Proof-gated, Terragrunt-style
orchestration for Terraform & OpenTofu.
The orchestrator that refuses to run the unproven.
Vizier wraps Terraform & OpenTofu with DRY, dependency-ordered runs - then reads every module’s proof in the Bazaar catalog first. Unsigned or below your bar? It never applies.
Availability - v0.1.0
Built for Linux, macOS and Windows (amd64 and arm64). The binaries are not publicly downloadable yet - Vizier lives in the Bazaar's private repository, so there is no working go install path either. Want a build? Get in touch.
117 live-tested modules Vizier will run, enforce-gated by default.
Why Vizier
Terragrunt runs any module.
Vizier runs only proven ones.
Terragrunt and native Stacks orchestrate whatever you point them at. Vizier is the only orchestrator backed by a verified catalog - so it can fail closed on infrastructure that is not signed and live-tested. That is the one axis a generic wrapper structurally cannot copy.
Proof-gate
Every module source is resolved against the verified catalog. Anything unsigned, or below your status floor, is blocked before a single resource is planned.
Fail-closed
In enforce mode an unreachable catalog or a missing proof blocks the run. Vizier never applies on doubt - the gate stays shut.
vizier.lock
Verified proofs are pinned to a lockfile, so re-verification is reproducible and works air-gapped after the first online resolve.
Vizier vs Terragrunt
An honest comparison
Looking for a Terragrunt alternative? Straight answer: Terragrunt is the mature, general-purpose tool for DRY configuration and orchestration, and Vizier is younger and narrower in scope. Vizier exists for the one job Terragrunt does not do - putting a fail-closed verification gate, backed by the IaC Bazaar catalog, in front of every apply.
| Dimension | Terragrunt | Vizier |
|---|---|---|
| Maturity & community | Years of production use, a large community, and a deep feature surface (hooks, scaffolding, engine options). | Young (v0.1.x) and deliberately narrow: one binary, a small command set, far fewer battle scars. |
| DRY configuration | Rich include/inheritance with an expressive built-in function library. | Terragrunt-shaped: one vizier.hcl per unit, include + find_in_parent_folders() for shared config - a narrower function set. |
| Orchestration | run-all across the dependency graph, threading outputs between units. | The same shape: DAG-ordered run-all that threads outputs to dependents (sequential runs). |
| Verification gate | None built in - it orchestrates whatever source you point it at. | The differentiator: a fail-closed verify {} gate that checks each module’s signature and verification status against the IaC Bazaar catalog before any apply, pinned in vizier.lock. |
| Module sources | Any Terraform source: registries, git, local paths. | iacbazaar:// catalog modules; anything else is blocked unless explicitly allow-listed. |
If you need a battle-tested orchestrator with the broadest feature set, pick Terragrunt - we say so. Pick Vizier when the property you care about most is that a run fails closed unless every module is signed and verified.
Watch it block.
The gate runs for every unit before a single apply. A module below your bar stops the run with a precise reason - which unit, which module, why - and a non-zero exit.
Describe · Verify · Apply
Three verbs, one proof-gate
Describe the unit
One vizier.hcl per unit: an iacbazaar:// module source, its inputs, dependencies, and a verify {} policy.
vizier verify
Read each unit’s proof against the catalog and report ok or blocked - no tofu runs, no cloud touched.
vizier run-all apply
Gate every unit first, then apply in dependency order, threading outputs to dependents. Blocked means blocked.
Run these, verified
Point Vizier at any live-tested module in the Bazaar.
Akamai Network Lists
Versioned IP and geo block/allow lists with activation, ready to feed WAF policies and property rules.
Akamai Edge DNS Zone
Authoritative Edge DNS zone with full recordset management on Akamai's DDoS-resilient anycast network.
Cloud Storage Bucket
Hardened GCS bucket with uniform access, versioning, lifecycle/soft-delete policies, CMEK and least-privilege IAM.
Cloud DNS Zones & Records
Public/private managed zones with record sets, DNSSEC, forwarding and peering configs.
Azure Public DNS Zone & Records
An Azure public DNS zone plus a map-driven set of record sets - A, AAAA, CNAME, TXT, MX, NS, CAA and SRV - with relative naming, verbatim TXT values, and apex footgun guards.
AWS S3 Bucket (hardened)
Private S3 bucket with encryption, versioning, public-access block, and TLS-only policy.
Orchestrate what you can prove.
One binary, no runtime dependencies beyond a tofu on your PATH. Point it at a tree of verified modules and the gatekeeper does the rest.
Availability - v0.1.0
Built for Linux, macOS and Windows (amd64 and arm64). The binaries are not publicly downloadable yet - Vizier lives in the Bazaar's private repository, so there is no working go install path either. Want a build? Get in touch.