diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
new file mode 100644
index 0000000..dfd0e30
--- /dev/null
+++ b/.github/dependabot.yaml
@@ -0,0 +1,10 @@
+# Set update schedule for GitHub Actions
+
+version: 2
+updates:
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      # Check for updates to GitHub Actions every week
+      interval: "weekly"
diff --git a/.github/workflows/apply.yaml b/.github/workflows/apply.yaml
new file mode 100644
index 0000000..84f3936
--- /dev/null
+++ b/.github/workflows/apply.yaml
@@ -0,0 +1,62 @@
+name: Apply
+
+on:
+  workflow_dispatch:
+  # schedule:
+  #   - cron: "17 */4 * * *"
+  push:
+    paths:
+      - "**/*.tf"
+      - "**/*.tfvars"
+      - "**/*.csv"
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  apply:
+    runs-on: ubuntu-latest
+    env:
+      TF_CLI_ARGS: "-no-color"
+      TF_IN_AUTOMATION: "true"
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: Iv23liMoEs2Rz8MBVfAe
+          private-key: ${{ secrets.CONFIG_APP_SECRET }}
+          owner: ${{ github.repository_owner }}
+
+      - uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          aws-region: us-east-1
+
+      - name: Setup OpenTofu
+        uses: opentofu/setup-opentofu@v2
+        with:
+          tofu_wrapper: false
+
+      - name: TF init
+        run: |
+          tofu init
+
+      - name: TF Validate
+        run: |
+          tofu validate
+
+      - name: TF Apply
+        env:
+          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
+        run: |
+          tofu apply -concise -auto-approve
diff --git a/.github/workflows/plan.yaml b/.github/workflows/plan.yaml
new file mode 100644
index 0000000..d85409b
--- /dev/null
+++ b/.github/workflows/plan.yaml
@@ -0,0 +1,52 @@
+name: Plan
+
+on:
+  pull_request:
+    paths:
+      - "**/*.tf"
+      - "**/*.tfvars"
+      - "**/*.csv"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  plan:
+    # This workflow cannot run on pull requests from forked repositories
+    # (because we do not want to grant access to our AWS credentials to
+    # third-party code).
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    env:
+      TF_CLI_ARGS: "-no-color"
+      TF_CLI_ARGS_plan: "-lock=false"
+      TF_IN_AUTOMATION: "true"
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          aws-region: us-east-1
+
+      - name: Setup OpenTofu
+        uses: opentofu/setup-opentofu@v2
+        with:
+          tofu_wrapper: false
+
+      - name: TF init
+        run: |
+          tofu init
+
+      - name: TF Validate
+        run: |
+          tofu validate
+
+      - name: TF Plan
+        run: |
+          tofu plan
diff --git a/.github/workflows/pre-commit.yaml b/.github/workflows/pre-commit.yaml
new file mode 100644
index 0000000..24a296e
--- /dev/null
+++ b/.github/workflows/pre-commit.yaml
@@ -0,0 +1,23 @@
+name: Pre-commit
+
+on:
+  workflow_dispatch:
+  pull_request:
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    env:
+      TF_CLI_ARGS: "-no-color"
+      TF_IN_AUTOMATION: "true"
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.13"
+      - uses: opentofu/setup-opentofu@v2
+        with:
+          tofu_wrapper: false
+      - uses: pre-commit/action@v3.0.1
+        with:
+          extra_args: --all-files
diff --git a/.gitignore b/.gitignore
index a8815a1..339d071 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,4 +2,3 @@ terraform.tfstate
 terraform.tfstate.backup
 .terraform
 terraform.tfstate.*.backup
-plan.*
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..17688e2
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,29 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: check-merge-conflict
+      - id: end-of-file-fixer
+      - id: check-added-large-files
+      - id: check-case-conflict
+      - id: check-json
+      - id: check-symlinks
+      - id: detect-private-key
+
+  - repo: https://github.com/adrienverge/yamllint.git
+    rev: v1.35.1
+    hooks:
+      - id: yamllint
+        files: \.(yaml|yml)$
+        types: [file, yaml]
+        entry: yamllint --strict
+
+  - repo: local
+    hooks:
+      - id: tofu-fmt
+        pass_filenames: false
+        name: tofu-fmt
+        language: script
+        files: \.tf$
+        entry: ./scripts/tofu-local-hook.sh
diff --git a/.yamllint.yaml b/.yamllint.yaml
new file mode 100644
index 0000000..88404b7
--- /dev/null
+++ b/.yamllint.yaml
@@ -0,0 +1,10 @@
+extends: default
+rules:
+  line-length: disable
+  document-start: disable
+  indentation:
+    indent-sequences: whatever
+  hyphens:
+    max-spaces-after: 4
+  truthy:
+    check-keys: false
diff --git a/scripts/tofu-local-hook.sh b/scripts/tofu-local-hook.sh
new file mode 100755
index 0000000..3a9483f
--- /dev/null
+++ b/scripts/tofu-local-hook.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+export TF_IN_AUTOMATION=true
+
+if ! tofu fmt -check -diff; then
+  tofu fmt
+  exit 1
+fi