Skip to content

Zenfra Documentation

Zenfra is an Infrastructure as Code control plane for teams running Terraform or OpenTofu. It connects your Git repositories to your cloud accounts and gives every change a lifecycle: plan, approve, apply, with the run history, state and audit trail kept in one place.

What Zenfra does

  • Stacks connect a repository, branch and project root to a managed lifecycle. Runs on a source control integration are pinned to the commit they planned, and a tracked run whose plan has no changes finishes without waiting for approval.
  • Runs come in three types: tracked runs plan, wait for your approval and apply; plan-only runs stop after planning; destroy runs remove what a stack manages. Every run has live per-phase logs that are complete or fail the run.
  • Plan Policies check the plan of each tracked and proposed run against your own rules once the plan and its hooks succeed: a deny fails the run, warnings are advisory, and a hook can hand a scanner's report to the rules.
  • Terraform State is stored and locked by Zenfra, or kept in your own S3 bucket with customer-managed state.
  • Source Control covers GitHub.com and GitLab.com directly, and GitHub Enterprise Server, self-managed GitLab, Bitbucket Data Center and Azure DevOps Server inside your network through a VCS Connector: an outbound-only tunnel you run, so no inbound firewall rule is needed.
  • AWS integration assumes an IAM role in your account for each run with short-lived credentials, from Zenfra's control plane or from your own worker's identity.
  • Worker Pools run your operations on Zenfra's public workers or on private workers inside your network.
  • Spaces group stacks into a tree and scope which configuration bundles of variables and files a stack can use.
  • Resources is an inventory of everything Zenfra manages, and drift detection schedules runs that compare configuration against real infrastructure.
  • Identity & Access gives every member a Read, Write or Admin role, with multi-factor authentication by authenticator app or passkey, and an audit log of significant activity across the organization.

Getting started

New to Zenfra? The Getting Started guide connects your first repository and cloud account and runs your first stack.

Guides

Organization

  • Identity & Access: roles, users, invitations, authentication and MFA.
  • API Keys: programmatic access and the API conventions.
  • Audit Log: who did what, when and from where.