Point at your IaC
Start with your IaC project. dryrun parses resources, modules, and dependencies — no architecture essay required.
IaC architecture linter
Dry run your infrastructure before production does.
Point dryrun at your IaC.
Find production architecture risks before they hit prod.
Parse real resources, run codified production rules, and get evidence-backed findings with follow-up verification.
Production rules
Cross-verify
Evidence-backed
$ dryrun validate ./infrastructure
Parsing 23 resources across 4 modules...
[CRITICAL] rule:rds-no-proxy
Lambda "api-handler" connects directly to RDS "main-db"
[WARNING] rule:sqs-no-dlq
Queue "order-events" has no dead-letter queue configured
Cross-verify: what happens to DB connections at 500 concurrent Lambdas?
Report saved to findings.json
Findings
2 critical
3 warnings
31 of 36 rules passed
rule:rds-no-proxy
Lambda "api-handler" → RDS "main-db" with no RDS Proxy in between.
Cross-verify
What happens when Lambda concurrency spikes to 500?
Recommended fix
Add RDS Proxy for connection pooling with read/write split and connection limits.
Doesn't stop at findings
Finding
Lambda → RDS without proxy
Dryrun asks
What happens when concurrency spikes to 500?
Outcome
Recommended architecture change with evidence attached.
Rule library
Senior-engineer judgment, encoded as rules.
Rules encode real production failure patterns — the things experienced engineers catch in design review, not generic misconfiguration scans.
rule:rds-no-proxy
rule:sqs-no-dlq
rule:nat-cost-sprawl
rule:lambda-timeout-mismatch
rule:missing-autoscale
rule:public-rds-endpoint
The gap
Not a prompt wrapper. Not a checklist. A rules engine for IaC.
Not operational blind spots
Rules target production architecture correctness: connection exhaustion, missing DLQs, NAT cost traps, concurrency assumptions — not just syntax or policy violations.
Not generic LLM judgment
Rules encode hard-learned patterns from real AWS architectures. The LLM explains and cross-verifies — it does not decide.
Not stop at the finding
Each rule triggers follow-up questions that interrogate your assumptions under load, failure, and scale — like a senior design review.
How it works
Find. Interrogate. Fix.
Run production rules
Codified rules check for known failure patterns: missing DLQs, direct Lambda-to-RDS, public exposure, cost traps, and more.
Cross-verify assumptions
Each finding triggers targeted follow-ups — what happens at 500 concurrent Lambdas? Where does backpressure go? Will this hold under scale?
Export when ready
Approved decisions can export as ADR drafts — documentation as proof of value, not the primary workflow.
Rule packs
Codified production knowledge, grouped by domain.
RDS & connections
Direct Lambda access, missing proxy, no read replicas, public subnets, connection limit risks.
Queues & events
Missing DLQs, no retry policy, ordering assumptions, poison message handling, visibility timeouts.
Exposure & access
Public RDS endpoints, open security groups, NAT Gateway sprawl, missing VPC endpoints.
Lambda & ECS
Timeout mismatches, missing autoscaling, cold start impact, container resource limits.
IAM & secrets
Over-scoped roles, hardcoded credentials, missing encryption, audit trail gaps.
Spend traps
NAT per-AZ duplication, unbounded log retention, oversized instances, missing lifecycle policies.
CLI first
Start in the terminal. Validate infrastructure in seconds.
Run rule checks from your terminal. Validate IaC, review findings with evidence, and cross-verify flagged decisions before they ship.
$ npx dryrun
$ dryrun validate ./infrastructure
$ dryrun cross-verify --from findings.json
Optional: export approved decisions as ADR drafts with dryrun adr generate.
Early access
Help shape the first IaC architecture linter.
Join the early list for production architecture rule checks and cross-verification. No spam — only product updates.