I Built an AI That Fixes Terraform Drift Automatically
If you've worked with Terraform long enough, you know the feeling. You run terraform plan and suddenly there are 12 unexpected changes. Someone tweaked an instance type in the console. A security group rule got added manually. A tag got removed. Your infrastructure drifted — and now you have to figure out what changed, why, and how to bring it back in line. Detecting drift is one thing. Actually fixing it is where engineers waste hours.
That's what I built tfdrift remediate to solve.
What is tfdrift?
tfdrift (https://github.com/sudarshan8417/tfdrift) is an open-source CLI for continuous Terraform and OpenTofu drift detection. It runs terraform plan across all your workspaces, classifies drift by severity (critical/high/medium/low), and sends alerts to Slack, Teams, or OpsGenie.
Version 0.5.3 ships a new command — tfdrift remediate — that takes detected drift and uses AI to generate a ready-to-review .tf remediation file.
The Problem With Fixing Drift Manually
When drift is detected, the typical workflow is:
For 1-2 resources this is fine. For 10+ resources across multiple workspaces, it becomes a slow, error-prone process — especially when you're dealing with complex resource types like aws_security_group, aws_iam_role_policy, or azurerm_virtual_network. How tfdrift remediate Works
The flow is simple:
tfdrift remediate --path ./infra Here's what the interactive prompt looks like:
Found 3 drifted resource(s): What would you like to remediate?
A — All resources
S — Select specific resources (comma-separated numbers) Q — Quit
Choice [A]: Choose S and enter 1,3 to fix only the high-severity ones. Or hit A to generate remediation for everything.
The AI Output
The AI receives the full drift context — resource type, action needed, and every attribute that changed with its desired vs actual value. It outputs valid HCL with inline comments explaining each correction:
resource "aws_instance" "web" {
instance_type = "t3.medium" # corrected: actual was t3.large
} resource "aws_security_group" "app" {
ingress {
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = ["10.0.0.0/8"]
}
}
Review it, make any adjustments, then apply:
terraform apply drift-remediation.tf
Dual AI Provider Support
tfdrift remediate auto-detects which AI provider to use based on your environment variables:
You can also force a specific provider:
tfdrift remediate --provider openai --path ./infra Getting Started
pip install 'tfdrift[ai]'
export ANTHROPIC_API_KEY=sk-ant-...
tfdrift remediate --path ./infra
export OPENAI_API_KEY=sk-...
tfdrift remediate --path ./infra
Optional flags:
tfdrift remediate --all
tfdrift remediate --output my-fixes.tf
tfdrift remediate --binary tofu
Why Not Just Run terraform apply?
tfdrift remediate is not the same as tfdrift scan --auto-fix (which actually runs terraform apply). The AI remediation command generates a file for you to review first — the AI explains what it's correcting and why, you verify it looks right, then you apply.
This matters in production. You want a human reviewing the fix before it touches infrastructure.
What's Next
tfdrift is open source (Apache 2.0). If you're using it or have feedback, open an issue or drop a star on GitHub (https://github.com/sudarshan8417/tfdrift).