The governance layer for AWS, Azure and GCP.
One inventory of everything you run. Continuous drift and policy checks against your code. Fixes drafted as Terraform pull requests you review and merge. Tessera works alongside your pipeline and doesn't replace it.
Everything you'd check by hand, if you had the week.
One list of what exists
Cross-cloud inventory with owners, tags, cost and age. Search it the way you'd search code. Export it, so the spreadsheet can finally retire.
What's in code, and what isn't
Every resource is matched to its Terraform or OpenTofu state, or marked unmanaged. Coverage is tracked per account and per team, over time.
Field-level drift detection
See exactly which attribute changed, when, and who changed it, from the provider's audit trail. Then revert it or adopt it into code.
Policy-as-code that runs on live resources
CIS benchmarks out of the box, plus your own rules in Rego. Checks run on the live estate and on every pull request before it merges.
Bring click-ops into code
Generate Terraform for unmanaged resources, with imports, so the 40% nobody wrote down becomes reviewable code.
Find what you pay for and don't use
Idle instances, unattached volumes, forgotten snapshots and orphaned IPs. Each comes with its monthly cost and a one-click cleanup PR.
Deterministic checks find the problem. AI drafts the fix. You approve it.
Drift is a state diff and policy is a rule evaluation, so the same input always gives the same finding, and you can audit it. The AI does the slow part: writing the Terraform change and explaining it.
Findings are reproducible
Every finding links to the resource, the rule and the evidence. No "the model thinks".
Fixes arrive as pull requests
Tessera opens the PR, your pipeline runs plan and apply. Nothing changes in your cloud without your review.
Every action is logged
Who approved what, when, and why. You can export the log for audits.
Start read-only. Go deeper only when the findings earn it.
Connect read-only
Create a read-only role in each cloud. It takes about 15 minutes, and we publish the exact permissions.
Get the findings
A ranked report on your estate in about two days: coverage, drift, policy and waste.
Turn on continuous
Scans run on a schedule and on change events. Alerts go to Slack or Teams, and tickets go to Jira.
Gate and fix in your flow
Policy checks run on pull requests in GitHub Actions or GitLab CI. Fixes arrive as PRs.
Works with what you already run
Integrations are built for the platform team's daily flow, so Ops stays part of the routine instead of becoming a dashboard you open before audits.
Tessera vs the script stack you'd build "when there's time".
| DIY: OpenTofu + OPA + scripts | Free cloud-native tools | Tessera Ops | |
|---|---|---|---|
| Cross-cloud view | If you build and maintain it | One provider each | AWS, Azure and GCP in one inventory |
| Resources outside IaC | Hard: needs your own discovery | Partial, per provider | Found and codified into Terraform |
| Keeps up with API changes | Your weekends | Yes, but single-cloud | Maintained by us |
| Fixes | Written by hand | Console recommendations | Drafted as pull requests |
| Who owns it | One engineer, until they leave | Nobody's job | A product with support |
| Cost | Engineer time | Free | From $199/month |
Run it as SaaS, or inside your own VPC.
For larger estates and regulated teams: deploy where your data has to stay, connect your identity provider, and add compliance packs on top of the core policy set.
Enterprise plans →- Self-hosted deployment in your AWS, Azure or GCP account
- SSO / SAML and role-based access control
- Audit log export
- Bring your own encryption keys
- Compliance packs as add-ons
- Support SLA