Approved changes. Your infrastructure.

Provisioning

• Versioned templates, typed inputs, approvals, provenance tags, drift detection and scrubbed execution logs available now
• The customer-run agent: a broker that holds the token and a worker that runs OpenTofu under another user available now
• An OpenTofu apply against a live AWS account: the test estate brought up and torn down through the product's own templates available now
• The library: built-in OpenTofu templates for the AWS types the inventory reads, checked by hash in the agent, enabled for the organisation, cloned to edit, with a notice when a newer release arrives available now
• Each library release runs the small Blueprint — a network, a database and a service — live in a test account, from request to destroy available now
• A role per template on AWS: with the setting on, each request runs as its template's own role, granted only that template's documented policy and the state bucket; a missing role fails the request, never falling back to the agent's identity available now
• The catalog: category, then type, then template, with the accounts whose agent can run each available now
• Blueprints: several templates requested as one run across slots of accounts, one approval bound to the run's expressions, each step a request, resume after a failure and destroy in reverse available now
• Import: a live resource recorded under a template version that declares its type and a team, with its provenance, its owner and its history; nothing is written to the cloud, and drift is not computed until it is fully managed available now
• The agent on Google Cloud: an agent token for a project, Google provenance labels and state in a Cloud Storage bucket available now
• An agent installed in one step for an AWS account the platform already reads, through a CloudFormation quick-create link available now
• Making an import fully managed: an import-only apply into the agent's state, then a separately approved retag, and release from state available now
• Import of a resource no template in the catalog declares, on AWS and Google Cloud: the account's agent generates its template, kept as a private version outside the catalog, and runs it as that resource type's own runner available now
• Google Cloud templates in the library: storage, messaging, networking, identity, compute and clusters, serverless and databases available now
• Azure templates in the library — a private storage account and one for archives, a virtual network with private subnets and one behind a NAT gateway, a private Linux virtual machine and a Spot one, a function app for background work and one for HTTPS callers in named address ranges, a PostgreSQL flexible server for development and a highly available one, a serverless SQL database for development and a zone-redundant one, a private AKS cluster and one answering named networks — each in an existing resource group, each run as its own managed identity with a token of its own, holding only its template's actions, in the subscription the request is for, with OpenTofu state in a storage container of the customer's; each run live through the product on a test subscription available now
• Import's generated template for every Azure type Estate collects in development
• Azure templates of your own, from git or inline, and Blueprints with Azure slots: a request runs on an agent whose runners are scoped to resource groups, and waits, naming the setting, until the account's agent is; an inline source is checked at publish for what the agent refuses — its own sign-in, a renamed provider, provider registration, a resource group made, OpenTofu state read in development
• Blueprints in the library: a network, a database and a service; Kubernetes with an Istio mesh across clusters available now
• A service account per template on Google Cloud, impersonated by the agent, its custom role only the template's documented policy and its own part of the state bucket available now
• Runners for templates of your own: the AWS, Google Cloud and Azure runners modules make one per template, scoped as the library's are, and a template of yours never runs as a library runner available now
• Stopping an EC2 instance through an approved request, from its resource page, verified by the next complete collection available now
• An expiry on a request that opens its destroy request planned
• In-place updates of a provisioned stack not in v1