bronco

The DevOps you're not going to hire.

Bronco puts your app into production in your own AWS account — database, domain, HTTPS, deploys and alerts included — without you learning Terraform, VPCs or IAM. And then it doesn't leave: it tells you what's broken, what you're overpaying for, and what will fall over when traffic arrives.

Your infrastructure. Your account. Plain Terraform. Leave whenever you want.

Start by finding out if you even have a problem

You don't have to build anything to get value out of Bronco. Point it at any AWS account — including one Bronco never touched — and it reads back what's costing you money, what's exposed, and what isn't production-ready.

npx bronco-cli doctor

Read-only. No sign-up. No license. Nothing is uploaded anywhere — the scan runs on your machine, with your credentials, and the results stay there.

  Spend      $1,240.00 / last 30d
  Waste        $412.00/mo / $4,944.00 a year you get nothing for
  Forecast   $1,580.00 / this month, per AWS

  Do these three things:

    1. Security groups open to the internet ×2
       Critical — fix this before anything else
       bronco fix --dry-run free

    2. NAT Gateway hours ×3
       $98/mo — $1,176 a year
       bronco cost --full Developer

    3. Single task, no redundancy ×2
       2 findings
       bronco risk --full Developer

  Coverage: 2 checks couldn't run — missing ce:GetCostAndUsage

Three things, not forty. Findings are grouped — twelve unused volumes are one decision worth $34, not twelve worth $2.80 — and ranked most value for least risk, with one from each of money, security and reliability so a long cost list can't hide an open port.

That last line matters as much as the rest: Bronco tells you what it couldn't look at. An account that denies every read doesn't get a green light here.

Where the numbers come from. Real spend and the forecast are AWS's own, through Cost Explorer — including AWS's rightsizing recommendations and any spend anomaly its detector already flagged, so you can check every figure in your own console. "Nobody is using this" is measured, never guessed: fourteen days of CloudWatch metrics, and if there isn't enough history Bronco says it couldn't tell rather than calling something unused.

What it looks at. 47 checks across EC2, S3, RDS, IAM, ECS, load balancers, CloudWatch Logs, ECR, ElastiCache, certificates, CloudTrail, Lambda, DynamoDB, SQS/SNS and API Gateway. A lot of them exist because the default is the problem: DynamoDB takes no backups unless you ask and doesn't mention it while you create the table, a certificate expires on a date AWS emails to an address nobody reads, and a CloudTrail can sit there switched off looking configured. Nobody did anything wrong to cause those — which is exactly why nothing else will ever tell you.

npx bronco-cli doctor --out checkup.md   # the full report: every resource, grouped
npx bronco-cli doctor --share            # a de-identified card you can send someone

Want the itemized version live? bronco cost, bronco audit and bronco risk are the detail behind that summary — free in preview on any account, all regions.

Then build the thing properly

npx bronco-cli forge

A short conversation in plain language — which environment, how resilient, do you need a database — and Bronco builds a complete, hardened AWS stack in your account and deploys your app into it: private network · PostgreSQL · Redis · ECS Fargate behind a load balancer · CDN · Secrets Manager · CloudWatch alarms · ECR, wired together, migrations run, live at a real URL.

Your first dev environment is free. Forever. Not a trial — you shouldn't have to pay to find out whether this works.

Yes, it takes about fifteen minutes. That's the point.

Other platforms deploy in forty seconds and you have no idea what's behind it — what the network looks like, whether anything is encrypted, whether there are backups, whether someone can reach your database from the internet. Bronco spends those minutes building the environment you'd otherwise have to come back and fix: your database on a private network nothing external can reach, encryption at rest, automated backups, HTTPS with a managed certificate, and secrets stored properly and injected at runtime instead of baked into your image.

You wait once. You don't rebuild it later.

And then it keeps an eye on it

An environment nobody watches is an environment that surprises you.

| Command | What it does | |---|---| | bronco | The console — every project, environment and service, with state, health and cost. | | bronco doctor | Cost + security + reliability, in one pass. | | bronco watch | A small read-only monitor in your own account (EventBridge → Lambda, no Bronco backend) that pushes a weekly digest — or an immediate alert — to Slack/Teams. | | bronco drift | What changed in AWS outside of Bronco. | | bronco evolve | Grow a live environment — add a service, a database, a connection — without tearing anything down. | | bronco pause / resume | Stop paying for a non-production environment nobody is using. Your data, secrets and URL stay. Never gated. | | bronco destroy | Tear it down and stop the bill. Never gated. |

💸 Spend $1,240 (▲$180 vs last week) · ✅ $400/mo waste · 🔒 88/100 (−4, new SG :22 open) · 🔀 3 resources drifted

Four signals alert immediately: cost spike · security regression · drift · reliability regression. The monitor only reports — remediation stays a deliberate bronco audit --fix away.

Ship into it

bronco deploy              # build → push → migrate → roll out
bronco logs api --errors   # search your logs inside CloudWatch, not scroll them
bronco rollback -s api     # back to the previous revision
bronco ci generate         # a pipeline for GitHub / GitLab / Azure / Bitbucket

Your app is wired to the environment automatically — database and cache connection strings, secrets, environment variables. You don't configure any of it.

Already have infrastructure in AWS? bronco adopt brings existing VPCs, RDS instances, ECS services and load balancers under management — journaled, resumable and reversible. It never guesses: it imports an explicit, blessed set and leaves everything else untouched.

What it costs

Bronco's pricing rule: you pay for acting and operating — never for seeing, and never for escaping cost.

| | Free | Developer | |---|---|---| | | $0, forever | $29/mo | | Diagnose any AWS account | ✓ all regions | ✓ | | Build & deploy | 1 dev environment | unlimited, any environment | | Full itemized cost / security / reliability reports | preview | ✓ | | Auto-fix (fix, audit --fix) | — | ✓ | | Continuous monitoring (watch on) | — | ✓ | | Machine seats | 1 | 2 (laptop + CI) |

Never gated, at any tier: destroy · rollback · logs · outputs · plan · restore · discover · ask. A lapsed license must never trap you with running AWS costs you can't see or stop, and must never stand between you and your own recovery.

Running AWS for clients? There's an Agency tier — multi-account tenants, per-client cost allocation, white-label reports and compliance evidence packs. It's sold by conversation: get in touch.

The AWS bill is yours and goes straight to AWS — Bronco never marks it up or sits in the middle of it.

Install

Nothing to install — Node.js ≥ 18 is the only prerequisite:

npx bronco-cli doctor

To keep it around, install it globally. The package is bronco-cli; the command it gives you is bronco:

npm install -g bronco-cli
bronco doctor

All you bring is an AWS account. Terraform is installed for you (a pinned build into ~/.bronco/bin, or your own if it's already on PATH). No AWS CLI required — Bronco uses whatever credentials the AWS SDK already sees (env vars, a profile, SSO), or walks you through connecting an account, including a one-click CloudFormation quick-create for a scoped deploy user so no admin key ever passes through the CLI.

State lives in a hardened S3 bucket Bronco provisions in your account (versioned, encrypted, private — one per account). You never touch it.

bronco activate <license-key>   # only when you go past the free tier

Why you own it

Bronco writes plain Terraform into your own AWS account. Not a proxy, not a control plane you rent, not a database we hold. If you stop paying, or you decide Bronco isn't for you, everything it built keeps running and stays yours — the state file is in your bucket, the modules are readable, and bronco destroy is free forever.

That's deliberate. We'd rather earn the renewal than hold your infrastructure hostage for it.

The daily loop

bronco ci generate          # a pipeline where every push deploys…

…but only if the environment is still healthy. The generated pipeline runs bronco doctor --gate --env prod before it ships: new drift, a security group that opened overnight, or a reliability regression stops the deploy with a list of what changed and when. Findings you've already accepted don't block anything — the gate is on what moved, not on what's there.

Your tests answer does my code work. This answers is the environment I'm about to ship into still the one I approved — and it's the one question only Bronco can answer, because only Bronco holds both what you declared and what AWS looks like right now.

And a ceiling. bronco forge asks what you're willing to spend per month. Bronco warns at 80% and won't build past the cap without asking — free tier included, because a spending limit is what makes trying AWS reasonable, not an enterprise control.

The reasoning behind each of these lives in docs/user-stories/.

More

• docs/product/PLANS.md — what each plan is, and why it costs what it costs.
• docs/user-stories/ — how the product is planned: the customer, the rules, the journeys.
• CONTRIBUTING.md — building from source, the repo layout, tests and releases.
• ARCHITECTURE.md — the maintainer's map.

© Tizyco