I Built an AI That Fixes Terraform Drift Automatically
If you’ve worked with Terraform long enough, you know the feeling. You run terraform plan and suddenly there are 12 unexpected changes. Someone tweaked an instance type in the console. A security group rule got added manually. A tag got removed. Your infrastructure drifted — and now you have to figure out what changed, why, and how to bring it back in line.
Detecting drift is one thing. Actually fixing it is where engineers waste hours.
That’s what I built tfdrift remediate to solve.
What is tfdrift?
tfdrift (https://github.com/sudarshan8417/tfdrift) is an open-source CLI for continuous Terraform and OpenTofu drift detection. It runs terraform plan across all your workspaces, classifies drift by severity (critical/high/medium/low), and sends alerts to Slack, Teams, or OpsGenie.
Version 0.5.3 ships a new command — tfdrift remediate — that takes detected drift and uses AI to generate a ready-to-review .tf remediation file.
The Problem With Fixing Drift Manually
When drift is detected, the typical workflow is:
- Look at the terraform plan output
- Figure out which attributes changed
- Manually update your .tf files to match desired state
- Run terraform apply
For 1-2 resources this is fine. For 10+ resources across multiple workspaces, it becomes a slow, error-prone process — especially when you’re dealing with complex resource types like aws_security_group, aws_iam_role_policy, or azurerm_virtual_network.
How tfdrift remediate Works
The flow is simple:
tfdrift remediate –path ./infra
- Scans all your Terraform workspaces for drift
- Lists every drifted resource with severity and number of changed attributes
- Asks whether you want to fix everything or just specific resources
- Calls AI (Claude or GPT-4o) with full drift context
- Writes a drift-remediation.tf file you can review and apply
Here’s what the interactive prompt looks like:
Found 3 drifted resource(s):
- aws_instance.web 🔴 high — 2 attribute change(s)
- aws_s3_bucket.logs 🟡 medium — 1 attribute change(s)
- aws_security_group.app 🔴 high — 3 attribute change(s)
What would you like to remediate?
A — All resources
S — Select specific resources (comma-separated numbers)
Q — Quit
Choice [A]:
Choose S and enter 1,3 to fix only the high-severity ones. Or hit A to generate remediation for everything.
The AI Output
The AI receives the full drift context — resource type, action needed, and every attribute that changed with its desired vs actual value. It outputs valid HCL with inline comments explaining each correction:
drift-remediation.tf
Generated by tfdrift remediate
Drift detected: 3 resource(s) across 1 workspace(s)
aws_instance.web — instance_type drifted from t3.medium to t3.large
aws_security_group.app — ingress rules modified out-of-band
Restores instance type to desired state (was changed from t3.medium to t3.large in console)
resource “aws_instance” “web” {
instance_type = “t3.medium” # corrected: actual was t3.large
# … other attributes unchanged
}
Removes manually added ingress rules
resource “aws_security_group” “app” {
ingress {
from_port = 443
to_port = 443
protocol = “tcp”
cidr_blocks = [“10.0.0.0/8”]
}
# … other attributes unchanged
}
Review it, make any adjustments, then apply:
terraform apply drift-remediation.tf
Dual AI Provider Support
tfdrift remediate auto-detects which AI provider to use based on your environment variables:
- Set ANTHROPIC_API_KEY → uses Claude (preferred)
- Set OPENAI_API_KEY → uses GPT-4o (fallback)
You can also force a specific provider:
tfdrift remediate –provider openai –path ./infra
Getting Started
pip install ‘tfdrift[ai]’
with Claude
export ANTHROPIC_API_KEY=sk-ant-…
tfdrift remediate –path ./infra
with OpenAI
export OPENAI_API_KEY=sk-…
tfdrift remediate –path ./infra
Optional flags:
Fix everything without the interactive prompt
tfdrift remediate –all
Custom output file
tfdrift remediate –output my-fixes.tf
Use OpenTofu instead of Terraform
tfdrift remediate –binary tofu
Why Not Just Run terraform apply?
tfdrift remediate is not the same as tfdrift scan –auto-fix (which actually runs terraform apply). The AI remediation command generates a file for you to review first — the AI explains what it’s correcting and why, you verify it looks right, then you apply.
This matters in production. You want a human reviewing the fix before it touches infrastructure.
What’s Next
- Support for multi-workspace remediation plans in a single file
- Severity filtering (–min-severity high to only remediate critical and high drift)
- GitHub PR generation — auto-open a PR with the remediation file
tfdrift is open source (Apache 2.0). If you’re using it or have feedback, open an issue or drop a star on GitHub (https://github.com/sudarshan8417/tfdrift).