Skip to content

For Platform Engineering

Governed infrastructure as code and Kubernetes, with cost enforcement on every launch path.

Who This Is For

Platform teams that provision infrastructure for other engineers: through pipelines, through a self-service portal, and through the provider console when someone needs it.

The usual stack has a gap in the middle. IaC orchestrators provision, but nothing in them refuses a stack that should not be applied. Kubernetes managers run clusters, with no view of what they cost. FinOps dashboards report what already happened, and cannot provision or refuse anything. Platform teams glue these together, and provisioning and cost enforcement meet only on the invoice.

RosettaHub puts provisioning and enforcement in one platform. Infrastructure is launched from Formations, and the real-time Monitoring Service governs whatever is created, whichever path created it.

What RosettaHub Does

Capability What it means for a platform team Details
Bring your own templates A Formation wraps an existing CloudFormation, CDK, Terraform, OpenTofu or Pulumi script and runs it as it is, with governance, sharing and budget enforcement attached. No rewrite Formations
Kubernetes across clouds Managed clusters and node groups on AWS, Azure and Google Cloud from one interface, under the same cost, quota and compliance policies Kubernetes
Container images and registries Images and repositories managed across clouds rather than per provider Container Images, Container Repos
Enforcement at launch Quotas are checked when a resource is created. Live cost is evaluated against the budget continuously, and an account that reaches its budget is blocked Cost Management
Service catalogs Portfolios act as a curated catalog per team. Perspectives and Views shape the portal to your organization Portfolios, Perspectives
Sharing without IAM tickets Share a Formation, a cluster blueprint, an image or a compliance policy with a user, group or organization. The platform issues temporary credentials on share and revokes them on unshare Sharing

Enforcement Lands at the Cloud's Own API

A check inside a pipeline step governs that pipeline and nothing else. RosettaHub enforces where resources are actually created. Quotas, permitted regions, services and instance types are translated into the cloud's own policy layer, so the same limits apply whether the work was launched from a pipeline, the portal, the command line or the provider console.

When an account reaches its budget, new activity on it is blocked, AI included. On Automate, running services are stopped as well: instances are stopped with their volumes kept, storage is untouched, and data is preserved wherever the service allows.

Production accounts

Enforcement is decided per account by the scopes granted on it. An account without the scopes that allow blocking and stopping is monitored and alerted on, but never stopped. That is the right setting for production. See Account Access and Scopes.

Does This Replace Your IaC Tooling?

Not necessarily. If you already have provisioning you are happy with, RosettaHub governs what it creates. Formations are there for the cases where you want governed self-service on top of the same templates.

Every Interface Is Programmatic

Every operation in the portal is available through the API, the CLI and SDKs, and through MCP servers for AI assistants. Users also get single sign-on and direct federated access to the AWS console and CLI through IAM roles.

Which Edition

Governing what your pipelines create needs Govern. Stopping running services at the budget and cleaning up idle resources needs Automate. Self-service provisioning from Formations is Build, which is Automate plus RosettaCloud. See RosettaOps Editions.

Getting Started

  1. Read RosettaOps Editions and decide which scopes each account needs.
  2. Follow Onboarding to connect your management account.
  3. Wrap one existing template as a Formation and share it with a team.

For pricing, see rosettahub.com/site/pricing.