Home/Using the templates/How to use this site
How to use this site
Pick a result, pick where it runs, pick how much to take on, then prove it worked.
The four steps
- Pick a result. Templates are named after what you end up with, such as audit logs nobody can delete. Browse them.
- Pick where it runs. Each template page has a tab per platform: AWS, Azure, Google Cloud, or Oracle Cloud for Terraform; Linux or Windows for Ansible; Kubernetes for Argo CD. The explanation reads the same on every tab.
- Pick a level. Quick start to see it work, Standard to keep it, Hardened when someone will audit it.
- Run the check. Every tab ends with how to prove the result. If the check does what the page says, the setup worked.
The three levels
| Level | What you get | Who it is for |
|---|---|---|
| Quick startT0 | One file. Copy it, run it, and you have a working example in a few minutes. | Someone who wants to see the thing work before deciding anything. |
| StandardT1 | Settings you can change, shared state, consistent tags, and your own encryption key. | A team putting this into an account they care about. |
| HardenedT2 | Rules that block a bad change before it applies, plus a job that tells you when someone edits it by hand. | Anyone who has to show an auditor that the setting stayed put. |
What each level includes, in detail
What you need installed
| For | Install | And have |
|---|---|---|
| Terraform | terraform 1.6 or later |
Your cloud's command line tool, signed in to the account you mean |
| Ansible | ansible-core 2.14 or later |
SSH access to the machines, and an inventory file listing them |
| Argo CD | kubectl |
A cluster with Argo CD already installed. The argocd command line tool helps and is optional |
Preview every change
Each tool can show you what it is about to do before it does it:
terraform plan, ansible-playbook --check --diff, and
argocd app diff. Read that output first. The templates are written so
the preview is short enough to read.
Draft and Ready
Draft means the code exists and the automatic checks have not all passed on the main branch yet. Use a Draft template as a starting point you read closely. Ready means every check for that tool passed, and someone confirmed the run before changing the label.