fleetworks / warden
The governed front door to your Terraform Cloud footprint
See which workspaces your organization has, which service and AWS account each one maps to, and who may change it. Every read is scoped to one organization; every write is checked against the service and account it names.
What Warden does
- 01
Workspace records
List, create and update the workspaces an organization owns, each tied to one service, one AWS account and one source repo.
- 02
Org-scoped reads
Every read is limited to the caller’s organization. A service, account or workspace from another organization never appears.
- 03
Guarded writes
Creating a workspace checks that its service and AWS account belong to your organization and that its VCS tenant is in the catalog.
- 04
Deterministic Review
A fixed rule set reads a stored workspace, PAT or webhook configuration and reports findings with a severity. No LLM, no network call.
- 05
Scoped API tokens
Machine callers use PATs with an explicit scope list and an optional pin to a single resource.
- 06
Signed webhooks
Workspace changes are delivered to your HTTPS endpoints, signed with HMAC-SHA256 and retried with backoff.
One API, one envelope
The console, the mobile companion and your own scripts call the same API under /api/gatehouse. Every response, errors included, uses one envelope: { data, type, meta }.
- GET
/v2/workspacesList workspaces, optionally by service - POST
/v2/workspacesCreate a workspace record - GET
/v2/workspaces/{workspace_name}/reviewRun the config Review - POST
/v2/tokensIssue a scoped PAT - POST
/v2/webhooksRegister a Webhook endpoint - GET
/public/searchSearch what is public, no sign-in
Bring your Terraform Cloud footprint into one place
Sign in with your Fleetworks account. An org admin grants your role, and your organization’s workspaces are there.