# env zero docs: Guides ## Guides ### GET STARTED - [Overview: What is env zero?](https://docs.envzero.com/index.md): env zero is the cloud infrastructure governance platform for IaC automation, self-service with guardrails, drift management, cost monitoring, and RBAC. - [Product homepage](https://docs.envzero.com/guides/admin-guide/homepage.md): Navigate the env zero homepage to review failed, drifted, or approval-pending environments and view Cloud Compass infrastructure coverage insights. #### Quick start - [Getting Started with env zero](https://docs.envzero.com/guides/getting-started/getting-started.md): Get started with env zero, an IaC platform for Terraform, OpenTofu, and Pulumi. Connect your VCS and cloud account, then deploy your first environment. - [Create your organization](https://docs.envzero.com/guides/getting-started/create-your-organization.md): Create your env zero organization during initial onboarding, set a unique org name, and gain administrator access to manage projects, templates, and users. - [Connect your Git repository](https://docs.envzero.com/guides/getting-started/connect-your-vcs.md): Connect your git repository to env zero using OAuth for GitHub.com, GitLab.com, and Bitbucket.org. SSH keys and HTTPS tokens for self-hosted providers. - [Connect your cloud account](https://docs.envzero.com/guides/getting-started/connect-your-cloud-account.md): Grant env zero permissions to manage resources in AWS, Azure, GCP, OCI, and Kubernetes using IAM roles, service principals, OIDC, or kubeconfig credentials. - [Create your first template](https://docs.envzero.com/guides/getting-started/create-your-first-template.md): Create your first env zero template by linking a VCS from GitHub, GitLab, Bitbucket, or Azure DevOps, specifying an IaC folder, and assigning it to a project. - [Deploy your first environment](https://docs.envzero.com/guides/getting-started/running-your-first-environment.md): Deploy your first IaC environment in env zero by selecting a template from your project, reviewing variables, clicking Run, and watching it deploy. #### Migrate from Terraform Cloud - [Migrate from Terraform Cloud](https://docs.envzero.com/guides/admin-guide/tfc-migration.md): Migrate Terraform Cloud or Terraform Enterprise workspaces to env zero using the in-app wizard for workspace discovery, variable migration, and state move. - [Connect and scan](https://docs.envzero.com/guides/admin-guide/tfc-migration/connect-and-scan.md): Connect your Terraform Cloud or Terraform Enterprise organization to env zero and automatically discover all workspaces, variables, and variable sets. - [Resolve issues](https://docs.envzero.com/guides/admin-guide/tfc-migration/resolve-issues.md): Review and fix any missing secrets or VCS connection gaps flagged by the migration wizard before proceeding with the Terraform Cloud migration. - [Review and migrate](https://docs.envzero.com/guides/admin-guide/tfc-migration/review-and-migrate.md): Review your selected Terraform Cloud workspaces and trigger one-click migration to create matching environments, variables, and state in env zero. - [Go live](https://docs.envzero.com/guides/admin-guide/tfc-migration/go-live.md): Complete the Terraform Cloud migration with a controlled cutover that locks TFC workspaces and activates the corresponding env zero environments. - [Troubleshooting](https://docs.envzero.com/guides/admin-guide/tfc-migration/troubleshooting.md): Fix common issues during Terraform Cloud migration, including credential errors, scan failures, state transfer problems, and drift detection. #### Plan your setup - [Plan your setup](https://docs.envzero.com/guides/getting-started/plan-your-setup.md): Understand common IaC provisioning models and VCS options before setting up env zero, so you can choose the right governance structure for your team. #### Reference - [Supported platforms](https://docs.envzero.com/guides/getting-started/supported-platforms.md): Deployment targets and IaC frameworks supported by env zero: AWS, Azure, GCP, OCI, Kubernetes, Terraform, OpenTofu, Terragrunt, Pulumi, Helm, and custom flows. - [Glossary](https://docs.envzero.com/guides/getting-started/glossary.md): Definitions of core env zero concepts: templates, environments, projects, agents, variables, configuration sets, approval policies, custom flows, and more. ### ENVIRONMENTS & DEPLOYMENTS #### Creating & managing environments - [Environment overview](https://docs.envzero.com/guides/admin-guide/environments.md): Manage IaC deployment environments in env zero - create, destroy, mark as inactive, and redeploy across Terraform, Terragrunt, CloudFormation, Pulumi, and Helm. - [Creating a new environment](https://docs.envzero.com/guides/admin-guide/environments/setting-up-a-new-environment.md): Create a new env zero environment from a template with RBAC controls or direct VCS integration for Terraform, OpenTofu, Helm, and other IaC frameworks. - [Environment access](https://docs.envzero.com/guides/admin-guide/environments/access.md): Control RBAC permissions at the environment level in env zero to grant users or teams access to specific environments using custom roles. - [Managing bulk operations](https://docs.envzero.com/guides/admin-guide/environments/bulk-operations.md): Run deploy, destroy, or other operations on multiple env zero environments simultaneously from the project environments page or organization dashboard. - [Environment Tags](https://docs.envzero.com/guides/admin-guide/environments/tags.md): Tag env zero environments with key-value pairs, then find them by tag in Explorer or the project environments list and act on them in bulk. - [Using continuous deployment](https://docs.envzero.com/guides/admin-guide/environments/continuous-deployment.md): Configure env zero environments to automatically redeploy on every push to a git branch, with options for any change or file filter pattern triggers. - [Locking environments](https://docs.envzero.com/guides/admin-guide/environments/environment-locking.md): Lock env zero environments to prevent deploy, destroy, plan, and drift detection from running, with an optional lock reason visible to project members. - [Performing targeted deployments](https://docs.envzero.com/guides/admin-guide/environments/targeted-deployments.md): Deploy specific Terraform resources or modules in env zero using targeted deployments via the UI, API, or ENV0_TERRAFORM_TARGET environment variable. - [Configure workflow triggers](https://docs.envzero.com/guides/admin-guide/environments/workflow-triggers.md): Configure chained environment deployments in env zero using workflow triggers, defining dependent environments that deploy after an upstream success. - [Additional deployment controls](https://docs.envzero.com/guides/admin-guide/additional-controls.md): Configure advanced deployment controls via environment variables at organization, project, template, or environment scope for Terraform and IaC tools. - [AI-powered summarization and error insights](https://docs.envzero.com/guides/admin-guide/environments/ai-powered-summarization-and-error-insights.md): Use AI error insights and plan/apply summarization in env zero to analyze deployment errors and highlight infrastructure changes for Terraform runs. - [Moving environments](https://docs.envzero.com/guides/admin-guide/environments/move-environment.md): Move env zero environments between projects to reorganize structures, with automatic updates to variables, policies, and state access control settings. - [Plan and apply via PR comments](https://docs.envzero.com/guides/admin-guide/environments/plan-and-apply-from-pr-comments.md): Trigger env zero plan and apply from pull request comments in GitHub, GitLab, Bitbucket, Azure DevOps, and self-hosted VCS providers. - [Running plan on pull requests](https://docs.envzero.com/guides/admin-guide/environments/plan-on-pull-request.md): Automatically run a Terraform plan on every pull request to review infrastructure changes before merging, with results posted as a PR comment. #### Workflows - [Workflow overview](https://docs.envzero.com/guides/admin-guide/workflows.md): Orchestrate multi-environment deployments with dependency management using env zero workflows, defined declaratively in env0.workflow.yaml for pipelines. - [Creating a new workflow](https://docs.envzero.com/guides/admin-guide/workflows/create-a-new-workflow.md): Create an env zero workflow using env0.workflow.yaml, covering dependency definitions, approval priority order, and multi-environment workflow setup. - [Partial workflow deployment](https://docs.envzero.com/guides/admin-guide/workflows/workflow-partial-deployment.md): Deploy or destroy subsets of an env zero workflow graph using Run From Here, single sub-environment redeploy, or single sub-environment destroy. - [Workflow file reference](https://docs.envzero.com/guides/admin-guide/workflows/workflow-file-reference.md): Complete reference for the env0.workflow.yaml file schema, covering environments, sub-environment dependencies, settings, and requiresApproval options. - [Workflow file JSON schema](https://docs.envzero.com/guides/admin-guide/workflows/workflow-file-json-schema.md): JSON Schema definition for validating and auto-completing env0.workflow.yaml files in your IDE, covering environments and sub-environment dependencies. #### Scheduling & automation - [Deployment scheduling](https://docs.envzero.com/guides/admin-guide/environments/scheduling.md): Schedule automatic deploys and destroys for env zero environments using UNIX cron expressions, with options for recurring actions and TTL interaction. - [Running ad hoc tasks](https://docs.envzero.com/guides/admin-guide/environments/ad-hoc-tasks.md): Run arbitrary bash commands on your env zero deployment container without committing to git using ad hoc tasks, with access to all environment variables. #### Environment discovery - [Environment discovery overview](https://docs.envzero.com/guides/admin-guide/environment-discovery.md): Automatically discover, import, and manage infrastructure environments in env zero for file-based creation, PR provisioning, and bulk onboarding of IaC. - [Discovery by file](https://docs.envzero.com/guides/admin-guide/environment-discovery/discovery-by-file.md): Use env0-discovery.yml marker files to create environments from existing templates, avoiding circular dependencies with the env zero Terraform Provider. - [Auto-create environments from pull requests](https://docs.envzero.com/guides/admin-guide/environment-discovery/automatic-environment-creation-from-pull-request.md): Automatically create and destroy environments from pull requests using glob pattern directory mapping and per-project discovery settings in env zero. - [Import external environments into env zero](https://docs.envzero.com/guides/admin-guide/environment-discovery/onboarding-import-external-environments-into-env-zero.md): Import and bulk-migrate Terraform or Terragrunt environments into env zero using environment discovery, with pre-filled variable keys and batch import. #### Drift detection & remediation - [Drift Detection](https://docs.envzero.com/guides/admin-guide/environments/drift-detection.md): Set up automated drift detection in env zero to identify when cloud resources diverge from IaC definitions, with cron scheduling and notification options. - [Analyze drift cause](https://docs.envzero.com/guides/admin-guide/environments/drift-detection/drift-cause.md): Identify the root cause of infrastructure drift in env zero, covering manual changes, provider version updates, and unapplied code for Terraform. - [Remediate Drift](https://docs.envzero.com/guides/admin-guide/environments/drift-detection/automatic-drift-remediation.md): Automatically or manually remediate infrastructure drift in env zero by deploying code from VCS or creating pull requests for manual cloud changes. - [Drift Actions](https://docs.envzero.com/guides/admin-guide/environments/drift-detection/drift-actions.md): Group drift root causes across environments in env zero, rank them by blast radius and age, then fix or ignore a cause everywhere at once. - [Drift detection policy](https://docs.envzero.com/guides/policies-governance/drift-detection-policy.md): Configure drift detection scheduling for env zero projects and set automatic remediation options: redeploy from VCS or create a pull request on detected drift. #### Promotion strategies - [Environment promotion strategies](https://docs.envzero.com/guides/admin-guide/environments/promotion-strategies.md): Plan how to promote infrastructure changes across environments in env zero using branch-based or folder-based strategies with automated or manual approvals. ### TEMPLATES & IaC TOOLS #### Managing templates - [Template overview](https://docs.envzero.com/guides/admin-guide/templates.md): Learn how env zero templates define reusable environment configurations for IaC, supporting Terraform, OpenTofu, Terragrunt, Pulumi, and CloudFormation. - [Managing IaC binary versions](https://docs.envzero.com/guides/admin-guide/templates/iac-binaries-versions.md): Specify and manage IaC tool versions in env zero templates for Terraform, OpenTofu, Terragrunt, Pulumi, and Ansible via environment variables. - [Using self-hosted VCS](https://docs.envzero.com/guides/admin-guide/templates/self-hosted-vcs.md): Connect self-hosted VCS providers to env zero with agent proxy support, covering GitHub Enterprise Server, Bitbucket Data Center, and GitLab. #### Version control integration - [Git and VCS integration](https://docs.envzero.com/guides/admin-guide/manage-vcs.md): Connect Git repositories and VCS to env zero - including GitHub, GitLab, Bitbucket, and Azure DevOps - for automated IaC deployments and GitOps workflows. - [Azure DevOps integration](https://docs.envzero.com/guides/admin-guide/templates/azure-devops-integration.md): Connect Azure DevOps repositories to env zero for IaC template creation, requiring Basic access level and View permissions for the organization. ##### GitHub integration - [Standard GitHub integration](https://docs.envzero.com/guides/admin-guide/templates/github-templates.md): Connect GitHub repositories to env zero using the GitHub App for template creation, deployments, and PR plans with branch or revision selection. - [GitHub Enterprise integration](https://docs.envzero.com/guides/admin-guide/templates/github-enterprise-integration.md): Integrate GitHub Enterprise Server with env zero using a self-hosted agent and a custom GitHub App for code cloning and PR plan status posting. ##### GitLab integration - [Standard GitLab integration](https://docs.envzero.com/guides/admin-guide/templates/gitlab-integration.md): Connect GitLab repositories to env zero using centralized VCS connections for template creation and deployments - [GitLab Enterprise integration](https://docs.envzero.com/guides/admin-guide/templates/gitlab-enterprise-integration.md): Integrate GitLab Enterprise with env zero using a self-hosted agent and a personal access token with read_repository and api scopes. ##### Bitbucket integration - [Standard Bitbucket integration](https://docs.envzero.com/guides/admin-guide/templates/bitbucket-integration.md): Connect Bitbucket Cloud repositories to env zero to create templates and manage deployments using the Bitbucket App for repository access. - [Bitbucket Server integration](https://docs.envzero.com/guides/admin-guide/templates/bitbucket-server-integration.md): Integrate Bitbucket Server or Data Center with env zero using a self-hosted agent and a personal access token with Repository write permissions. #### IaC ecosystem - [OpenTofu](https://docs.envzero.com/guides/admin-guide/templates/opentofu.md): Configure and deploy OpenTofu templates with env zero using the tofu binary for HCL-based infrastructure as an open-source Terraform alternative. - [Terraform](https://docs.envzero.com/guides/admin-guide/templates/terraform.md): Configure and deploy Terraform templates with env zero for infrastructure provisioning, state management, and drift detection using HashiCorp Terraform. - [Pulumi integration](https://docs.envzero.com/guides/admin-guide/templates/pulumi.md): Deploy Pulumi stacks with env zero using Python, TypeScript, Go, and .NET, with PULUMI_ACCESS_TOKEN configuration and Pulumi remote backend state. - [AWS CloudFormation integration](https://docs.envzero.com/guides/admin-guide/templates/cloudformation.md): Manage AWS CloudFormation stacks with env zero for automated provisioning, drift detection, and change set review using ENV0_CF_PARAM_ variables. - [Kubernetes (K8s) integration](https://docs.envzero.com/guides/admin-guide/templates/k8s.md): Deploy Kubernetes resources with env zero using kubectl and Kustomize for per-environment labeling, PR plan integration, and drift detection. - [Helm integration](https://docs.envzero.com/guides/admin-guide/templates/helm.md): Deploy Helm charts with env zero from Git, Helm repositories, OCI registries, or S3, with helm diff and upgrade support for private chart repos. - [Ansible integration](https://docs.envzero.com/guides/admin-guide/templates/ansible.md): Configure and deploy Ansible playbooks with env zero for automated configuration management, supporting standard Ansible versions with custom flows. - [Terragrunt integration](https://docs.envzero.com/guides/admin-guide/templates/terragrunt.md): Set up Terragrunt templates in env zero with run-all support, configurable binary selection, and module targeting for DRY infrastructure configurations. #### Open source projects - [OpenTofu project](https://docs.envzero.com/guides/community-and-resources/community-and-open-source/opentofu.md): env zero is a founding member of OpenTofu, the open-source Terraform-compatible IaC tool backed by the Linux Foundation with a large provider ecosystem. - [Terratag project](https://docs.envzero.com/guides/community-and-resources/community-and-open-source/terratag.md): Terratag is the env zero CLI tool for applying consistent tags to AWS, GCP, and Azure resources across Terraform and Terragrunt codebases automatically. #### Repository structure - [Repository structure](https://docs.envzero.com/guides/admin-guide/templates/repository-structure.md): Understand how monorepo and single-repo structures work with env zero templates, including module source patterns and self-hosted Git server requirements. #### Module & provider registries - [Private registry](https://docs.envzero.com/guides/admin-guide/private-registry.md): Host and manage private Terraform modules and providers in the env zero registry, with automated authorization during deployments and API key access. - [Providers overview](https://docs.envzero.com/guides/admin-guide/private-registry/providers.md): Publish and manage private Terraform providers in the env zero provider registry, with goreleaser version publishing and private registry authentication. ##### Modules registry - [Module overview](https://docs.envzero.com/guides/admin-guide/private-registry/modules.md): Share Terraform and OpenTofu modules with the env zero private module registry, with VCS-backed publishing, version control, and organization-wide access. - [Using modules](https://docs.envzero.com/guides/admin-guide/private-registry/modules/module-usage.md): Track module adoption in the env zero private registry with download counters and environment dependency counts to monitor module usage across your org. - [Testing modules in CI](https://docs.envzero.com/guides/admin-guide/private-registry/modules/modules-continuous-integration-testing.md): Run automated CI tests on private registry modules in env zero using OpenTofu tftest files, with per-commit and per-PR test execution support. ### PLATFORM CONFIGURATION #### Variables & secrets - [Managing variables](https://docs.envzero.com/guides/admin-guide/variables.md): Configure Terraform and shell environment variables across organization, project, template, and environment scopes in env zero for IaC deployments. - [Manage access tokens](https://docs.envzero.com/guides/admin-guide/variables/access-tokens.md): Add and manage HTTP/S access tokens for private VCS repository access in env zero, covering GitHub, GitLab, and Bitbucket app password authentication. - [Handling common errors](https://docs.envzero.com/guides/admin-guide/variables/common-errors.md): Troubleshoot common Terraform variable errors in env zero, including TF_VAR formatting for list and map types and sensitive variable configuration issues. - [Working with environment outputs](https://docs.envzero.com/guides/admin-guide/variables/environment-outputs.md): Export and share environment outputs like VPC IDs and endpoints across env zero environments as input variables for Terraform, Pulumi, and CloudFormation. - [Managing SSH keys](https://docs.envzero.com/guides/admin-guide/variables/ssh-keys.md): Add and manage SSH keys at organization and project level in env zero for secure Git repository access with GitHub, GitLab, and Bitbucket setup. - [Using variable sets](https://docs.envzero.com/guides/admin-guide/variables/variable-sets.md): Group related variables into reusable sets and assign them to organizations, projects, templates, or environments in env zero for consistent configuration. - [Managing workflow variables](https://docs.envzero.com/guides/admin-guide/variables/workflow-variables.md): Configure variables for workflow sub-environments at the template level in env zero, including output passing between stacks and self-service defaults. #### Custom flows - [Custom flows overview](https://docs.envzero.com/guides/admin-guide/custom-flows.md): Run custom commands during deployment with env0.yml custom flows, supporting bash, Python, and Ansible hooks before or after Terraform init and apply. - [Project-level custom flow](https://docs.envzero.com/guides/admin-guide/custom-flows/project-level-custom-flow.md): Configure custom flows at the project level to apply across all environments, with override or merge policies for template-level env0.yml files. - [Custom flow schema (v2)](https://docs.envzero.com/guides/admin-guide/custom-flows/version-2-schema.md): Reference for the version 2 env0.yml custom flow schema, where each configured step appears as a separate deployment step in the env zero UI with its own logs. #### State management - [Remote backend](https://docs.envzero.com/guides/admin-guide/remote-backend.md): Store and manage Terraform state with env zero remote backend, including state locking, versioning, deployment correlation, and access control. - [Using self-hosted remote state](https://docs.envzero.com/guides/admin-guide/remote-backend/self-hosted-remote-state.md): Store env zero remote backend state in your own AWS S3 bucket using the env zero Terraform module for data residency and compliance requirements. - [Authenticate locally](https://docs.envzero.com/guides/admin-guide/remote-backend/login.md): Authenticate to the env zero remote backend from your local machine using a personal API key token for local terraform login and remote plan. - [Running remote plan](https://docs.envzero.com/guides/admin-guide/remote-backend/remote-plan.md): Run terraform plan locally while executing remotely on env zero with shared state, RBAC, cost estimation, and custom flows, with auditable results. - [Running remote apply](https://docs.envzero.com/guides/admin-guide/remote-backend/remote-apply.md): Run terraform apply locally while executing remotely on env zero with shared state, variables, cost estimation, and an auditable deployment record. - [Integrate with Terraform Cloud Remote Backend](https://docs.envzero.com/guides/admin-guide/remote-backend/working-with-terraform-cloud-remote-backend.md): Use env zero with Terraform Cloud remote backend for state storage during evaluation or migration, requiring local execution mode and an API token. ##### State migration & backend configuration - [Migrating State](https://docs.envzero.com/guides/admin-guide/remote-backend/state-migration.md): Migrate Terraform state to or from env zero remote backend using terraform init -migrate-state, including migrations from TFC, S3, and other backends. - [Configuring state access control](https://docs.envzero.com/guides/admin-guide/remote-backend/state-access-control.md): Control which environments can access env zero remote state, restricting terraform_remote_state access to specific projects for secure state sharing. - [Remote state data source](https://docs.envzero.com/guides/admin-guide/remote-backend/remote-state-data-source.md): Use the terraform_remote_state data source to read outputs from env zero remote backend state, sharing VPC IDs and endpoints across Terraform stacks. #### Plugins - [Plugins overview](https://docs.envzero.com/guides/integrations/plugins.md): Use env zero plugins to extend deployments with reusable command sets in your env0.yaml custom flow, with support for OPA, Checkov, TFLint, and more. - [Using the Checkov plugin](https://docs.envzero.com/guides/integrations/plugins/checkov-plugin.md): Integrate the Checkov plugin with env zero to run IaC security scanning during deployments, requiring a target directory and optional CLI flags as inputs. - [Using the import variable plugin](https://docs.envzero.com/guides/integrations/plugins/import-variable-plugin.md): Use the Import Variable plugin in env zero custom flows to fetch outputs from other environments and inject them as Terraform or environment variables. - [Using the Lightlytics plugin](https://docs.envzero.com/guides/integrations/plugins/lightlytics-plugin.md): Run Lightlytics infrastructure simulations as a step within env zero deployments by adding the Lightlytics plugin to your env0.yaml custom flow. - [Using the OPA plugin](https://docs.envzero.com/guides/integrations/plugins/opa-plugin.md): Enforce policies in env zero deployments using the OPA plugin, which installs the opa binary and runs opa eval against a bundle path with a specified query. - [Terragrunt module detection](https://docs.envzero.com/guides/integrations/plugins/terragrunt-modules-detection.md): Detect changed Terragrunt modules in pull requests and limit PR plan execution to only the modules affected by the changes using this env zero plugin. - [Using the TFLint plugin](https://docs.envzero.com/guides/integrations/plugins/tflint-plugin.md): Integrate the TFLint plugin with env zero to analyze Terraform code for syntax errors, deprecated syntax, and best-practice violations during deployments. - [Using the TFsec plugin](https://docs.envzero.com/guides/integrations/plugins/tfsec-plugin.md): Integrate the tfsec plugin with env zero to scan Terraform code for security misconfigurations and built-in rule violations during deployment pipelines. - [Using the Trivy plugin](https://docs.envzero.com/guides/integrations/plugins/trivy-plugin.md): Integrate the Trivy plugin with env zero to run a trivy config scan on your IaC directory, detecting misconfigurations and enforcing built-in security rules. ### SELF-HOSTED AGENTS - [Troubleshooting](https://docs.envzero.com/guides/admin-guide/self-hosted-kubernetes-agent/troubleshooting.md): Troubleshoot common env zero self-hosted Kubernetes agent issues, including SIGABRT crash errors from pod memory limits and resource configuration. #### Getting started - [Self-hosted agents overview](https://docs.envzero.com/guides/admin-guide/self-hosted-kubernetes-agent/overview.md): Create and manage self-hosted agent pools, authentication secrets, and project assignments in env zero for Kubernetes and Docker agents. - [Self-hosted Kubernetes agent](https://docs.envzero.com/guides/admin-guide/self-hosted-kubernetes-agent/self-hosted-kubernetes-agent.md): Install and configure the env zero self-hosted Kubernetes agent using Helm, covering autoscaler, persistent volume setup, and upgrade procedures. - [Running a standalone Docker agent](https://docs.envzero.com/guides/admin-guide/self-hosted-kubernetes-agent/standalone-docker-agent.md): Run the env zero self-hosted agent as a standalone Docker container using docker run with an agent access token and base64 state encryption key. #### Deployment image - [Configuring deployment image](https://docs.envzero.com/guides/admin-guide/self-hosted-kubernetes-agent/deployment-image.md): Pre-installed tools and versions in the env zero deployment agent base image, built on alpine, with guidance on checking versions using ad hoc tasks. - [Extending deployment image](https://docs.envzero.com/guides/admin-guide/self-hosted-kubernetes-agent/extending-deployment-image.md): Extend the env zero deployment agent base image with custom tools and pre-installed CLIs using a Dockerfile for the self-hosted Kubernetes agent. - [Changing user ID](https://docs.envzero.com/guides/admin-guide/self-hosted-kubernetes-agent/using-a-custom-image-in-an-agent/change-user-id.md): Change the default user ID and group ID in the env zero self-hosted agent Docker image using a custom Dockerfile and Helm strictSecurityContext settings. #### Authentication - [Authenticating the agent on AWS EKS](https://docs.envzero.com/guides/admin-guide/self-hosted-kubernetes-agent/authenticating-the-agent-on-aws-eks.md): Authenticate env zero self-hosted agents on AWS EKS using Pod Identity, IRSA, or Node Roles, with credential resolution order and service account setup. - [Authenticating the agent on Azure AKS](https://docs.envzero.com/guides/admin-guide/self-hosted-kubernetes-agent/authenticating-the-agent-on-azure-aks.md): Authenticate env zero self-hosted agents on Azure AKS using workload identity and federated tokens, with azurerm provider and Helm configuration. #### Configuration - [Custom/optional configuration](https://docs.envzero.com/guides/admin-guide/self-hosted-kubernetes-agent/custom-optional-configuration.md): Helm values reference for the env zero self-hosted Kubernetes agent, covering authentication, Docker image, resource limits, and pod scheduling options. - [Using cache with PVC](https://docs.envzero.com/guides/admin-guide/self-hosted-kubernetes-agent/cache-with-pvc.md): Enable plugin caching with Persistent Volume Claims on the env zero self-hosted Kubernetes agent to reduce provider download times for Terraform runs. - [Using custom CA certificates](https://docs.envzero.com/guides/admin-guide/self-hosted-kubernetes-agent/custom-ca-certificates.md): Add custom or self-signed CA certificates to your env zero self-hosted Kubernetes agent using Kubernetes secrets and the customCertificates Helm value. - [Hosting deployment logs](https://docs.envzero.com/guides/admin-guide/self-hosted-kubernetes-agent/hosting-the-deployment-logs.md): Store env zero deployment logs in your own AWS DynamoDB table using the env zero log table Terraform module with IAM role ARN configuration. - [env zero Hosted Encrypted State](https://docs.envzero.com/guides/admin-guide/self-hosted-kubernetes-agent/env-zero-hosted-encrypted-state.md): Use env zero hosted encrypted state to avoid PVC configuration for the self-hosted Kubernetes agent, with a customer-provided base64 encryption key. #### High availability & scaling - [HA/DR strategy for self-hosted agents](https://docs.envzero.com/guides/admin-guide/self-hosted-kubernetes-agent/hadr-strategy-for-self-hosted-agents.md): Configure high availability and disaster recovery for env zero self-hosted agents using active-passive Kubernetes clusters in separate availability zones. - [Running multiple self-hosted agents](https://docs.envzero.com/guides/admin-guide/self-hosted-kubernetes-agent/multiple-self-hosted-agents.md): Run multiple self-hosted and SaaS agents in a single env zero organization with per-project assignment for isolation and security boundary separation. - [Autoscaling self-hosted agents on Azure Container Apps](https://docs.envzero.com/guides/admin-guide/self-hosted-kubernetes-agent/autoscaling-on-azure-container-apps.md): Run env zero self-hosted agents as ephemeral Azure Container Apps Jobs that scale to zero when idle and spin up on demand, using KEDA autoscaling. - [Monitoring Self-Hosted Agents](https://docs.envzero.com/guides/admin-guide/self-hosted-kubernetes-agent/self-hosted-agents-monitoring.md): Monitor the health and version of env zero self-hosted Kubernetes agents, with active, inactive, and degraded status indicators for connectivity issues. ### CLOUD MANAGEMENT #### Cloud resource management - [Cloud Compass](https://docs.envzero.com/guides/cloud-compass/cloud-compass.md): Discover and categorize unmanaged cloud resources with env zero Cloud Compass, track IaC coverage trends, assess drift risk severity, and generate IaC code. - [Configure an AWS cloud account](https://docs.envzero.com/guides/cloud-compass/cloud-compass/configure-cloud-accounts.md): Connect your AWS account to env zero Cloud Compass by granting the cloud-scanner IAM role access to your S3 CloudTrail bucket and optionally KMS decryption. - [Configure an Azure cloud account](https://docs.envzero.com/guides/cloud-compass/cloud-compass/configure-an-azure-cloud-account.md): Connect an Azure subscription to env zero Cloud Compass by exporting activity logs to Log Analytics and granting OIDC permissions with Log Analytics Reader. - [Configure a GCP cloud account](https://docs.envzero.com/guides/cloud-compass/cloud-compass/configure-a-gcp-cloud-account.md): Connect a GCP project to env zero Cloud Compass by enabling the Cloud Logging API, creating a logging.viewer service account, and configuring Workload Identity. - [Link environments to Cloud Compass](https://docs.envzero.com/guides/cloud-compass/cloud-compass/linking-environments-to-cloud-compass-resources.md): Map env zero environments to discovered cloud resources in Cloud Compass using a resource identification engine that catalogs resources after each deployment. #### Cloud insights - [Cloud Analyst](https://docs.envzero.com/guides/cloud-analyst/cloud-analyst.md): Use env zero Cloud Analyst to query deployment data with AI, build dashboards and insights, and manage environments at scale using the Explorer tab. - [AI chat interface](https://docs.envzero.com/guides/cloud-analyst/cloud-analyst/ai-chat-interface.md): Query infrastructure data using natural language with env zero Cloud Analyst AI chat, then pin results to dashboards, save as insights, or download as CSV. - [Dashboards](https://docs.envzero.com/guides/cloud-analyst/cloud-analyst/dashboards.md): Create and use Cloud Analyst dashboards in env zero by combining multiple insights into a single interactive page with predefined metrics and global filters. - [Explorer](https://docs.envzero.com/guides/cloud-analyst/cloud-analyst/explorer.md): Filter, search, and manage all environments from one centralized view with env zero Cloud Analyst Explorer, including bulk actions across multiple environments. - [Insights](https://docs.envzero.com/guides/cloud-analyst/cloud-analyst/insights.md): Create single-chart insights in env zero Cloud Analyst using predefined metrics or the chart editor with fields, filters, aggregations, and 20+ chart types. - [env zero model](https://docs.envzero.com/guides/cloud-analyst/cloud-analyst/env-zero-model.md): Explore the env zero Cloud Analyst data model covering entities including environments, deployments, state resources, cloud resources, and change events. ### GOVERNANCE & POLICIES #### Policies & safeguards - [Manage policies](https://docs.envzero.com/guides/policies-governance/policies.md): Overview of runtime and OPA-based deployment policies in env zero for governing cloud resource provisioning, enforcing best practices, and applying guardrails. - [Ready-to-use policies](https://docs.envzero.com/guides/policies-governance/ready-to-use-policies.md): Pre-configured guardrails that you can integrate into your Infrastructure as Code workflows to enforce governance, security, and compliance standards - [Enable env zero secrets](https://docs.envzero.com/guides/policies-governance/allow-env0-secrets.md): Control whether users can store sensitive data such as variables, SSH keys, and deployment credentials in env zero, using an organization-level policy. - [Force remote backend](https://docs.envzero.com/guides/policies-governance/force-remote-backend.md): Require all future Terraform environments in a project to use the env zero remote backend, making workspace name a mandatory field on environment creation. #### Approval & deployment controls - [Manage approval policies](https://docs.envzero.com/guides/policies-governance/approval-policies.md): Enforce deployment approval workflows in env zero using OPA rego policies assigned to templates or projects, evaluated after the plan and cost estimation steps. - [Enable destroy protection](https://docs.envzero.com/guides/policies-governance/destroy-protection.md): Prevent accidental destruction of environments in env zero by enabling destroy protection, which disables the Destroy button, TTL panel, and Scheduled Destroy. - [Default auto-approve](https://docs.envzero.com/guides/policies-governance/default-auto-approve.md): Configure the default plan auto-approval behavior for new environments in an env zero project, overridable per-deployment by users with the Deployer role. - [Deployment controls](https://docs.envzero.com/guides/policies-governance/deployment-controls.md): Reference for env zero deployment controls: skip apply, state refresh, redundant deployments, PR plan policies, skipped status checks, and apply mergeability. #### Environment quotas & TTL settings - [Set environment limits](https://docs.envzero.com/guides/policies-governance/environment-limits.md): Restrict the number of active environments in an env zero project by setting per-user and per-project limits in the Project Settings Policies tab. - [Configure policy TTL](https://docs.envzero.com/guides/policies-governance/policy-ttl.md): Set default and maximum TTL values for environments at organization or project level in env zero, with automated alert emails sent before scheduled destruction. #### Cost management - [Estimate costs](https://docs.envzero.com/guides/policies-governance/cost-estimation.md): Set up Infracost cost estimation in env zero to calculate cloud resource costs at plan time for Terraform, OpenTofu, and Terragrunt deployments. - [Set budget notifications](https://docs.envzero.com/guides/cost-monitoring/budget-notifications.md): Configure project budget thresholds and notifications in env zero by enabling cost monitoring, setting timeframes and amounts, and alerting on breaches. - [Set cost monitoring](https://docs.envzero.com/guides/cost-monitoring/cost-monitoring.md): Enable cloud cost monitoring in env zero using Terratag resource tagging and project-scoped credentials to view per-environment and per-project costs. ##### Cloud provider cost setup - [Configure AWS costs](https://docs.envzero.com/guides/cost-monitoring/aws-costs.md): Set up AWS cost monitoring in env zero by creating an IAM role with Cost Explorer API access, enabling cost allocation tags, and registering the Role ARN. - [Configure Azure costs](https://docs.envzero.com/guides/cost-monitoring/setup-azure-costs.md): Set up Azure cost monitoring in env zero by creating a service principal with the Cost Management Reader role via AZ CLI, then adding client ID and tenant ID. - [Configure GCP costs](https://docs.envzero.com/guides/cost-monitoring/gcp-costs.md): Set up GCP cost monitoring in env zero by exporting billing data to BigQuery, creating a service account with BigQuery Job User and Data Viewer roles. #### Code Optimizer - [Code Optimizer overview](https://docs.envzero.com/guides/policies-governance/code-optimizer/overview.md): Code Optimizer scans HCL repositories with TFLint and Checkov to detect security, quality, and compliance issues, then generates AI-powered pull request fixes. - [Setup & prerequisites](https://docs.envzero.com/guides/policies-governance/code-optimizer/setup.md): Configure Code Optimizer by connecting your VCS with the required permissions, selecting repositories, and meeting self-hosted agent version requirements. - [Scanning your code](https://docs.envzero.com/guides/policies-governance/code-optimizer/scanning.md): Trigger Code Optimizer scans to analyze HCL repositories with TFLint and Checkov, then review issues categorized by severity, scanner, and current state. - [Generating & applying fixes](https://docs.envzero.com/guides/policies-governance/code-optimizer/fixes.md): Generate AI-powered fixes for Code Optimizer issues and submit them as GitHub pull requests, then track resolution status through subsequent scans. ### ACCESS & IDENTITY #### User, role & team management - [Manage users](https://docs.envzero.com/guides/admin-guide/user-role-and-team-management/user-management.md): Add, invite, and manage users in your env zero organization with SSO via Azure Active Directory, SAML 2.0, and SCIM provisioning support. - [Manage teams](https://docs.envzero.com/guides/admin-guide/user-role-and-team-management/teams.md): Create and manage teams in env zero to group users and assign permissions at organization, project, and environment levels, with SCIM provisioning support. - [Role-based access control (RBAC)](https://docs.envzero.com/guides/admin-guide/user-role-and-team-management/rbac.md): Manage permissions with role-based access control in env zero, using default and custom roles assignable at organization, project, and environment levels. - [Default roles](https://docs.envzero.com/guides/admin-guide/user-role-and-team-management/default-roles.md): Built-in default roles at organization, project, and environment levels in env zero, including Organization Admin, Project Admin, and Project Deployer. - [Custom roles](https://docs.envzero.com/guides/admin-guide/user-role-and-team-management/custom-roles.md): Create and manage custom roles with tailored permissions in env zero, assignable at organization, project, and environment levels with deletion options. - [Assigning roles](https://docs.envzero.com/guides/admin-guide/user-role-and-team-management/role-assignment.md): Assign roles to users and teams at organization, project, and environment levels in env zero, with cascading permissions and sub-project inheritance rules. - [User API keys](https://docs.envzero.com/guides/admin-guide/user-role-and-team-management/api-keys.md): Create and manage Admin, User, and Personal API keys in env zero for REST API access, Terraform provider use, and module registry with RBAC-scoped permissions. #### Organization & project settings - [Manage organizations](https://docs.envzero.com/guides/admin-guide/organizations.md): Set up and manage organizations as the top-level entity for projects, templates, variables, and policies in env zero, including SSO configuration. - [Manage projects](https://docs.envzero.com/guides/admin-guide/projects.md): Organize environments with projects in env zero for access control, multi-cloud account management, and separation of dev, staging, and production. - [Manage sub-projects](https://docs.envzero.com/guides/admin-guide/projects/sub-projects.md): Create and manage sub-projects to organize environments, templates, and variables hierarchically in env zero, with per-level RBAC role assignments. #### SSO & identity - [Self-service SSO integration](https://docs.envzero.com/guides/sso-integrations/self-service-sso.md): Configure enterprise SSO from the env zero interface using SAML 2.0 or Azure Active Directory without support requests, plus optional SCIM 2.0 provisioning. - [Self-service SAML setup](https://docs.envzero.com/guides/sso-integrations/self-service-saml.md): Self-service SAML 2.0 configuration for env zero covering the ACS URL, entity ID, required attribute mappings, and team syncing via groups or teams attributes. - [Sync roles & groups from your IdP](https://docs.envzero.com/guides/sso-integrations/importing-roles-or-groups-from-your-identity-provider.md): Sync IdP groups to env zero teams at login via SAML group attributes, enabling automated team membership, RBAC role assignment, and admin role promotion. ##### SCIM provisioning - [SCIM provisioning](https://docs.envzero.com/guides/sso-integrations/scim-provisioning.md): Sync users and groups from your identity provider to env zero with SCIM 2.0, covering provisioning modes, group to team mapping, token rotation, and reconcile. - [SCIM provisioning with Okta](https://docs.envzero.com/guides/sso-integrations/scim-provisioning-okta.md): Configure the Okta SCIM connector for env zero, push Okta groups to env zero teams, and recover a group push mapping that Okta has moved into Error state. - [SCIM provisioning with Entra ID](https://docs.envzero.com/guides/sso-integrations/scim-provisioning-entra-id.md): Configure Microsoft Entra ID (Azure AD) automatic provisioning for env zero over SCIM 2.0: tenant URL, assignment scope, groups, and attribute mappings. ##### Identity provider guides - [Azure Active Directory integration](https://docs.envzero.com/guides/sso-integrations/self-service-azure-ad.md): Configure Microsoft Entra ID or Azure AD as an OAuth provider for env zero SSO with Redirect URI setup, client secret, group-based team syncing, and SCIM 2.0. - [AWS Single Sign-On integration](https://docs.envzero.com/guides/sso-integrations/aws-single-sign-on.md): Configure AWS SSO as a SAML 2.0 provider for env zero by creating a custom SAML app in IAM Identity Center, mapping user attributes, and completing the form. - [Google Workspace integration](https://docs.envzero.com/guides/sso-integrations/google-workspace.md): Set up Google Workspace as a SAML provider for env zero SSO by creating a custom SAML app, mapping user attributes and groups, and configuring the ACS URL. - [JumpCloud integration](https://docs.envzero.com/guides/sso-integrations/jumpcloud.md): Integrate JumpCloud as a SAML 2.0 identity provider for env zero using a custom SAML app with the ACS URL, entity ID, attribute mappings, and group sync. - [Keycloak integration](https://docs.envzero.com/guides/sso-integrations/keycloak.md): Configure Keycloak as a SAML identity provider for env zero by creating a SAML client with the correct entity ID, ACS URL, attribute mappers, and group mapper. - [Okta integration](https://docs.envzero.com/guides/sso-integrations/okta-integration.md): Set up Okta as a SAML 2.0 provider for env zero with attribute mappings, assertion encryption, group attribute statements for team sync, and SCIM provisioning. - [OneLogin integration](https://docs.envzero.com/guides/sso-integrations/onelogin.md): Integrate OneLogin as a SAML 2.0 identity provider for env zero using a custom SAML connector with the correct ACS URL, entity ID, attribute mappings, and cert. - [VMware Workspace ONE integration](https://docs.envzero.com/guides/sso-integrations/vmware-workspace-one.md): Set up VMware Workspace ONE as a SAML 2.0 identity provider for env zero using Workspace ONE Access with the correct ACS URL, entity ID, and attribute mappings. - [Other SAML providers](https://docs.envzero.com/guides/sso-integrations/additional-saml-providers.md): Connect any SAML-compatible identity provider to env zero for SSO. All SAML 2.0 providers are supported via self-service configuration or by contacting support. #### OIDC integrations - [General OIDC integrations](https://docs.envzero.com/guides/integrations/oidc-integrations.md): Configure OpenID Connect (OIDC) in env zero to issue short-lived JWT tokens for authenticating with AWS, Azure, GCP, and HashiCorp Vault. - [Retrieve OIDC subject identifier](https://docs.envzero.com/guides/integrations/oidc-integrations/oidc-retrieving-your-subject-identifier.md): Retrieve your env zero OIDC subject identifier using the credential form, organization settings UI, a Run Task script, or a decode template. - [OIDC for AWS](https://docs.envzero.com/guides/integrations/oidc-integrations/oidc-with-aws.md): Connect env zero to AWS using OIDC by creating an IAM Identity Provider, assigning an IAM role, and adding a sub claim condition to the trust policy. - [OIDC for Azure](https://docs.envzero.com/guides/integrations/oidc-integrations/oidc-with-azure.md): Connect env zero to Azure using OIDC by registering an Azure AD App, configuring a Federated Credential, and assigning the app a Contributor role. - [OIDC for GCP](https://docs.envzero.com/guides/integrations/oidc-integrations/oidc-with-google-cloud-platform.md): Connect env zero to GCP using OIDC by creating a Workload Identity Federation pool and provider, then granting access to a GCP Service Account. - [OIDC for Vault](https://docs.envzero.com/guides/integrations/oidc-integrations/oidc-with-vault.md): Connect env zero to HashiCorp Vault using OIDC by enabling the JWT Authentication method, configuring a KV secrets store, and creating an access policy. #### Auditing & transparency - [Monitoring dashboards](https://docs.envzero.com/guides/admin-guide/dashboards.md): Monitor organization activity with summary and activity dashboards showing environment status, deployment counts, top deploying users, and trends. ##### Forwarding logs - [Logs forwarding overview](https://docs.envzero.com/guides/integrations/logs-forwarding.md): Forward deployment and audit logs from env zero to external observability platforms including Datadog, New Relic, CloudWatch, and Splunk. - [Amazon CloudWatch](https://docs.envzero.com/guides/integrations/logs-forwarding/cloudwatch.md): Forward env zero deployment and audit logs to AWS CloudWatch log groups via OIDC authentication and an IAM policy with log write permissions. - [Amazon S3 logs](https://docs.envzero.com/guides/integrations/logs-forwarding/s3.md): Forward env zero deployment and audit logs to Amazon S3 using OIDC authentication and an IAM policy that grants PutObject access to the target bucket. - [Coralogix logs](https://docs.envzero.com/guides/integrations/logs-forwarding/coralogix.md): Send env zero deployment and audit logs to Coralogix using a Send-Your-Data API key and cluster URL, configured via the UI or environment variables. - [Datadog logs](https://docs.envzero.com/guides/integrations/logs-forwarding/datadog.md): Forward env zero deployment and audit logs to Datadog using an API key and TCP over TLS endpoint, with separate service tags for audits and deployments. - [Dynatrace logs](https://docs.envzero.com/guides/integrations/logs-forwarding/dynatrace.md): Forward env zero deployment and audit logs to Dynatrace using an API token with Ingest Logs scope, configured via environment variables on any scope. - [Google Cloud Logging](https://docs.envzero.com/guides/integrations/logs-forwarding/gcp-logging.md): Send env zero deployment and audit logs to Google Cloud Logging using a Logs Writer service account credential, configured via UI or environment variables. - [Grafana Loki logs](https://docs.envzero.com/guides/integrations/logs-forwarding/grafana-loki.md): Forward env zero deployment and audit logs to Grafana Loki using a host URL and Access Policy token, supporting both Grafana Cloud and self-hosted Loki. - [Logz.io logs](https://docs.envzero.com/guides/integrations/logs-forwarding/logzio.md): Send env zero deployment and audit logs to Logz.io using a data shipping token and listener URL, configurable via the UI or environment variables. - [New Relic logs](https://docs.envzero.com/guides/integrations/logs-forwarding/new-relic.md): Forward env zero deployment and audit logs to New Relic via the Log API, using a License Key and a region-specific endpoint for US, EU, or FedRAMP. - [Splunk logs](https://docs.envzero.com/guides/integrations/logs-forwarding/splunk.md): Send env zero deployment and audit logs to Splunk via the HTTP Event Collector, using separate indexes for deployment and audit log streams. - [Sumo Logic logs](https://docs.envzero.com/guides/integrations/logs-forwarding/sumologic.md): Forward env zero deployment and audit logs to Sumo Logic by configuring an HTTP Source and providing the generated collector URL as an environment variable. ### SECURITY & COMPLIANCE - [Security overview](https://docs.envzero.com/guides/overview/security-overview.md): env zero security practices: SOC 2 Type II attestation, AWS-hosted infrastructure, HTTPS encryption, sandboxed deployment containers, and self-hosted agents. - [View audit logs](https://docs.envzero.com/guides/admin-guide/audit-logs.md): Track user activity with audit logs in env zero, covering environments, templates, teams, users, roles, and cloud credentials. Enterprise plan only. - [IP addresses](https://docs.envzero.com/guides/overview/security-overview/ip-addresses.md): env zero IP addresses across us-east-1 and us-west-2 for allowlisting in VCS providers and cloud resources, with a Terraform provider for dynamic IP lookups. ### INTEGRATIONS & DEVELOPER TOOLS #### Notifications - [Manage notifications](https://docs.envzero.com/guides/integrations/notifications.md): Configure env zero deployment notifications by creating Notification Targets for Slack, Email, Teams, and webhooks, then associating them with projects. - [Slack integrations](https://docs.envzero.com/guides/integrations/notifications/slack.md): Connect env zero to Slack for deployment notifications by installing the Incoming Webhooks app and configuring the webhook URL in Notification Targets. - [Microsoft Teams integration](https://docs.envzero.com/guides/integrations/notifications/microsoft-teams.md): Integrate env zero with Microsoft Teams by creating a Workflow App webhook flow to post deployment notifications to your chosen channel. - [Email notifications](https://docs.envzero.com/guides/integrations/notifications/email.md): Set up email notifications in env zero to deliver deployment events to comma-separated addresses, the environment creator, or the deployer. - [Webhook notifications](https://docs.envzero.com/guides/integrations/notifications/webhooks.md): Set up webhook notifications in env zero to POST deployment event payloads to an HTTPS endpoint, with optional HMAC signature validation for security. #### Internal developer platforms - [Platform overview](https://docs.envzero.com/guides/integrations/internal-developer-platforms.md): Integrate env zero with internal developer platforms, including Backstage, to give developers self-service access to IaC environments. - [Backstage integration](https://docs.envzero.com/guides/integrations/internal-developer-platforms/backstage.md): Set up the env zero Backstage plugin to give developers self-service IaC environment creation and management from within the Backstage catalog. #### CLI & API access - [env zero CLI Tool](https://docs.envzero.com/guides/community-and-resources/support-and-help/env-zero-cli.md): Install the env zero CLI to deploy, inspect, and manage environments from your terminal or CI, with JSON output and stable exit codes for scripts. ### BILLING & SUPPORT - [Purchase options](https://docs.envzero.com/guides/billing/purchase-options.md): Purchase env zero via direct Stripe invoicing or private marketplace offers on AWS, Azure, and Google Cloud to consolidate spend with cloud billing. - [Subscription tiers](https://docs.envzero.com/guides/billing/subscription-tiers.md): Compare env zero plans, the Free plan, Cloud Navigator, and Cloud Pilot, by monthly runs, environments, drift management, features, and support. - [Managing your subscription](https://docs.envzero.com/guides/billing/managing-your-subscription.md): How to upgrade, switch, or cancel your env zero subscription, including billing cycle details, Stripe invoicing, and marketplace customer invoice access. - [Support](https://docs.envzero.com/guides/community-and-resources/support-and-help/support.md): env zero support tiers - Silver, Gold, and Platinum SLAs with first-response times from best effort to 1 hour for critical issues, plus 99.9% uptime guarantees.