Join waitlist
Waitlist openNow in early access

Describe infra. Ship your Terraform.

Describe it or draw it on a canvas. Get production Terraform that follows your team's modules, naming and guardrails.

You're on the list. Check your inbox.

We only use your email to contact you about early access. No spam, unsubscribe anytime.

Watch how it works
128 engineers on the list Built for AWS · Terraform · OpenTofu Real terraform plan · zero lock-in

Real Terraform.
Yours. Not generic.

Weftly reads your repo, learns your modules and writes HCL that looks like your senior engineer wrote it, ready for you to review and ship.

AWSMulti-account AWS
TTerraform 1.x
OTOpenTofu
GHGitHub Actions
OIOIDC-gated apply
Canvas

A diagram you can actually trust.

Drag nodes or describe what you want. Weftly keeps the architecture, the Terraform graph and the plan in lock-step. The diagram is the source of truth, not a drawing in a wiki that drifted six months ago.

  • Resolves against your real module library, in real time
  • Live cost estimate as you wire
  • Re-render the canvas from any commit, past or future
checkout-service · canvas
14 rules · live plan
Internet
Edge
VPC · prod-eu-west-1
Public
ALB · checkout-alb
Load Balancer
NAT Gateway
VPC
Private
ECS · checkout-api
Containers
RDS · checkout-db
PostgreSQL
Trust layer

Guardrails that see the move before HCL exists.

Naming, tagging, module versions, topology. Every change runs through your conventions in plain language, in the same panel you're drafting in. An RDS instance trying to talk to the internet is blocked before the Terraform file is even written.

  • Convention pack extracted from your repo (not hand-written rules)
  • Topology guardrails: RDS → internet, untagged buckets, public IAM
  • Per-tier budget caps and module-version pins
✓ OK Naming follows acme-aws-v34 / 4 resources +0.4s
✓ OK Modules pinned to approved registryterraform-aws-modules · 5.x 3 modules
! Warn RDS class db.r6g.large exceeds dev budget$118/mo · approve? budget-tier-dev
✕ Blocked RDS checkout-db-prod cannot route to 0.0.0.0/0topology-guardrail-07 prevented
✓ OK Required tags appliedenv · owner · cost-center · slo all 4
Ship it your way

Lands where you already work.

No opaque apply, no SaaS-locked state. Weftly runs a real terraform plan against your account, then hands you the change as a reviewable pull request, or applies it through your own OIDC-gated CI. You stay in control of how it ships.

  • Reviewable PR with the diagram, plan diff and a plain-language summary
  • Or apply through your existing OIDC-gated pipeline
  • State stays where it already lives (S3, Spacelift, TFC)
feat(checkout): provision checkout service in eu-west-1 #1284
canvas opened 4m ago by @daniel +128 / −0
We
Weftly bot · trust-layer summary
What this PR does: provisions a checkout service (ALB → ECS → RDS) following acme-aws-v3. 4 resources, 1 module reuse. 1 guardrail enforced (RDS internet egress blocked). Estimated cost: $214/mo.
The problem

AI writes infra. Your standards don't survive.

Generic agents produce plausible HCL that ignores your modules, naming and topology rules. Worse: you can't see what they're about to do until it's already in your account.
01 · STANDARDS

AI writes infra that ignores your standards.

Generic HCL. Wrong naming. Unapproved modules. Tags drift from the company schema on day one.

# generated by a generic agent resource "aws_db_instance" "prod-db-1" { instance_class = "db.m5.large" engine = "postgres" publicly_accessible = true tags = { Env = "prod" } }
02 · OPACITY

You can't see what the agent is about to do.

Opaque tool calls. Then terraform destroy wipes the wrong account.

tool: aws_db_instance.delete
tool: aws_s3_bucket.delete
tool: aws_vpc.delete
→ executing on prod-285…
03 · TRUST GAP

84% use AI. Only 29% trust the output.

Reviewing AI-generated infra is now a job. Your team always pays the bill.

84%
use AI at work
29%
trust the output
SO Developer Survey 2025
Why Weftly

Not "Cursor for infra." A canvas that knows your conventions.

Four things that make Weftly different from generic IaC chatbots and Terraform-as-a-service tools.

Convention-aware codegen.

Reads your repo, extracts modules, naming, tagging. Generates HCL that looks like your team wrote it.

acme-aws-v3 · 14 rules

Diagram is the truth.

See the architecture before any HCL exists. Re-render the canvas from your Terraform graph after every merge.

live · bidirectional

Reviewable HCL, not opaque apply.

Output is a pull request your team merges. Version control, blast-radius review, revertable history.

git-native · OIDC apply

Topology guardrails.

Block the move before it becomes a Slack incident. RDS to internet? Blocked. Live, on the canvas.

7 default · custom packs
WaitlistOpen · early access

Stop shipping
generic HCL.

Drop your email. We'll be in touch when there's a spot.

What do you use today?
You're on the list. We'll be in touch within 48 hours.

No spam, unsubscribe anytime. We only store your email to contact you about early access. 128 engineers already joined.