Killing Terraform Enterprise

At sevenseven.tech, we follow a simple rule: Don't pay for software features you can build yourself in an afternoon.

Terraform is the industry standard for Infrastructure as Code (IaC). But as teams grow, managing Terraform state and locking becomes a headache. The "default" answer is to buy Terraform Cloud or Terraform Enterprise. These are great tools, but they can be expensive, introducing per-user pricing or run-based limits that don't fit every budget.

We found a better way. By leveraging GitHub Actions, Amazon S3, and DynamoDB, we built a fully automated, secure, completely serverless, and auditable Terraform pipeline that costs zero dollars in software licensing.

Here is how we replaced the Enterprise features with pure engineering.

1. The Foundation: Serverless State Management

The first thing Terraform Enterprise sells you is "Remote State Management." You can build this yourself on AWS for pennies.

• Storage (S3): We store the terraform.tfstate file in a private, encrypted S3 bucket.
• Locking (DynamoDB): To prevent two engineers from deploying at the same time and corrupting the state, we use a DynamoDB table.

This gives us the same "State Locking" reliability as the enterprise tools, but we own the data.

2. The Workflow: Plan, Pause, Apply

The biggest risk in CI/CD for infrastructure is applying changes blindly. You never want a git push to instantly destroy your database. We engineered a 3-stage GitHub Actions workflow that replicates the rigorous checks of a managed platform.

Stage 1: The Plan

When a developer pushes code to the development branch, the Action spins up. It configures Terraform, authenticates with AWS, and runs a terraform plan. If there are no changes, the pipeline stops green. If there are changes, it outputs the "Diff" and proceeds to the next step.

Stage 2: The "Ticket" Gate

Here is the important part. Instead of using a third-party approval tool, we use GitHub Issues as our gatekeeper.

If the plan detects changes, the workflow pauses. It automatically creates a GitHub Issue titled "Terraform Apply Approval Required" containing the plan details.

• The Notification: The team gets alerted via email/Slack.
• The Review: A senior engineer clicks the link and reviews the Plan output directly in GitHub.

Stage 3: The Apply

The approval isn't a complex dashboard button. The senior engineer simply types "approve" in the issue comments.

The GitHub Action detects this keyword from an authorized user, automatically resumes the pipeline to run terraform apply, updates the infrastructure, and closes the ticket for us.

3. The "Secret Weapon": Private Modules

We don't keep all our Terraform code in one giant "monorepo." We treat infrastructure like software. We separate reusable components (e.g., an ECS Cluster, an RDS setup) into Private GitHub Repositories.

• Versioning: We tag our modules (e.g., v1.0.2). This ensures that if we update the "Database Module," we don't accidentally break all client projects using it. They stay on v1.0.1 until they are ready to upgrade.
• Security: Our pipeline is configured with a GH_TOKEN, securely injected from GitHub Secrets. This grants the runner temporary permission to fetch these private modules during the build without hardcoding credentials.

4. The "Emergency Mode": DevOps from the Beach

One of the unexpected benefits of this setup is Zero-Install Ops.

Imagine a critical config change is needed while you are at a dinner party or on the beach. You don't have your work laptop. You don't have VS Code. You definitely don't have the AWS CLI installed on your phone.

With this setup, you don't need them.

1. Open the GitHub repository on your phone's browser.
2. Edit the .tf file directly in the GitHub web interface.
3. Commit the change.

GitHub Actions takes over. It installs the tools, authenticates to AWS, runs the plan, creates the ticket, and waits for your approval click. You just deployed infrastructure from a smartphone, securely.

5. Cost Savings: Why pay for the runner?

Terraform Enterprise uses custom, quote-based pricing that typically starts around $15,000+ a year, depending on your infrastructure size, deployment scale, and negotiated contracts.

GitHub Actions offers 2,000 free automation minutes per month for private repositories (and it's free for public ones). Because Terraform plan and apply usually take seconds to execute, we rarely, if ever, hit the limit.

We replaced a $15,000+ a year tool with a workflow file that runs for free.

Architecture Diagram

Here is how the logic flows. Note the "Human Gate" that uses native GitHub features.

Figure 1: The GitOps Workflow. The pipeline pauses automatically if changes are detected, requiring a manual approval via GitHub Issues before touching the infrastructure.

Conclusion: Simplicity is Security

This architecture proves that you don't need expensive SaaS contracts to have "Enterprise" grade infrastructure. By using S3 for state, DynamoDB for locking, and GitHub Actions for orchestration, we built a pipeline that is:

• Secure: No local credentials needed.
• Auditable: Every change is logged in a GitHub Issue.
• Free: It runs entirely within existing quotas.

Want to automate your infrastructure?

Stop running terraform apply from your laptop. We can build you a secure, serverless pipeline that scales.

Contact us at support@sevenseven.tech or fill out our contact form.