Show HN: OrchesTerra – Generate Terraform from a repo, then catch drift

OrchesTerra launched a Show HN tool that scans a code repository to discover services and dependencies, generates Terraform/OpenTofu infrastructure-as-code, and then reconciles declared state against live AWS, Azure, GCP and OCI resources to flag drift. The self-serve platform starts at $99 a month with a 14-day trial, and a live read-only sample workspace (Acme Retail) requires no signup. The tool also prices plans against live cloud price lists, enforces OPA policy packs and Checkov scanning in one approval pipeline, and includes an AI agent named Orbit that answers questions about an estate and bill and asks before making changes.

AWS Drift aws security group.app sg Ingress 0.0.0.0/0:443 added outside Terraform Security group drift AI Operating System for Cloud Infrastructure Paste a repository and OrchesTerra automatically discovers services, maps dependencies, generates architecture, estimates cloud costs, validates governance, and creates deployment-ready infrastructure. Reduce architecture discovery from weeks to minutes. The live demo opens a read-only sample workspace Acme Retail . No signup. Analysis output Two ways to work with us Same platform, same approvals, same audit trail. You choose who operates it. Platform Self-serve OrchesTerra Your platform team uses OrchesTerra to generate, govern and reconcile infrastructure. From $99 a month, with a 14-day trial. Managed service Managed DevSecOps A dedicated team of our engineers runs your cloud on OrchesTerra: pipelines, patching, drift fixes, DR drills and cost reviews. Every change still waits for your approval. The platform Scans a repository and finds its services, dependencies, Docker Compose, Helm charts, Kubernetes manifests, Terragrunt and CI pipelines, then draws the topology. Writes reviewable IaC from that topology, provisions through CloudFormation change sets when you prefer, and imports the resources you already run. Prices every plan against live AWS, Azure, GCP and OCI price lists, and flags savings in what is already running. Scheduled and predictive scans compare state with the cloud; restore, accept or forget each drift through an approval. One inbox for every change, with reviewer groups, delegation and maintenance windows. Nothing applies until the chain is complete. OPA policy packs, a simulator to test them, Checkov config scanning and compliance packs, all enforced in the same pipeline. Plan replication and standby regions, run failover, and check readiness before the day you need it. An AI agent that reads your estate and your bill, answers in plain words, and asks before it changes anything. MULTI-CLOUD STATE RECONCILIATION Detect infrastructure drift before it becomes an incident. Multi-cloud reconciliation Terraform · OpenTofu vs live cloud state 4 Critical drift events detected 12 Workloads potentially impacted 23 Resources outside declared state Drift findings listed below Drift findings Differences between Terraform/OpenTofu state and live cloud resources. aws lb listener rule.public alb Catch-all listener rule rerouted to public target group Load balancer drift Azure azurerm network security rule.aks api AKS API endpoint opened to broad source CIDR block Network rule drift OCI oci load balancer listener.public Public listener certificate policy downgraded outside IaC 4 drift events identified during state reconciliation. Conversational Orchestration OrchesTerra understands your intent, asks the right questions, and builds the optimal infrastructure—ready for you to review and launch. 01 Describe what you need in natural language. What matters most to you? How would you like to deploy? 02 Orbit designs the best-fit architecture in real time. EKS Cluster Multi-AZ Worker Nodes Auto Scaling Private ALB Internal Node Groups PostgreSQL Primary / Read Replica Redis Cluster 03 Review the pre-filled configuration. Generated from your conversation Intelligent by default Best practices built-in at every step. Continuously optimized Adapts to your inputs in real time. Secure & compliant Security, reliability and compliance first. Ready in minutes From idea to launch—faster. Product Demo Short clips from a live sample workspace: from repository to governed infrastructure, with cost, drift and approvals along the way. Reopen a scanned repository and land on the architecture OrchesTerra generated from it. Click around a read-only sample workspace for Acme Retail. No signup needed. Operate Orbit answers questions about your estate and your bill, and drafts changes for approval. Disaster recovery keeps standby regions ready and drills on record. Orbit AI assistant acme-prod · AWS Why did our AWS bill go up last month? Disaster recovery checkout us-east-1 → eu-west-1 Last drill RTO 11 min Replication lag 2.1 s Infrastructure Governance Detect infrastructure drift, route approvals, and enforce controlled execution before changes reach production. Swipe to view approval flow → Drift Detected Complete Change Identified Complete Security Review In Progress Platform Approval Waiting Application Owner Waiting Execute Change Blocked Security Team Approved Platform Team Pending Execution paused All required approvals must complete before execution can proceed. Our engineers operate your cloud on OrchesTerra, so your developers ship product instead of patching clusters. You keep the approvals and the audit log. How an engagement runs Assess We scan your repositories and accounts, map drift, risk and spend, and agree the scope. Onboard Existing resources are imported into Terraform state; pipelines and approval chains are set up. Your named engineers run day-to-day changes, patching and incident response. Report A monthly review of cost, security posture, drift and DR readiness. You stay in control. Every change our team makes waits for your approvers and lands in your audit log. Platform Comparison Replace fragmented infrastructure workflows with a single orchestration layer for generation, approvals, deployment, and reconciliation. Create Govern One orchestration layer Terraform / OpenTofu Spacelift / Env0 OrchesTerra is the only platform that unifies infrastructure creation, governance, and operations into a single AI-native orchestration layer. See seats, cloud accounts, and governance limits on the pricing page https://www.orchesterra.in/pricing/ . Enterprise Operations Built for teams operating production infrastructure with governance, access control, auditability, and secure credential boundaries. Designed for production Enterprise patterns baked in, not bolted on. Secure by default Least-privilege access, credential isolation, and policy guardrails. Audit everything Complete traceability across every action and environment. Built for scale Reliable, consistent operations across teams, clouds, and regions. Route infrastructure changes through configurable approval chains before deployment or reconciliation. Control access to environments, projects, and infrastructure operations with precision. Track deployments, approvals, reconciliations, and operator actions with immutable logs. Integrate cloud credentials securely with scoped permissions and controlled access. Every deployment, approval, and reconciliation action is fully traceable, auditable, and governed through a single control plane. Pricing FAQ AWS, Azure, Google Cloud and Oracle Cloud OCI . Cost estimates, drift scans and policy checks run across all four from one workspace. Generated code is Terraform or OpenTofu, your choice. On AWS you can also provision through CloudFormation change sets and import existing stacks. No. OrchesTerra imports existing AWS and Azure resources into Terraform state, so drift detection and approvals cover what you run today. A scoped role per cloud account. On AWS you create it with a one-click CloudFormation template that pins a per-tenant External ID, with separate read-only and deploy roles. Sessions are labelled for CloudTrail and can be locked to source IPs, credentials are encrypted and scoped to your workspace, plans and applies run on a separate sandboxed runner, and every apply waits for the approval chain you configure. A dedicated team of our engineers runs your infrastructure on OrchesTerra: pipelines, patching, drift and policy fixes, DR drills and cost reviews. Every change they make goes through your approvals and lands in your audit log. Pick Starter or Business and keep your workspace, or talk to us about Enterprise or Managed DevSecOps. Nothing is applied to your cloud without approval, during the trial or after it. Platform Evaluation Describe your infrastructure intent, operational constraints, and deployment priorities — OrchesTerra will generate the execution path. What OrchesTerra will generate