envctl

┌────────────────────────────┐
│ IN NON-PROD ACCOUNT        │
│                            │
│ You run: terraform apply   │
│ We run:  terraform destroy │
└────────────────────────────┘

EnvCtl is a tool to automate Terraform environment lifecycle management in non-prod accounts

Main use case: you provision resources for dev testing, the tool destroys them at the end of a work day, so you save $

EnvCtl is free for personal use

install

EnvCtl requires Node.js 22 or higher

npm install -g @agilecustoms/envctl

setup

Currently (May 2026) EnvCtl is in alpha testing, please contact author [email protected] for onboarding. Once you get an API Key, you can run:

envctl configure

usage

This is an easy part. You just use envctl instead of terraform:

envctl init -backend-config=key=my-test-env
envctl plan  # any normal terraform plan arguments
envctl apply # any normal terraform apply arguments
envctl delete

Note. Instead of "destroy" you now can use the "delete" command, it launches an async destroy process on EnvCtl backend. For this purpose you'll need to create a user/role with trust policy to allow EnvCtl to assume it and delete resources on your behalf

Advantages:

• (main) you can forget to run destroy, EnvCtl will delete resources at the end of the workday (configurable)
• often destroy takes a long time (up to 40 min if you use Lambda in VPC). With envctl you don't need to wait for it
• (future) Often terraform just can't delete a resource, because, for example, there are already some objects in S3 bucket. We call it "hard resources". EnvCtl will delete them too

Since now a destruction process is run on a remote server, you might need to know what is going on. For this purpose you can use the following commands:

envctl status # shows environment status: ACTIVE, DELETING, DELETE_ERROR
envctl logs   # shows most recent destroy logs - helpful if status returns DELETE_ERROR

Limitations

As of May 2026:

• Only AWS is supported. GCP, Azure and other providers are planned in the future (send an email at [email protected] if you want to be a tester for other providers)
• S3 remote state only (other remote states are planned)

Extra features:

• if apply fails due to a lock error, EnvCtl will offer you to force unlock state and retry apply
• for multi-tenant accounts EnvCtl offers automatic injection of a variable that defines environment key/prefix
• just like AWS CLI, EnvCtl supports profiles, so you can switch between different accounts

Support

Currently, support is via email [email protected]

Roadmap

• OIDC support (currently customers require creating IAM user with access keys)
• Support for other providers (GCP, Azure)
• Self-service website (currently onboarding is via chat)
• Extended "Hard resources" support (non-empty S3 bucket, amended routes in Api Gateway, etc)
• Notification in Slack/Email when environment deletion failed
• Extended analytics for enterprise

Ephemeral environments

Ephemeral environments are used in the CD pipeline to run end-to-end tests. Such environments are deleted not at the end of the workday, but after some time after creation (configurable, typically within an hour – the time required to run all tests). Key idea: if tests passed, the last step of your CD pipeline will run envctl delete. So your pipeline finishes when tests finish, you do not need to wait a few more minutes for resources deletion anymore! But if tests fail – you have some time to investigate the failure and a chance to extend environment lifetime!

This feature is available for alpha/beta testers and the first month of use after prod release, then it will be paid

Contact [email protected] for ephemeral environments demo