{"slug": "i-built-an-ai-that-fixes-terraform-drift-automatically", "title": "I Built an AI That Fixes Terraform Drift Automatically", "summary": "Developer Sudarshan8417 released tfdrift remediate, a new command in the open-source tfdrift CLI that uses AI to automatically generate Terraform remediation files for infrastructure drift. The tool detects drift, classifies it by severity, and produces ready-to-review .tf files with inline explanations, supporting both Anthropic and OpenAI providers.", "body_md": "I Built an AI That Fixes Terraform Drift Automatically\n\nIf you've worked with Terraform long enough, you know the feeling. You run terraform plan and suddenly there are 12 unexpected changes. Someone tweaked an instance type in the console. A security group rule got added manually. A tag got removed. Your infrastructure drifted — and now you have to figure out what changed, why, and how to bring it back in line.\n\nDetecting drift is one thing. Actually fixing it is where engineers waste hours.\n\nThat's what I built tfdrift remediate to solve.\n\nWhat is tfdrift?\n\ntfdrift ([https://github.com/sudarshan8417/tfdrift](https://github.com/sudarshan8417/tfdrift)) is an open-source CLI for continuous Terraform and OpenTofu drift detection. It runs terraform plan across all your workspaces, classifies drift by severity (critical/high/medium/low), and sends alerts to Slack, Teams, or OpsGenie.\n\nVersion 0.5.3 ships a new command — tfdrift remediate — that takes detected drift and uses AI to generate a ready-to-review .tf remediation file.\n\nThe Problem With Fixing Drift Manually\n\nWhen drift is detected, the typical workflow is:\n\nFor 1-2 resources this is fine. For 10+ resources across multiple workspaces, it becomes a slow, error-prone process — especially when you're dealing with complex resource types like aws_security_group, aws_iam_role_policy, or azurerm_virtual_network.\n\nHow tfdrift remediate Works\n\nThe flow is simple:\n\ntfdrift remediate --path ./infra\n\nHere's what the interactive prompt looks like:\n\nFound 3 drifted resource(s):\n\nWhat would you like to remediate?\n\nA — All resources\n\nS — Select specific resources (comma-separated numbers)\n\nQ — Quit\n\nChoice [A]:\n\nChoose S and enter 1,3 to fix only the high-severity ones. Or hit A to generate remediation for everything.\n\nThe AI Output\n\nThe AI receives the full drift context — resource type, action needed, and every attribute that changed with its desired vs actual value. It outputs valid HCL with inline comments explaining each correction:\n\nresource \"aws_instance\" \"web\" {\n\ninstance_type = \"t3.medium\" # corrected: actual was t3.large\n\n# ... other attributes unchanged\n\n}\n\nresource \"aws_security_group\" \"app\" {\n\ningress {\n\nfrom_port = 443\n\nto_port = 443\n\nprotocol = \"tcp\"\n\ncidr_blocks = [\"10.0.0.0/8\"]\n\n}\n\n# ... other attributes unchanged\n\n}\n\nReview it, make any adjustments, then apply:\n\nterraform apply drift-remediation.tf\n\nDual AI Provider Support\n\ntfdrift remediate auto-detects which AI provider to use based on your environment variables:\n\nYou can also force a specific provider:\n\ntfdrift remediate --provider openai --path ./infra\n\nGetting Started\n\npip install 'tfdrift[ai]'\n\nexport ANTHROPIC_API_KEY=sk-ant-...\n\ntfdrift remediate --path ./infra\n\nexport OPENAI_API_KEY=sk-...\n\ntfdrift remediate --path ./infra\n\nOptional flags:\n\ntfdrift remediate --all\n\ntfdrift remediate --output my-fixes.tf\n\ntfdrift remediate --binary tofu\n\nWhy Not Just Run terraform apply?\n\ntfdrift remediate is not the same as tfdrift scan --auto-fix (which actually runs terraform apply). The AI remediation command generates a file for you to review first — the AI explains what it's correcting and why, you verify it looks right, then you apply.\n\nThis matters in production. You want a human reviewing the fix before it touches infrastructure.\n\nWhat's Next\n\ntfdrift is open source (Apache 2.0). If you're using it or have feedback, open an issue or drop a star on GitHub ([https://github.com/sudarshan8417/tfdrift](https://github.com/sudarshan8417/tfdrift)).", "url": "https://wpnews.pro/news/i-built-an-ai-that-fixes-terraform-drift-automatically", "canonical_source": "https://dev.to/sudarshan_thakur_1e141b99/i-built-an-ai-that-fixes-terraform-drift-automatically-p97", "published_at": "2026-08-23 17:37:22+00:00", "updated_at": "2026-08-23 17:43:27.709074+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "mlops"], "entities": ["tfdrift", "Terraform", "OpenTofu", "Anthropic", "OpenAI", "Slack", "Teams", "OpsGenie"], "alternates": {"html": "https://wpnews.pro/news/i-built-an-ai-that-fixes-terraform-drift-automatically", "markdown": "https://wpnews.pro/news/i-built-an-ai-that-fixes-terraform-drift-automatically.md", "text": "https://wpnews.pro/news/i-built-an-ai-that-fixes-terraform-drift-automatically.txt", "jsonld": "https://wpnews.pro/news/i-built-an-ai-that-fixes-terraform-drift-automatically.jsonld"}}