How do you know the module a run deploys is the one you trust, and not a tampered copy?
Modules get shared and reused, and along the way one can be swapped or changed, a supply chain attack that is easy to miss. A Module Attestation policy guards against this: it checks that the module a run deploys is signed by a key you trust, so a swapped or changed copy does not go unnoticed. Here is what it checks, with the steps to set one up.
What if you could write your own rule once and have Tharsis check it on every run?
An OPA policy runs a rule you write against a run, and the rule content decides whether the run passes. Here is what OPA policies can do, with one worked example you can copy end to end.
We've made significant improvements to the Tharsis documentation. Here's what's new.
The Tharsis CLI has been refactored to communicate directly with the Tharsis API via gRPC, replacing the previous SDK-based architecture. This post covers what changed, why, and what it means for users.
What if managing your Terraform infrastructure was as simple as having a conversation?
Tharsis now includes a built-in Model Context Protocol (MCP) server, enabling AI assistants to manage your infrastructure through natural language.
Tharsis now has support for ephemeral variables, a powerful new feature that enhances security by preventing sensitive data from being stored in Terraform plan and state files.
We are excited to announce a new open-source Terraform platform called Tharsis! Tharsis is a free open-source project that offers an alternative to using the HashiCorp Terraform Cloud Platform (HCP). It's an enterprise-scale Terraform platform that offers a complete solution for managing your Terraform deployments, state, and workspaces. Tharsis is licensed under the MPL license and can be used for free on your machine or can be deployed to your own cloud infrastructure so that your entire team can benefit from using it.