diff --git a/deployment/terraform/modules/azure/README.md b/deployment/terraform/modules/azure/README.md
index 94cf6242bb..d274d2023d 100644
--- a/deployment/terraform/modules/azure/README.md
+++ b/deployment/terraform/modules/azure/README.md
@@ -3,9 +3,11 @@
 ## Status
 
 These modules are validated against the `azurerm` provider schema and each one
-ships a `terraform test` suite that plans it against a mocked provider. They
-have not yet been applied to a live subscription. Treat the first deployment as
-a first deployment.
+ships a `terraform test` suite that plans it against a mocked provider.
+
+The `onyx` composition has been applied to a live subscription, and the Onyx
+Helm chart runs on it. The WAF policy is created but not attached, because it
+needs an Application Gateway or Front Door (see `waf`).
 
 ## Overview
 
diff --git a/deployment/terraform/modules/gcp/README.md b/deployment/terraform/modules/gcp/README.md
index 6bf57faad0..486ad657e9 100644
--- a/deployment/terraform/modules/gcp/README.md
+++ b/deployment/terraform/modules/gcp/README.md
@@ -3,9 +3,12 @@
 ## Status
 
 These modules pass validation against the `google` provider schema. Each one
-has a `terraform test` suite that plans it against a mocked provider. No one
-has applied them to a live project yet. Treat the first deployment as a first
-deployment.
+has a `terraform test` suite that plans it against a mocked provider.
+
+The `onyx` composition has been applied to a live project, and the Onyx Helm
+chart runs on it: GKE, Cloud SQL, Memorystore with TLS, and the GCS file store
+through Workload Identity. The Cloud Armor policy is created but not attached,
+because an L7 load balancer is needed for that (see `cloud-armor`).
 
 ## Overview