Apex Cloud Provisioning

Self-service AWS, governed like a release.

A developer picks a stack and gets a repository, a compliant GitHub Actions pipeline and the AWS infrastructure to run it, with no cloud-ops ticket. Every change goes plan, approve, apply, and the plan that was approved is the plan that runs.

  1. RequestA short form: component, stack, owning team, environment profile.
  2. ScaffoldA GitHub repository with a working skeleton for that stack.
  3. PipelineBuild, security scans, containerize and deploy, already wired in GitHub Actions.
  4. ProvisionTerraform plan, approval where the environment needs it, then apply.
  5. RunRegistered in the catalog with an owner; deployed through Argo CD with canary.
golden paths

New services without a queue. The same compliant path every time.

Most new services wait on a central team for a repo, a pipeline and an AWS account. Apex Cloud Provisioning turns that wait into a golden path your platform team defines once.

Developers

Ask for a service, get one

Pick a stack and a component type. The repository, pipeline and infrastructure arrive together, owned by your team from day one.

Platform team

Define the path once

Stacks, Terraform modules, pipeline templates and environment profiles live in a catalog you control, so every service starts compliant.

Runtimes

ECS, Fargate and EKS

Container workloads on the runtime each environment calls for, with the target group, task definition and service recorded as outputs.

accounts, infrastructure, deploys

The estate a release lands in, built on demand.

The estate should be as governed as the release. Apex Cloud Provisioning builds it and hands the release a target it can prove.

Accounts

One-click AWS accounts

Account Factory for Terraform and Control Tower vending, with guardrails applied before the first workload lands.

Infrastructure

Terraform modules and golden paths

Discovery of what exists, convergence to what should, drift reported rather than silently fixed.

Deploys

Argo CD, canary, blue-green, rolling

Progressive delivery with Istio traffic shaping and Prometheus analysis, rollback as a first-class step.

governance

The approved plan is the plan that runs.

  • Plan, approve, apply. The plan is digested and pinned; apply runs only that plan.
  • Environment-aware gates. Sandbox and dev apply automatically; staging and production stop for cost review and approval.
  • No blind retries. A failed or unknown apply waits for an operator to inspect the pipeline and Terraform state.
  • State you can trust. Per-component remote state in S3 with locking, at a predictable key per tenant, environment and service.
  • Multi-tenant by design. Row-level security separates tenants in the platform's own data.
Release orchestration

Provisioning and release, one trail

Infrastructure changes and application releases share the same approvals and evidence model as Apex, so an auditor sees one record from account to production.

scanner and terragrunt

Start from what you already run.

Apex Cloud Provisioning reads your estate before it changes anything, and works alongside the tooling your teams already trust.

Account scanner

A read-only inventory and graph

Inventory across about twenty AWS services, with the VPC and subnet containment graph, so you see what exists before any plan is written.

Coexist with Terragrunt

Keep your live repo

Apex provisions the shared platform (network, clusters, databases, guardrails); your app teams keep their Terragrunt and read its outputs. No fight over state.

contact

See a request become a running service, in your own AWS account.

A live walkthrough takes twenty minutes. Bring a service you would like to stand up.