I Built an AI That Fixes Terraform Drift Automatically

Developer Sudarshan8417 released tfdrift remediate, a new command in the open-source tfdrift CLI that uses AI to automatically generate Terraform remediation files for infrastructure drift. The tool detects drift, classifies it by severity, and produces ready-to-review .tf files with inline explanations, supporting both Anthropic and OpenAI providers.

I Built an AI That Fixes Terraform Drift Automatically If you've worked with Terraform long enough, you know the feeling. You run terraform plan and suddenly there are 12 unexpected changes. Someone tweaked an instance type in the console. A security group rule got added manually. A tag got removed. Your infrastructure drifted — and now you have to figure out what changed, why, and how to bring it back in line. Detecting drift is one thing. Actually fixing it is where engineers waste hours. That's what I built tfdrift remediate to solve. What is tfdrift? tfdrift https://github.com/sudarshan8417/tfdrift https://github.com/sudarshan8417/tfdrift is an open-source CLI for continuous Terraform and OpenTofu drift detection. It runs terraform plan across all your workspaces, classifies drift by severity critical/high/medium/low , and sends alerts to Slack, Teams, or OpsGenie. Version 0.5.3 ships a new command — tfdrift remediate — that takes detected drift and uses AI to generate a ready-to-review .tf remediation file. The Problem With Fixing Drift Manually When drift is detected, the typical workflow is: For 1-2 resources this is fine. For 10+ resources across multiple workspaces, it becomes a slow, error-prone process — especially when you're dealing with complex resource types like aws security group, aws iam role policy, or azurerm virtual network. How tfdrift remediate Works The flow is simple: tfdrift remediate --path ./infra Here's what the interactive prompt looks like: Found 3 drifted resource s : What would you like to remediate? A — All resources S — Select specific resources comma-separated numbers Q — Quit Choice A : Choose S and enter 1,3 to fix only the high-severity ones. Or hit A to generate remediation for everything. The AI Output The AI receives the full drift context — resource type, action needed, and every attribute that changed with its desired vs actual value. It outputs valid HCL with inline comments explaining each correction: resource "aws instance" "web" { instance type = "t3.medium" corrected: actual was t3.large ... other attributes unchanged } resource "aws security group" "app" { ingress { from port = 443 to port = 443 protocol = "tcp" cidr blocks = "10.0.0.0/8" } ... other attributes unchanged } Review it, make any adjustments, then apply: terraform apply drift-remediation.tf Dual AI Provider Support tfdrift remediate auto-detects which AI provider to use based on your environment variables: You can also force a specific provider: tfdrift remediate --provider openai --path ./infra Getting Started pip install 'tfdrift ai ' export ANTHROPIC API KEY=sk-ant-... tfdrift remediate --path ./infra export OPENAI API KEY=sk-... tfdrift remediate --path ./infra Optional flags: tfdrift remediate --all tfdrift remediate --output my-fixes.tf tfdrift remediate --binary tofu Why Not Just Run terraform apply? tfdrift remediate is not the same as tfdrift scan --auto-fix which actually runs terraform apply . The AI remediation command generates a file for you to review first — the AI explains what it's correcting and why, you verify it looks right, then you apply. This matters in production. You want a human reviewing the fix before it touches infrastructure. What's Next tfdrift is open source Apache 2.0 . If you're using it or have feedback, open an issue or drop a star on GitHub https://github.com/sudarshan8417/tfdrift https://github.com/sudarshan8417/tfdrift .