How to Monitor Infrastructure Managed by Terrateam with Vigilmon

Terrateam is a GitOps platform for Terraform and OpenTofu that runs infrastructure apply operations directly from GitHub pull requests. It gives you code-reviewed, auditable infrastructure changes — but once your infrastructure is provisioned, you still need external monitoring to verify your services are healthy.

In this tutorial you'll set up end-to-end monitoring for infrastructure managed by Terrateam using Vigilmon — free tier, no credit card.

Why Terrateam-managed infrastructure needs external monitoring

Terrateam focuses on the apply phase — making infrastructure changes safely through PR workflows. But successful Terraform applies don't guarantee a healthy service:

• Apply succeeds, service fails to start — Terraform provisions the instance and marks it healthy, but the application inside never starts
• DNS propagation delays — a Terrateam apply updates a Route53 record but DNS hasn't propagated globally; traffic goes to the old IP
• Security group misconfigurations — a Terraform plan looks correct but the resulting security group blocks inbound traffic on the wrong port
• Post-apply drift — infrastructure was correctly provisioned but a subsequent OS update, certificate expiry, or configuration change causes downtime weeks later
• Multi-module coordination failures — Terrateam applies multiple modules in sequence; a later module depends on the output of an earlier one, and a partial failure leaves services in a broken state

External monitoring catches all of these after the fact — Vigilmon doesn't care how the infrastructure was provisioned, only whether the service responds correctly right now.

What you'll need

• Infrastructure already provisioned via Terrateam (EC2, ECS, Cloud Run, or similar)
• A public URL or IP for your service
• A free Vigilmon account

Step 1: Add a health endpoint to your application

Your deployed service should expose a /health endpoint that returns HTTP 200 when it's operational.

For a service running on EC2 behind an Application Load Balancer:

// Node.js/Express
app.get('/health', (req, res) => {
  res.json({ status: 'ok', region: process.env.AWS_REGION });
});

For an ECS task, configure the ALB target group health check in your Terraform code:

resource "aws_lb_target_group" "app" {
  name     = "app-tg"
  port     = 3000
  protocol = "HTTP"
  vpc_id   = var.vpc_id

  health_check {
    path                = "/health"
    interval            = 30
    timeout             = 5
    healthy_threshold   = 2
    unhealthy_threshold = 3
    matcher             = "200"
  }
}

The ALB health check tells AWS when to route traffic; Vigilmon's check tells you when users can't reach the service.

Step 2: Integrate monitoring into your Terrateam workflow

The best time to verify a deployment is immediately after a Terrateam apply completes. Add monitoring setup as a Terrateam hook that runs post-apply.

In .terrateam/config.yml, add a post-apply hook:

hooks:
  apply:
    post:
      - type: run
        cmd: |
          echo "Apply complete. Verifying service health..."
          curl -sf https://your-app.example.com/health || echo "WARNING: Health check failed post-apply"

This gives you an early warning in the PR comments if the service isn't responding right after Terraform provisions it.

For a more robust approach, use a dedicated verification workflow that also validates Vigilmon monitor status via the API after apply.

Step 3: Set up HTTP monitoring in Vigilmon

1. Log in to vigilmon.online and go to Monitors → New Monitor
2. Choose HTTP / HTTPS as the type
3. Set the URL to your health endpoint, e.g. https://your-app.example.com/health
4. Set the check interval to 1 minute
5. Under Expected response, set:
   • Status code: 200
   • (Optional) Response body contains: "status":"ok"
6. Save the monitor

Vigilmon now continuously verifies that your Terrateam-managed infrastructure is serving traffic. Any drift that happens between Terrateam applies will be caught immediately.

Step 4: Monitor infrastructure endpoints directly

For infrastructure where no HTTP endpoint exists, use TCP monitoring:

1. In Vigilmon, go to Monitors → New Monitor
2. Choose TCP Port as the type
3. Enter the hostname and port, e.g. rds.example.com / 5432
4. Save

This is useful for databases, Redis clusters, or internal services that Terrateam provisions but that don't expose HTTP.

Step 5: Monitor multiple environments

Terrateam typically manages multiple Terraform workspaces (dev, staging, production). Set up a Vigilmon monitor per environment:

| Environment | Monitor URL | Purpose | |-------------|-------------|---------| | production | https://app.example.com/health | Customer-facing uptime | | staging | https://staging.app.example.com/health | Pre-production validation | | dev | https://dev.app.example.com/health | Developer environment health |

Grouping monitors by environment in Vigilmon lets you set different alert thresholds — production might alert after 1 failure, staging after 3.

Step 6: Configure webhook alerts

1. Go to Alert Channels → Add Channel → Webhook
2. Enter your Slack, PagerDuty, or Discord webhook URL
3. Assign the alert channel to your production monitors

For a Terrateam workflow, configure your Slack channel to receive both Terrateam apply notifications and Vigilmon downtime alerts. When a Terrateam apply is followed minutes later by a Vigilmon alert, that's a strong signal the apply caused a regression:

{
  "monitor_name": "production /health",
  "status": "down",
  "url": "https://app.example.com/health",
  "started_at": "2024-06-15T16:10:00Z",
  "duration_seconds": 180
}

Step 7: Create a status page

1. In Vigilmon, go to Status Pages → New Status Page
2. Add your production environment monitors
3. Publish the page

A public status page is valuable for teams using Terrateam because infrastructure changes are happening through GitHub — stakeholders can monitor service health without needing GitHub or AWS access.

Key metrics to watch

| Metric | What it catches | |--------|----------------| | HTTP response code | Post-apply startup failures, security group blocks, ALB misrouting | | HTTP response time | Instance undersizing, networking regressions from Terraform changes | | TCP port reachability | Database provisioning failures, firewall rule errors | | SSL certificate | ACM certificate validation failures after DNS changes | | Uptime percentage | SLA tracking between Terrateam apply cycles |

Alerting recommendations for Terrateam workflows

• Immediately after apply — check monitor status manually or via Vigilmon API to confirm the apply didn't cause a regression
• Production alerts — 1-minute interval, alert after 2 consecutive failures, page on-call via PagerDuty
• Staging alerts — 5-minute interval, alert via Slack only
• SSL expiry — alert 14 days before expiry so you have time to debug ACM renewal issues before they become incidents

Summary

Terrateam makes infrastructure changes safe and auditable through GitOps workflows, but a successful Terraform apply doesn't guarantee a healthy service. Vigilmon adds the continuous external verification layer — probing your endpoints every minute, independent of your Terraform state, and alerting you when the real-world service diverges from the infrastructure-as-code spec. Set up your first monitor in five minutes and catch post-apply regressions before they become customer-impacting incidents.