The reviewed plan is the applied plan.
Approval stays tied to the saved plan and source commit—not a fresh calculation at apply time.
Argus Deploy / Terraform + OpenTofu automation
Infrastructure done right!
Review a Terraform or OpenTofu plan, approve the exact changes, and apply that same saved plan with ephemeral workers inside your AWS accounts. No call home to _fromTheCode during normal runs. Plans, credentials, and audit evidence stay in your AWS accounts.
- Product
- Argus Deploy
- Runtime
- Terraform + Tofu
- Execution
- Your AWS
account / 8828••••7356
us-west-1
network
SAVED PLAN
APPROVED
network / production
Plan ID01JDP7C4Q9A
Commit8de04bf
EngineOpenTofu 1.12.6
ApplyExact binary
aws_s3_bucket.audit_archive
Creates a versioned, encrypted archive in the customer account.
aws_security_group.service_ingress
Updates one inbound rule. No resource replacement required.
The code is the contract. Control stays with you.
Infrastructure automation should make code real without making control disappear. Argus Deploy keeps the plan, credentials, state, execution, and evidence inside the AWS accounts your team already owns.
Your infrastructure stays yours.
Execution, credentials, state, artifacts, and audit history remain in the AWS accounts your team already controls.
02 / WORKFLOW
From the code to exact apply.
Routine environments move automatically. Protected environments pause on the exact artifact your team reviews, then continue when your team is ready.
22:14:03.044 event.accepted merge
22:14:03.118 config.pinned pipeline.json@v18
22:14:03.209 queue.created dev/us-west-1/network
22:14:03.216 queue.created dev/us-west-2/network
22:14:03.480 worker.requested accepted
› six coordinates queued; orchestrator exiting cleanly
03 / ARCHITECTURE
Built from code. Runs in your cloud.
The control plane, execution plane, artifacts, state, credentials, and audit history remain in accounts you own.
CUSTOMER AWS ORGANIZATIONOWNED + OPERATED BY YOU
PRIMARY ACCOUNTCONTROL PLANE
Argus Deploy dashboardStateless · private ingress
S3 / KMSplans + audit
Orchestratorevent driven
WORKLOAD ACCOUNTSEXECUTION PLANE
US-WEST-1ephemeral worker0 running at rest
US-WEST-2ephemeral worker0 running at rest
AP-SOUTHEAST-4ephemeral worker0 running at rest
IAM boundariesRegional stateCloudWatch logsECR cache
GitHubtrigger + source
Only required external runtime connection
No vendor connectionzero runtime data path
04 / CONTROLS
Infrastructure done right means:
Approve the artifact.
Apply that artifact.
The saved plan, its source revision, and review evidence stay linked. Apply executes the plan reviewers approved.
ACCOUNT BOUNDARYENFORCED
Least privilege by coordinate.
Workers receive access only to their account, environment, region, and state prefix.
STATE TRANSITIONATOMIC
Approval races fail closed.
Conditional writes decide Cancel versus Apply with no ambiguous in-between state.
Every action leaves evidence.
Plan, actor, timestamp, status transition, apply output, and exact SHA stay in your encrypted storage.
21:42:08Pendingrunner:task/4fd2
21:48:31Approvedreviewer@company.com
22:00:04Applyingschedule:prod-window
22:02:19Appliedsha 8de04bf
_fromTheCode / ARGUS DEPLOY / PRIVATE PILOT
Your infrastructure.
Your infrastructure.
From your code.
Under your control.
Your next environment will start from the code—and stay under your control.
or write to maxim@fromthecode.com