Last updated 08-12-2026
Category:
Reviews:
Join thousands of AI enthusiasts in the World of AI!
Terracotta
Terracotta is an Infrastructure as Code governance tool that audits every pull request before merge, checking Terraform and OpenTofu changes against live cloud resources, remote state, and your team's governance policies. It installs as a GitHub or GitLab app, posts findings in the PR thread, and builds a tamper-evident audit trail regulators can export. The product targets platform engineering teams that need security, drift, cost, and compliance checks without rewriting CI pipelines.
Static scanners like Checkov or tfsec lint HCL syntax and known misconfigurations, but they never compare a plan to what is actually running in AWS. Terracotta closes that gap by correlating code, Terraform state, and live resources so drift, cross-PR conflicts, and hidden blast radius show up before anyone clicks merge. Its guardrails are written in plain English rather than Rego or Sentinel, which lowers the bar for teams that lack a dedicated policy-as-code engineer.
DevOps leads and platform engineers at regulated shops use Terracotta to block public S3 buckets, open SSH rules, and unapproved cost spikes at review time instead of in production. Security and compliance teams get a fleet-wide dashboard with drift posture, policy compliance rates, and exportable records for SOC 2 or HIPAA audits. Developers keep working inside GitHub or GitLab because findings arrive as PR comments, not another portal to check.
Beacon, Terracotta's in-PR chat assistant, answers questions about specific findings using context from the repo, plan output, and drift reports. The Platform tier adds unlimited drift repos, IAM and blast-radius analysis, Slack notifications, and a command center dashboard for $49 per engineer per month. Enterprise customers can run Terracotta self-hosted with SSO, SAML, and custom integrations for HCP Terraform or CircleCI.
Posts automated PR reviews on GitHub and GitLab when a Terraform or OpenTofu pull request opens, before CI runs
Compares IaC code against live cloud resources and remote Terraform state to flag drift across 119 AWS resource types
Platform plan at $49 per engineer per month includes cost analysis, IAM review, blast-radius mapping, and guardrail enforcement
Free Community tier covers 50 public repo PRs, 1 private repo at 20 PRs per month, and up to 5 seats with no credit card
Plain-English guardrails block risky changes without Rego, Sentinel, or OPA policy files
Beacon chat assistant answers in-thread questions about findings using repo, plan, and drift context
Installs via GitHub or GitLab app with no agents required for basic PR reviews
Correlates code, Terraform state, and live AWS resources instead of linting HCL alone
Free Community tier covers public repos and small teams without a credit card
Plain-English guardrails avoid Rego or Sentinel policy expertise
SOC 2 Type II and HIPAA compliance with exportable audit trails
Cost analysis, guardrail enforcement, and IAM review require the Platform plan at $49 per engineer per month
Free tier limits private repos to one repository and 20 PRs per month
Drift detection on the Community plan covers only one repository
What is Terracotta?
Terracotta is an Infrastructure as Code governance platform that audits Terraform and OpenTofu pull requests for security violations, drift, cost impact, and policy compliance before merge. It installs as a GitHub or GitLab app and posts findings directly in the PR.
Is Terracotta free to use?
Terracotta offers a free Community plan with no credit card required. It includes 50 public repo PRs, 1 private repo limited to 20 PRs per month, up to 5 seats, Terraform summary and code review, and drift detection on one repo.
Which IaC formats does Terracotta support?
Terracotta supports Terraform, OpenTofu, Kubernetes manifests, and Terragrunt workflows. It integrates with GitHub, GitLab, and HCP Terraform Run Tasks, and can gate GitHub Actions or GitLab CI pipelines via its CLI.
How does Terracotta detect infrastructure drift?
Terracotta compares your IaC code and Terraform remote state against live cloud resources to surface field-level drift. Its drift reports cover 119 AWS resource types, including console edits, manual applies, and resources deleted outside of code.
What does Terracotta Platform cost?
Terracotta Platform is $49 per engineer per month with unlimited public and private PRs, unlimited seats, unlimited drift repos, all check types, Slack integration, and priority support. Billing starts when a developer authors their first PR.
Does Terracotta work with GitHub and GitLab?
Terracotta connects through read-only GitHub and GitLab apps that audit every IaC pull request automatically. Findings appear as PR comments with severity-coded security, cost, drift, and guardrail results before anyone merges.
What compliance certifications does Terracotta hold?
Terracotta is SOC 2 Type II certified and HIPAA compliant, with tamper-evident audit trails on every finding and approval. Enterprise plans add SSO, SAML, audit logging, and a self-hosted BYOC deployment option.