iac.htora.dev · security templates

Home/Templates/All templates

All templates

Every template on the site, named after what you end up with.

Ready to use

Audit logs nobody can delete

Send cloud audit logs to storage that refuses deletes for a set number of days.

TerraformDraft
Lock SSH down to keys only

Turn off password logins and root logins, and check the config before restarting so you cannot lock yourself out.

AnsibleDraft
Send host logs off the machine

Forward system logs to a collector so they outlive the machine that wrote them.

AnsibleDraft
Point Argo CD at a repository

The first Application, which then manages every other application from Git.

Argo CDDraft
See what containers are doing while they run

Runtime alerts installed by the same pipeline that ships the workloads, so they cannot fall behind.

Argo CDDraft

Planned

Listed so the gaps are visible. Each page explains the problem and names the service each platform will use.

Block the changes you never want

Policies that make dangerous actions fail outright, so there is nothing to alert on afterwards.

TerraformPlanned
Check every resource against your rules, all the time

Continuous evaluation that flags a resource the moment it stops matching the standard.

TerraformPlanned
Get cloud logs into your SIEM

A delivery pipe from cloud logging to the place your detections actually run.

TerraformPlanned
Emergency access that works when login is broken

A separate account that does not depend on your identity provider, and shouts every time it is used.

TerraformPlanned
Shell access without opening a port

Reach a server for troubleshooting with nothing listening on the internet, and a recording of the session.

TerraformPlanned
Somewhere to keep secrets that rotates them

A managed store with automatic rotation, an access log, and a way to take access away.

TerraformPlanned
Encryption keys you control and can switch off

Your own keys, rotated on a schedule, with a usage log and an off switch.

TerraformPlanned
Keep network records long enough to be useful

Traffic records stored cheaply for months, in a format you can query.

TerraformPlanned
An analysis machine that cannot reach production

A clean-room virtual machine for looking at suspicious files, with no route to anything live.

TerraformPlanned
A safe place to keep Terraform state

The state file holds secrets in plain text. This stores it encrypted, versioned, and locked.

TerraformPlanned

Registry 0.6.0. Built 2026-09-22.

Made by Habibullah Tora. Code under the MIT licence, writing under CC BY 4.0.