env zero

env zero is an infrastructure as code automation platform for platform teams, adding self-service, policy guardrails and drift detection to the IaC they write.

env zero controls how infrastructure code reaches the cloud, sending every Terraform, OpenTofu, Terragrunt and Pulumi deployment through one governed workflow. EnvZero Inc. builds it, and since merging with CloudQuery in March 2026 the combined company has kept the env zero name. The gap it closes widens as code is written faster. Changes outpace human review, each team enforces its own rules, and live resources drift away from what the code declares. Older documentation and the app's address still use the earlier spelling env0. Each environment deploys a template from GitHub, GitLab, Bitbucket or Azure DevOps and keeps its own variables and roles. Plan on Pull Request posts the plan as a comment and a commit status before anything changes. Approval policies written in Open Policy Agent rego let a deployment continue, wait for a reviewer or stop. Drift Detection runs on a cron schedule against the deployed resources, and remediation redeploys the code to the cloud. The Module Registry shares versioned modules privately, Cloud Analyst adds an AI agent with dashboards, and EZ Control, an autonomous cloud control plane, is in early access. Platform engineering teams are the main users, especially in companies where many application teams ship infrastructure on their own. Developers get self-service environments from approved templates, while the platform team assigns roles at the organization, project or environment level. Security and compliance leads rely on the policy and approval steps to keep every change reviewable. Organizations already standardised on Terraform or OpenTofu, or mixing them with Terragrunt and Pulumi stacks in Python or TypeScript, fit best, because env zero deploys the code those engines already read. Most work starts in a pull request. A developer opens a change in GitHub, env zero posts the plan, and an approval policy decides whether the apply waits for a reviewer. Every deployment plan also triggers an Infracost estimate, so the cost change shows before anything is applied. On a schedule, drift checks compare AWS, Azure or Google Cloud resources with the code and flag the differences. Test environments carry a time-to-live, and their owners get an email before they are torn down. Teams inside private networks run the same workflow on self-hosted Kubernetes agents that need only outbound internet access.