n\nComplete\nChange Identified\n\nComplete\nSecurity Review\n\nIn Progress\nPlatform Approval\n\nWaiting\nApplication Owner\n\nWaiting\nExecute Change\n\nBlocked\nSecurity Team\n\nApproved\nPlatform Team\n\nPending\nExecution paused\n\nAll required approvals must complete before execution can proceed.\n\nOur engineers operate your cloud on OrchesTerra, so your developers ship product instead of patching clusters. You keep the approvals and the audit log.\n\nHow an engagement runs\n\nAssess\n\nWe scan your repositories and accounts, map drift, risk and spend, and agree the scope.\n\nOnboard\n\nExisting resources are imported into Terraform state; pipelines and approval chains are set up.\n\nYour named engineers run day-to-day changes, patching and incident response.\n\nReport\n\nA monthly review of cost, security posture, drift and DR readiness.\n\nYou stay in control. Every change our team makes waits for your approvers and lands in your audit log.\n\nPlatform Comparison\n\nReplace fragmented infrastructure workflows with a single orchestration layer for generation, approvals, deployment, and reconciliation.\n\nCreate\n\nGovern\n\nOne orchestration layer\n\nTerraform / OpenTofu\n\nSpacelift / Env0\n\nOrchesTerra is the only platform that unifies infrastructure creation, governance, and operations into a single AI-native orchestration layer.\n\nSee seats, cloud accounts, and governance limits on the [pricing page](https://www.orchesterra.in/pricing/).\n\nEnterprise Operations\n\nBuilt for teams operating production infrastructure with governance, access control, auditability, and secure credential boundaries.\n\nDesigned for production\n\nEnterprise patterns baked in, not bolted on.\n\nSecure by default\n\nLeast-privilege access, credential isolation, and policy guardrails.\n\nAudit everything\n\nComplete traceability across every action and environment.\n\nBuilt for scale\n\nReliable, consistent operations across teams, clouds, and regions.\n\nRoute infrastructure changes through configurable approval chains before deployment or reconciliation.\n\nControl access to environments, projects, and infrastructure operations with precision.\n\nTrack deployments, approvals, reconciliations, and operator actions with immutable logs.\n\nIntegrate cloud credentials securely with scoped permissions and controlled access.\n\nEvery deployment, approval, and reconciliation action is fully traceable, auditable, and governed through a single control plane.\n\nPricing\n\nFAQ\n\nAWS, Azure, Google Cloud and Oracle Cloud (OCI). Cost estimates, drift scans and policy checks run across all four from one workspace.\n\nGenerated code is Terraform or OpenTofu, your choice. On AWS you can also provision through CloudFormation change sets and import existing stacks.\n\nNo. OrchesTerra imports existing AWS and Azure resources into Terraform state, so drift detection and approvals cover what you run today.\n\nA scoped role per cloud account. On AWS you create it with a one-click CloudFormation template that pins a per-tenant External ID, with separate read-only and deploy roles. Sessions are labelled for CloudTrail and can be locked to source IPs, credentials are encrypted and scoped to your workspace, plans and applies run on a separate sandboxed runner, and every apply waits for the approval chain you configure.\n\nA dedicated team of our engineers runs your infrastructure on OrchesTerra: pipelines, patching, drift and policy fixes, DR drills and cost reviews. Every change they make goes through your approvals and lands in your audit log.\n\nPick Starter or Business and keep your workspace, or talk to us about Enterprise or Managed DevSecOps. Nothing is applied to your cloud without approval, during the trial or after it.\n\nPlatform Evaluation\n\nDescribe your infrastructure intent, operational constraints, and deployment priorities — OrchesTerra will generate the execution path.\n\nWhat OrchesTerra will generate", "url": "https://wpnews.pro/news/show-hn-orchesterra-generate-terraform-from-a-repo-then-catch-drift", "canonical_source": "https://www.orchesterra.in/", "published_at": "2026-11-15 13:06:47+00:00", "updated_at": "2026-11-15 13:24:06.571358+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "ai-infrastructure", "developer-tools"], "entities": ["OrchesTerra", "Orbit", "Terraform", "OpenTofu", "AWS", "Azure", "GCP", "OCI"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-orchesterra-generate-terraform-from-a-repo-then-catch-drift", "markdown": "https://wpnews.pro/news/show-hn-orchesterra-generate-terraform-from-a-repo-then-catch-drift.md", "text": "https://wpnews.pro/news/show-hn-orchesterra-generate-terraform-from-a-repo-then-catch-drift.txt", "jsonld": "https://wpnews.pro/news/show-hn-orchesterra-generate-terraform-from-a-repo-then-catch-drift.jsonld"}}