Skip to main content

Open-source Terraform Platform

Tharsis is an enterprise scale Terraform platform that offers a complete solution for managing your Terraform deployments, state and workspaces.

CloudNative
EnterpriseScale
OpenSource
tharsis-demo.mp4
LIVE

Core Capabilities

Central control

Home Dashboard

Centralized dashboard displaying run status, workspace access, recent activity events, and team memberships. Single view for managing all your infrastructure deployments and monitoring system health.

Tharsis
๐Ÿ” Search
Workspaces
๐Ÿ”
Pprod-vpc
Sstaging-api
Ddev-db
Teams
Pplatform
Ddevops
Activity
๐Ÿš€
Run applied in prod-vpc
๐Ÿš€
Run created in staging-api
๐Ÿ“
Group dev-team created
โš™
Variable added to prod-app
๐Ÿš€
Run planned in test-infra
๐Ÿš€Get Started
Recent Runs
Ul83YmM1YWQ3
Nzk2ZTRiOWE4
MmFlNjc0YzU2
YjRkOGUyMTNh
Change preview

Plan Visualization

Visual diff of infrastructure changes with streaming logs and plan summaries. See exactly what resources will be created, updated, or destroyed with drift detection before applying changes.

Plan Changes
aws_instance.webcreate
+ ami = "ami-0c02fb55"
+ instance_type = "t3.micro"
aws_security_group.webupdate
- cidr = ["10.0.0.0/8"]
+ cidr = ["0.0.0.0/0"]
aws_s3_bucket.olddelete
- bucket = "old-assets"
RBAC & teams

Role-Based Access Control

Hierarchical permissions with inherited memberships across groups and workspaces. User, team, and service account management with viewer, deployer, and owner roles for streamlined access control.

Members
NameTypeRoleUpdatedSource
A
alice.jones
Userowner9mo agoacme
B
bob.smith
Userdeployer4d agoDirect
C
ci-runner
ServiceAccountdeployer9mo agoacme
Organization

Group Hierarchy

Organize workspaces using nested groups that model your product and environment structure. Terraform variables and permissions set at group level are inherited by all subgroups and workspaces.

Groups
O
organization
3 subgroups
P
production
2 subgroups ยท 3 workspaces
S
staging
2 workspaces
Module management

Private Registry

Built-in Terraform registry for private modules and providers with versioning, visibility controls, and attestation. Central location to store, discover, and share infrastructure patterns.

Modules
aws-vpc/aws
2.1.0 published 3mo ago by alice
private
azure-network/azure
1.3.2 published 1mo ago by bob
k8s-cluster/kubernetes
3.0.1 published 2w ago by carol
private
Provider caching

Terraform Provider Mirror

Automatic caching of Terraform providers with GPG signature verification. Reduces network latency, avoids rate limiting, and enables offline access to cached providers when upstream registries are unavailable.

terraform init
๐ŸŒUpstream
๐Ÿ”€Proxy
โšกCache
Installed hashicorp/aws v5.31.0 โœ“ verified
๐Ÿ“ด Offline ready
Simplified deployment

No-Code Deployments

Deploy Terraform modules directly from the registry without writing wrapper code. Create and manage infrastructure through UI or CLI without maintaining root Terraform configurations.

Select Source
Module
Config
VCS
Run Type
Plan
Apply
Module
acme/aws-vpc/aws ยท 2.1.0
Enterprise Scale

Managed Identities

Secure cloud authentication using OIDC without storing static credentials. AWS and Azure support with access policies and module attestation for zero-credential infrastructure management.

OIDC Federation
๐Ÿ”Tharsis
โ†’OIDC Token
โ˜๏ธAWS / Azure
โœ“ No stored credentials
M2M authentication

Service Accounts

Machine-to-machine authentication for CI/CD pipelines using OIDC tokens. Assign roles within groups or workspaces without managing static API keys or secrets.

CI/CD Authentication
โš™๏ธGitLab CI
โ†’
๐ŸŽซOIDC
โ†’
๐Ÿ—๏ธTharsis
โœ“ No secrets in pipelines
Git workflows

VCS Integration

Automatic Terraform deployments triggered by Git repository changes. GitHub and GitLab support with webhook automation to keep infrastructure in sync with your codebase.

โއfeat: add vpc moduleOpen
โœ“tharsis/planpassed
โ—‹tharsis/applywaiting
Plan: +3 ~1 -0
Flexible execution

Runner Agents

Scalable job execution with pluggable container runtimes including Docker, Kubernetes, and AWS Fargate. Deploy shared or dedicated runners within private networks for secure deployments.

Job
Job
โ†’
โš™๏ธRunner
โ†’
๐ŸณExecutor
โ†’
โ˜๏ธDeploy
Execute Terraform in your environment
Native integration

Terraform Provider

Native Terraform provider for managing Tharsis resources and consuming workspace outputs. Create and manage Tharsis infrastructure using familiar Terraform workflows and syntax.

main.tf
provider "tharsis" {
ย ย endpoint = "https://tharsis.example.com"
}
data "tharsis_workspace_outputs" "vpc" {
ย ย full_path = "acme/prod/vpc"
}

locals {
ย ย subnet_id = data.tharsis_workspace_outputs.vpc.outputs.subnet_id
ย ย vpc_id = data.tharsis_workspace_outputs.vpc.outputs.vpc_id
}
Dependency management

Workspace Dependencies

Visual dependency tracking and cross-workspace data sharing through output consumption. Understand infrastructure relationships and manage complex multi-workspace deployments.

vpc
database
secrets
โ†˜โ†’โ†—
app-prod
Share outputs across workspaces
MCP server

AI Assistant Integration

Built-in MCP server enables AI assistants like Kiro, Claude, and Cursor to manage infrastructure. Create runs, troubleshoot failures, and deploy changes through natural language with configurable access controls.

AI Assistant
โฏ Why did my run fail?
Analyzing run logs for acme/prod...
Error: InvalidAMIID.NotFound
The AMI ami-old123 doesn't exist in us-east-1.
Fix: Update aws_instance.web to ami-0abc123
โฏ Apply the fix and run plan
Updating configuration...
Running terraform plan...
โœ“ Plan succeeded: +0 ~1 -0

Simple. Secure. Scalable.

01
๐Ÿ“

Write

Create Terraform configurations with your infrastructure as code

02
๐Ÿš€

Deploy

Deploy using Tharsis CLI locally, from CI/CD pipelines, or trigger runs via VCS integration

03
๐Ÿ“ฆ

Share

Publish modules to private registries for team collaboration

Ready to Get Started?

Deploy your first Terraform module with Tharsis in minutes. Choose your preferred way to begin.