iac.htora.dev · security templates

Home/Templates/Block the changes you never want

Block the changes you never want

Policies that make dangerous actions fail outright, so there is nothing to alert on afterwards.

Terraform

Why bother

Alerts tell you that someone turned off logging or opened a region you do not use. By then it has happened. A guardrail makes the action fail, so there is nothing to respond to.

How you know it worked

Try a blocked action from a member account. It should be refused.

Not written yet

No code exists for this one. It is listed so the gap shows on the coverage table. When it is written, each platform will use:

PlatformService
AWSService control policies on the organization
AzureA policy set assigned to the management group
Google CloudOrganization policy constraints
Oracle CloudTenancy policies and compartment quotas

Registry 0.6.0. Built 2026-09-22.

Made by Habibullah Tora. Code under the MIT licence, writing under CC BY 4.0.