iac.htora.dev · security templates

Home/Using the templates/How to use this site

How to use this site

Pick a result, pick where it runs, pick how much to take on, then prove it worked.

The four steps

  1. Pick a result. Templates are named after what you end up with, such as audit logs nobody can delete. Browse them.
  2. Pick where it runs. Each template page has a tab per platform: AWS, Azure, Google Cloud, or Oracle Cloud for Terraform; Linux or Windows for Ansible; Kubernetes for Argo CD. The explanation reads the same on every tab.
  3. Pick a level. Quick start to see it work, Standard to keep it, Hardened when someone will audit it.
  4. Run the check. Every tab ends with how to prove the result. If the check does what the page says, the setup worked.

The three levels

LevelWhat you getWho it is for
Quick startT0One file. Copy it, run it, and you have a working example in a few minutes.Someone who wants to see the thing work before deciding anything.
StandardT1Settings you can change, shared state, consistent tags, and your own encryption key.A team putting this into an account they care about.
HardenedT2Rules that block a bad change before it applies, plus a job that tells you when someone edits it by hand.Anyone who has to show an auditor that the setting stayed put.

What each level includes, in detail

What you need installed

ForInstallAnd have
Terraformterraform 1.6 or later Your cloud's command line tool, signed in to the account you mean
Ansibleansible-core 2.14 or later SSH access to the machines, and an inventory file listing them
Argo CDkubectl A cluster with Argo CD already installed. The argocd command line tool helps and is optional
Preview every change

Each tool can show you what it is about to do before it does it: terraform plan, ansible-playbook --check --diff, and argocd app diff. Read that output first. The templates are written so the preview is short enough to read.

Draft and Ready

Draft means the code exists and the automatic checks have not all passed on the main branch yet. Use a Draft template as a starting point you read closely. Ready means every check for that tool passed, and someone confirmed the run before changing the label.

Registry 0.6.0. Built 2026-09-22.

Made by Habibullah Tora. Code under the MIT licence, writing under CC BY 4.0.