In Active Development

Self-service Azure IaC,
built for platform teams.

Basilect gives platform teams an opinionated, end-to-end framework for self-service Azure infrastructure. Product teams write a CDKTF stack in any of five languages — the platform owns everything beneath: Terraform modules, CI/CD pipelines, OPA policies, Azure Policy governance, state backends, and service principals.

Multi-language constructs

Python, TypeScript, C#, Java, and Go. Product teams pick their language; the platform team maintains one set of modules.

Layered enforcement

OPA policies gate every plan. Azure Policy enforces at the ARM level. Management locks protect stateful resources.

Zero static credentials

All authentication uses OIDC workload identity federation. No secrets stored in CI.

View Documentation Request Early Access

Basilect is currently in development. Source code access is available by request — email karczag.ashley@gmail.com.

Request Early Access

Basilect is currently in active development.

The platform may not behave as expected in all scenarios. APIs, constructs, and pipeline behaviour are subject to change without notice as the project matures.

Basilect is completely free to set up and use in testing environments. There are no license fees, usage limits, or commercial restrictions during the development phase.

To request access to the source code, email:

karczag.ashley@gmail.com

Looking for contributors

Basilect is actively looking for contributors. If you have experience with any of the following, we'd love to hear from you:

Terraform module development and testing
CDKTF / construct library development in any of the five supported languages
GitHub Actions reusable workflows
OPA / Rego policy authoring
Azure platform engineering and governance
Documentation and developer experience

Include a brief description of your background and what areas interest you when you email. All skill levels are welcome.

View Documentation

Loading documentation...

See it in action

Developer writes a stack

A product team developer installs the construct library and writes infrastructure as code in their language of choice. No HCL required.

main.py

from basilect_infra import BaseAzureStack
from basilect_infra.constructs import (
    NetworkConstruct, DatabaseConstruct, SubnetConfig
)

class PortalStack(BaseAzureStack):
    def __init__(self, scope, id):
        super().__init__(scope, id,
            project="portal",
            environment="dev",
            location="eastus",
        )

        net = NetworkConstruct(self, "network",
            project="portal",
            environment="dev",
            resource_group="portal-dev-rg",
            location="eastus",
            address_space=["10.0.0.0/16"],
            subnets={"app": SubnetConfig("10.0.1.0/24")},
        )

        DatabaseConstruct(self, "db",
            project="portal",
            environment="dev",
            resource_group="portal-dev-rg",
            location="eastus",
            subnet_id=net.subnet_ids["app"],
            dns_zone_id=net.dns_zone_ids["postgres"],
            admin_password=os.environ["DB_PASSWORD"],
        )

PR triggers validation

The developer opens a pull request. The reusable workflow pipeline kicks in automatically — formatting, validation, and change detection.

.github/workflows/infra.yml

name: Infrastructure
on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  validate:
    uses: basilect/reusable-workflows/.github/workflows/tf-validate.yml@v1.4.0

  changes:
    if: github.event_name == 'pull_request'
    uses: basilect/reusable-workflows/.github/workflows/tf-changes.yml@v1.4.0

  plan:
    needs: [validate, changes]
    if: github.event_name == 'pull_request'
    uses: basilect/reusable-workflows/.github/workflows/tf-plan.yml@v1.4.0
    with:
      environments: ${{ needs.changes.outputs.affected }}

OPA policies gate the plan

Every terraform plan is evaluated against the full OPA policy suite. Public resources, unauthorized network changes, missing tags — all blocked before apply.

policy/deny_public_resources.rego

package basilect.deny

import rego.v1

deny contains msg if {
    some resource in input.resource_changes
    resource.change.after.public_network_access_enabled == true
    msg := sprintf(
        "Resource '%s' enables public network access. "
        "All resources must use private endpoints.",
        [resource.address]
    )
}

deny contains msg if {
    some resource in input.resource_changes
    resource.type == "azurerm_public_ip"
    msg := sprintf(
        "Resource '%s' creates a public IP. "
        "Public IPs are not allowed in any environment.",
        [resource.address]
    )
}

# ✓ Plan passed — 0 violations

Plan posted to the PR

The pipeline comments the full plan diff and policy results directly on the pull request. Reviewers see exactly what will change before approving.

PR comment

Basilect Plan — portal / dev

Terraform will perform the following actions:

  # module.network.azurerm_virtual_network.this
  + resource "azurerm_virtual_network" "this" {
      + name                = "portal-dev-vnet"
      + address_space       = ["10.0.0.0/16"]
      + location            = "eastus"
      + resource_group_name = "portal-dev-rg"
      + tags = {
          + "managed_by"  = "terraform"
          + "project"     = "portal"
          + "environment" = "dev"
        }
    }

  # module.db.azurerm_postgresql_flexible_server.this
  + resource "azurerm_postgresql_flexible_server" "this" {
      + name    = "portal-dev-psql"
      + sku     = "GP_Standard_D2s_v3"
      + version = "15"
    }

Plan: 6 to add, 0 to change, 0 to destroy.
OPA: ✓ All policies passed (6 rules evaluated)

Merge triggers deploy

After approval, the PR is merged. The deploy pipeline applies changes environment by environment — dev and QA automatically, stage and prod with platform team approval.

deploy pipeline

Basilect Deploy — portal

━━━ dev ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  ✓ terraform plan    6 to add
  ✓ OPA policy check  passed
  ✓ terraform apply   6 added, 0 changed
  ✓ artifact saved    plan-portal-dev-a3f8c21

━━━ qa ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  ✓ terraform plan    6 to add
  ✓ OPA policy check  passed
  ✓ terraform apply   6 added, 0 changed

━━━ stage ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  ⏳ waiting for approval ...
     environment: stage
     required reviewer: @platform-infra
     wait timer: 10 minutes

━━━ prod ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  ○ blocked by: stage

Resources protected in Azure

Once applied, Azure Policy enforces constraints at the ARM API level and management locks prevent accidental deletion. Drift detection runs daily.

Azure portal

Resource Group: portal-dev-rg
Location:       East US

┌─────────────────────────────────────────────┐
│ Resources                                   │
├─────────────────────────────────────────────┤
│ ✓ portal-dev-vnet          Virtual Network  │
│ ✓ portal-dev-app-nsg       Network Security │
│ ✓ portal-dev-app           Subnet           │
│ ✓ portal-dev-psql          PostgreSQL       │
│ ✓ portal-dev-dns           Private DNS Zone │
│ ✓ portal-dev-vnet-link     DNS VNet Link    │
├─────────────────────────────────────────────┤
│ Management locks (staging + prod):          │
│   🔒 CanNotDelete on all resources          │
│                                             │
│ Azure Policy:                               │
│   ✓ deny-public-access        enforced      │
│   ✓ deny-network-outside-dev  enforced      │
│   ✓ require-tags              enforced      │
│                                             │
│ Drift detection:                            │
│   🕐 Daily scan — next run in 14h           │
│   Last result: ✓ No drift detected          │
└─────────────────────────────────────────────┘