Skip to content
Nimbus

Infrastructure as Code (Terraform / OpenTofu / Pulumi)

The IaC connector exposes a small set of CLI-driven tools for terraform, OpenTofu, Pulumi, and AWS CloudFormation against a caller-supplied working directory. Reads (plan, preview) are no-HITL; every state-mutating tool (apply, destroy, up, deploy) is HITL-gated. Opt-in.

What’s indexed

Section titled “What’s indexed”
  • Service id: iac
  • Item types: sync_heartbeat

The IaC connector does not scan repositories. The sync emits a heartbeat with indexed AWS Lambda counts (consumed by nimbus status --drift); all other operation is on-demand against a workingDirectory you pass at call time.

Authenticate

Section titled “Authenticate”
Terminal window
# Opt in
nimbus vault set iac.enabled 1

The connector inherits the ambient process environment, so cloud credentials come from your usual terraform / pulumi / aws setup (AWS_PROFILE, ~/.aws/credentials, gcloud auth, etc.). Without iac.enabled = "1" in the Vault, the syncable returns a no-op.

Read tools (no HITL)

Section titled “Read tools (no HITL)”
Tool Purpose
iac_pulumi_preview Run pulumi preview in a stack directory.
iac_terraform_plan Run terraform plan in a directory.

Write tools (HITL-gated)

Section titled “Write tools (HITL-gated)”

Every tool below requires interactive consent through the Gateway HITL gate before it executes.

Tool Purpose
iac_cloudformation_deploy Deploy a CloudFormation stack via AWS CLI.
iac_pulumi_up Run pulumi up.
iac_terraform_apply Run terraform apply.
iac_terraform_destroy Run terraform destroy.

Platform notes

Section titled “Platform notes”
  • Requires the relevant CLI on PATH: terraform (or tofu) for terraform tools, pulumi for pulumi tools, aws for cloudformation_deploy.
  • All operations take a workingDirectory argument and execute there with the caller’s ambient cloud credentials.

See also

Section titled “See also”