Home/Using the templates/The three levels
The three levels
The same result at three levels of commitment. Move up when you are ready.
Code that is safe to paste into a scratch account and code a team runs in production are written differently. Every result here is written up to three times so you can pick the one that matches what you are doing today.
Quick start
Someone who wants to see the thing work before deciding anything.
One file. Copy it, run it, and you have a working example in a few minutes.
Every template at this level follows these rules:
- one file, read it top to bottom
- nothing to set up before you run it
- no modules or roles to follow into
- anything you must change sits at the very top of the file
Standard
A team putting this into an account they care about.
Settings you can change, shared state, consistent tags, and your own encryption key.
Every template at this level follows these rules:
- settings live in their own file, separate from the logic
- shared state or a shared source of truth, with a filled-in example
- every resource carries the four standard tags, where the target has tags
- uses your own encryption key wherever the platform offers one
Hardened
Anyone who has to show an auditor that the setting stayed put.
Rules that block a bad change before it applies, plus a job that tells you when someone edits it by hand.
Every template at this level follows these rules:
- policy rules in policy/ that fail the plan
- a scheduled job that compares the live account to the code
- security scan set to fail, and any exception written down with a reason
Moving between levels
Treat each level as its own thing. The names and settings differ between them, so applying Standard on top of a quick start creates a second set of resources beside the first.
The quick starts are built to be removed. The AWS and Azure audit log versions lock for one day, so you can try them today and clear them out tomorrow. When you are ready to keep something, remove the quick start and apply Standard.