Declarative infrastructure automation
— without the cluster.

Every resource is a single-writer object

Each managed resource is its own Restate Virtual Object, keyed by a natural identifier like S3Bucket/my-bucket. Mutations (Provision, Delete, Reconcile) run as exclusive handlers, so two concurrent operations on the same resource are serialized automatically. No distributed locks, no state file, no optimistic-concurrency conflicts.

The resource's spec, observed state, outputs, and status live in the object's own key-value store. Query the object and you see everything about that resource.

# Every driver implements the same six handlers

Exclusive (single-writer):
  Provision(spec)  → outputs   # create or update
  Import(ref)      → outputs   # adopt existing
  Delete()                     # remove
  Reconcile()      → result    # check drift, fix it

Shared (concurrent-read):
  GetStatus()      → status
  GetOutputs()     → outputs   # ARN, ID, etc.

Typed CUE templates

Platform teams define validated templates; users fill in variables. Types, regex constraints, and enums are checked at evaluation time, so bad configs fail before they ever reach AWS.

Deploy with --var key=value or a variables file.

// examples/s3/app-buckets.cue
variables: {
    name:        string & =~"^[a-z][a-z0-9-]{2,40}$"
    environment: "dev" | "staging" | "prod"
}

resources: assets: {
    apiVersion: "praxis.io/v1"
    kind:       "S3Bucket"
    metadata: name:
        "\(variables.name)-\(variables.environment)-assets"
    spec: {
        region:     "us-east-1"
        versioning: true
        acl:        "private"
        tags: { app: variables.name, env: variables.environment }
    }
}

// app-buckets.vars.json
{ "name": "myapp", "environment": "prod" }

Dependency-aware orchestration

Output expressions wire resources together. The orchestrator builds a DAG from them and dispatches with maximum parallelism as dependencies complete. Here that means vpc → webSG → server, with no ordering written anywhere.

// examples/stacks/ec2-web-stack.cue (trimmed)
resources: {
    vpc: {
        kind: "VPC"
        spec: { region: "us-east-1", cidrBlock: "10.0.0.0/16" }
    }
    webSG: {
        kind: "SecurityGroup"
        spec: {
            vpcId: "${resources.vpc.outputs.vpcId}"
            ingressRules: [{
                protocol:  "tcp"
                fromPort:  443
                toPort:    443
                cidrBlock: "0.0.0.0/0"
            }]
        }
    }
    server: {
        kind: "EC2Instance"
        spec: securityGroupIds: ["${resources.webSG.outputs.groupId}"]
    }
}

Plan before apply

Per-field diffs for every resource before anything changes. Resources that reference other resources' outputs are resolved at plan time against live driver state, so what you see is what will happen.

$ praxis plan stack.cue --account prod

Praxis will perform the following actions:

  # S3Bucket "my-bucket" will be created
  + resource "S3Bucket" "my-bucket" {
      + bucketName  = "my-bucket"
      + region      = "us-east-1"
      + versioning  = true
    }

  # SecurityGroup "web-sg" will be updated in-place
  ~ resource "SecurityGroup" "web-sg" {
      ~ description = "old desc" => "new desc"
      - sslPolicy   = "ELBSecurityPolicy-2016-08"
    }

Plan: 1 to create, 1 to update, 0 to delete, 2 unchanged.

Continuous reconciliation: corrected or just reported

Every resource is re-compared against AWS reality on a five-minute interval, powered by Restate's durable timers. There is no external cron and no polling infrastructure.

Managed resources get drift corrected automatically. Observed resources get drift reported to the event stream but are never touched, which is ideal for adopting infrastructure you're not ready to hand over.

# Template resources are Managed:
# drift is detected and corrected.
praxis deploy stack.cue --account prod --key web --wait

# Imported resources can be Observed instead:
# drift is reported, never modified.
praxis import S3Bucket --id legacy-assets \
    --region us-east-1 --observe

Durable execution, exactly-once

Every AWS API call runs inside a Restate journal entry. If a driver crashes mid-provision, replay resumes from the journal. Completed calls are never re-executed, so there are no duplicate resources and no half-applied state.

Transient AWS errors (throttling, network) are retried by Restate automatically; only terminal errors surface.

// internal/drivers/s3/driver.go (trimmed)
// Idempotent create: the existence check is journaled.
exists, err := restate.Run(ctx,
    func(rc restate.RunContext) (bool, error) {
        headErr := api.HeadBucket(rc, spec.BucketName)
        if headErr == nil {
            return true, nil
        }
        if IsNotFound(headErr) {
            return false, nil
        }
        // transient (throttling/network): Restate retries
        return false, headErr
    })

Lifecycle protection

preventDestroy blocks deletion of resources you can't afford to lose. ignoreChanges excludes specific fields from drift detection, so external systems like cost tooling and audit scripts can co-manage them without Praxis fighting back.

// examples/lifecycle/protected-db.cue
resources: database: {
    kind: "RDSInstance"
    spec: { engine: "postgres", instanceClass: "db.t3.small" }
    lifecycle: preventDestroy: true
}

// examples/lifecycle/external-managed.cue
resources: bucket: {
    kind: "S3Bucket"
    spec: { region: "us-east-1", versioning: true }
    lifecycle: ignoreChanges: [
        "tags.CostCenter",
        "tags.LastAudit",
        "tags.ManagedBy",
    ]
}

Policy as CUE constraints

Organizational standards are plain CUE unification. No separate policy engine, no admission webhooks. Constraints apply at template evaluation, and violations stop the deployment before it starts.

// examples/policies/prod-guardrails.cue

// Production resources must be protected from deletion.
resources: [=~"-prod"]: lifecycle: preventDestroy: true

// Production S3 buckets must be private and versioned.
resources: [=~"-prod"]: {
    kind: string
    if kind == "S3Bucket" {
        spec: {
            acl:        "private"
            versioning: true
        }
    }
}

Data sources

Reference infrastructure that already exists without managing it. A data block performs a read-only lookup and injects outputs like VPC IDs, ARNs, and CIDR blocks into your managed resources. No state stored, no lifecycle tracked.

Supported today for VPC, Subnet, Security Group, S3 Bucket, IAM Role, and Route 53 Hosted Zone.

// examples/stacks/data-source-vpc.cue
variables: vpcName: string

data: existingVpc: {
    kind:   "VPC"
    region: "us-east-1"
    filter: name: variables.vpcName
}

resources: webSG: {
    kind: "SecurityGroup"
    spec: {
        vpcId: "${data.existingVpc.outputs.vpcId}"
        ingressRules: [{
            protocol:  "tcp"
            fromPort:  443
            toPort:    443
            cidrBlock: "0.0.0.0/0"
        }]
    }
}

Import existing resources

Adopt what's already running in your account. Praxis captures the resource's current state as a baseline, then manages it. With --observe it just watches and reports drift instead.

praxis import S3Bucket --id my-existing-bucket \
    --region us-east-1 --account prod
praxis import SecurityGroup --id sg-0abc123 --region us-east-1
praxis import EBSVolume --id vol-0abc123 --region us-east-1

# Read-only: track and report, never modify
praxis import ElasticIP --id eipalloc-0abc123 \
    --region us-east-1 --observe

Audit event stream

Every provision, drift detection, correction, and deletion is a CloudEvents v1.0 event. Follow a deployment live with praxis observe, or consume the NDJSON stream with your own tooling.

Drift gets its own event family: drift.detected, drift.corrected, and drift.external_delete for resources deleted behind Praxis's back.

$ praxis observe Deployment/web

[14:30:00] Ready S3Bucket/assets: provisioned successfully
[14:30:05] Ready EC2Instance/server: launched in vpc-0abc123

// One event from the NDJSON stream (trimmed)
{
  "type":         "dev.praxis.drift.corrected",
  "subject":      "webSG",
  "category":     "drift",
  "severity":     "info",
  "resourcekind": "SecurityGroup",
  "deployment":   "web",
  "data": { "message": "ingress rules restored to match spec" }
}

Extensible without forking

Restate doesn't distinguish built-in from external services. Write a driver in Python, TypeScript, Go, Java, Kotlin, or Rust in your own repository, register it with the same Restate instance, and it participates in DAG orchestration, output expressions, state tracking, and the event stream alongside built-in drivers.

No plugin SDK. No fork. No changes to Praxis.

# docs/EXTENDING.md: a Cloudflare DNS driver (trimmed)
import restate

cf_driver = restate.VirtualObject("CloudflareDNSRecord")

@cf_driver.handler()
async def Provision(ctx, spec):
    record = await ctx.run_typed("create DNS record",
        api.create_record, zone_id=spec.zone_id,
        record={"type": spec.type, "name": spec.name})
    return DNSRecordOutputs(record_id=record["id"],
        fqdn=record["name"])