env zero enables platform teams to deliver infrastructure 10x faster without losing control, with standardized, governed workflows at the speed and scale of AI.
Boston, MA
Joined November 2019
- Tweets1.2K
- Following86
- Followers1.8K
- Likes711
Hypothetical: an agent cleaning up security group rules searches the repo, finds no references to one, and deletes it. If a service someone built in the console depended on that rule, the repo had no way to say so. bit.ly/3VEXQLT
Microsoft is retiring Azure DevOps OAuth apps. env zero now connects to Azure DevOps through Microsoft Entra ID. Connections that need the switch are flagged in Organization Settings > VCS, and templates keep working after it. bit.ly/4BlCKm6
Ownership that lives in a wiki is invisible to your policy engine and to every agent you hand a credential. Put the owner on the resource at creation with default_tags, then block any change that's missing it. Same rule for people and agents.
Every drift alert is a question: is the code right, or the cloud? A tool that only detects never makes you answer it, so the alerts pile up and someone mutes the channel. Decide per resource which side wins.
Day two at DevOpsCon NYC. The env zero team is at the booth showing EZ Control: it finds the gap between the cloud you declared and the cloud you actually run, and closes it under policy. Early Access: hubs.la/Q04yKbF50
Today, we are at #DevOpsCon & AI Platform Engineering Day New York announcing the Early Access launch of EZ Control, the autonomous cloud control plane for the AI era. EZ Control closes the loop between the state an enterprise intends and the state its cloud is actually in, whether that intent is written as infrastructure code, a rule in a cloud security posture management tool, a policy-as-code repository or a guardrail set within the cloud provider itself. It detects divergence continuously, decides the correct response under policy, and executes the remediation itself.
🗞️ Read the release >> hubs.la/Q04yyhs_0
The Replit agent that deleted a production database during a code freeze wasn't compromised. Neither was the Gemini CLI run that turned a file reorg into data loss.
Both had permission to do what they did. Nobody had reviewed it.
OIDC credentials in env zero shared one audience claim across AWS, Azure, GCP and Vault, so a token minted for one was replayable against another.
v2 issues a provider-specific aud. Opt-in per credential, v1 untouched.
hubs.la/Q04xpcSR0
-auto-approve applies to terraform destroy exactly the way it applies to terraform apply.
It exists so pipelines don't wait on someone typing yes. Agents reach for it for the same reason.
hubs.la/Q04xpd4x0
Infrastructure risk models assume two actors: someone who makes a mistake, and an attacker who shouldn't have access.
An agent with a real credential, inside permissions you approved, reasoning its way to a destructive action, is neither.
🏗️ Having an amazing show at AWS Summit Tel Aviv! Come visit the env zero engineers at Booth S15 for a sneak peek at what we're building, a limited edition t-shirt, and chance to win a LEGO Star Wars Grogu.
תערוכה מדהימה בכנס AWS Summit תל אביב! בואו לבקר את מהנדסי env zero בביתן S15 לקבלת הצצה למה שאנחנו בונים, חולצת טריקו במהדורה מוגבלת והזדמנות לזכות בגרוגו של LEGO Star Wars.
#AWS #AWSSummit #AWSSummit2026 #AWSSummitTLV
Single-resource terraform import assumes you already know what to import. Most teams don't: the unmanaged resources are unmanaged because nobody knows they exist. Finding hundreds at a time, then importing them under policy: bit.ly/45J1RRf
Nobody's deployment fails in the interesting layer. It fails because a log forwarding transport threw an error, or the remote backend returned a 503 in exactly the window you needed it. Reliability work is unglamorous, and it is most of the job.
Stale SSO connections are an audit finding waiting to happen. When you migrate identity providers, the new SAML or Azure AD connection works, the old one lingers because deleting it needed a support ticket. It doesn't anymore. Delete it where you created it.
The tell that your internal platform isn't working isn't complaints. It's the Terraform in someone's personal repo, applied from a laptop, that never comes up in standup. Teams route around friction quietly. Go find where the workarounds live.
If your org outgrew 1,000 members, env zero's member list was quietly lying to you. Counts, search, and SCIM reconcile all stopped at the cap. They don't anymore: member reads now come from the membership mirror instead of the provider list API.
One of the bigger names in IaC orchestration recently published a 2,000-word comparison of their platform and env zero. We didn't ask for it, didn't review it, and didn't get a say in the framing.
Read it anyway.
If you're shortlisting IaC platforms right now, a comparison written by the other side is worth more than anything either of us puts on a landing page.
One thing it missed by a few weeks: env zero has a free tier now. 250 runs a month, 30 environments, unlimited users, no credit card.
So take the article's own advice. Stop reading comparisons, run both against your own stacks, and decide for yourselves.
#InfrastructureAsCode #PlatformEngineering #InfrastructureOrchestration #OpenTofu #Terraform
Link to article: linkedin.com/feed/update/urn…
