I Built an AI That Fixes Terraform Drift Automatically

I Built an AI That Fixes Terraform Drift Automatically

If you've worked with Terraform long enough, you know the feeling. You run terraform plan and suddenly there are 12 unexpected changes. Someone tweaked an instance type in the console. A security group rule got added manually. A tag got removed. Your infrastructure drifted — and now you have to figure out what changed, why, and how to bring it back in line.

Detecting drift is one thing. Actually fixing it is where engineers waste hours.

That's what I built tfdrift remediate to solve.

What is tfdrift?

tfdrift (https://github.com/sudarshan8417/tfdrift) is an open-source CLI for continuous Terraform and OpenTofu drift detection. It runs terraform plan across all your workspaces, classifies drift by severity (critical/high/medium/low), and sends alerts to Slack, Teams, or OpsGenie.

Version 0.5.3 ships a new command — tfdrift remediate — that takes detected drift and uses AI to generate a ready-to-review .tf remediation file.

The Problem With Fixing Drift Manually

When drift is detected, the typical workflow is:

1. Look at the terraform plan output
2. Figure out which attributes changed
3. Manually update your .tf files to match desired state
4. Run terraform apply

For 1-2 resources this is fine. For 10+ resources across multiple workspaces, it becomes a slow, error-prone process — especially when you're dealing with complex resource types like aws_security_group, aws_iam_role_policy, or azurerm_virtual_network.

How tfdrift remediate Works

The flow is simple:

tfdrift remediate --path ./infra

1. Scans all your Terraform workspaces for drift
2. Lists every drifted resource with severity and number of changed attributes
3. Asks whether you want to fix everything or just specific resources
4. Calls AI (Claude or GPT-4o) with full drift context
5. Writes a drift-remediation.tf file you can review and apply

Here's what the interactive prompt looks like:

Found 3 drifted resource(s):

1. aws_instance.web 🔴 high — 2 attribute change(s)
2. aws_s3_bucket.logs 🟡 medium — 1 attribute change(s)
3. aws_security_group.app 🔴 high — 3 attribute change(s)

What would you like to remediate?
A — All resources
S — Select specific resources (comma-separated numbers)
Q — Quit

Choice [A]:

Choose S and enter 1,3 to fix only the high-severity ones. Or hit A to generate remediation for everything.

The AI Output

The AI receives the full drift context — resource type, action needed, and every attribute that changed with its desired vs actual value. It outputs valid HCL with inline comments explaining each correction:

drift-remediation.tf

Generated by tfdrift remediate

Drift detected: 3 resource(s) across 1 workspace(s)

aws_instance.web — instance_type drifted from t3.medium to t3.large

aws_security_group.app — ingress rules modified out-of-band

Restores instance type to desired state (was changed from t3.medium to t3.large in console)

resource "aws_instance" "web" {
instance_type = "t3.medium" # corrected: actual was t3.large
# ... other attributes unchanged
}

Removes manually added ingress rules

resource "aws_security_group" "app" {
ingress {
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = ["10.0.0.0/8"]
}
# ... other attributes unchanged
}

Review it, make any adjustments, then apply:

terraform apply drift-remediation.tf

Dual AI Provider Support

tfdrift remediate auto-detects which AI provider to use based on your environment variables:

• Set ANTHROPIC_API_KEY → uses Claude (preferred)
• Set OPENAI_API_KEY → uses GPT-4o (fallback)

You can also force a specific provider:

tfdrift remediate --provider openai --path ./infra

Getting Started

pip install 'tfdrift[ai]'

with Claude

export ANTHROPIC_API_KEY=sk-ant-...
tfdrift remediate --path ./infra

with OpenAI

export OPENAI_API_KEY=sk-...
tfdrift remediate --path ./infra

Optional flags:

Fix everything without the interactive prompt

tfdrift remediate --all

Custom output file

tfdrift remediate --output my-fixes.tf

Use OpenTofu instead of Terraform

tfdrift remediate --binary tofu

Why Not Just Run terraform apply?

tfdrift remediate is not the same as tfdrift scan --auto-fix (which actually runs terraform apply). The AI remediation command generates a file for you to review first — the AI explains what it's correcting and why, you verify it looks right, then you apply.

This matters in production. You want a human reviewing the fix before it touches infrastructure.

What's Next

• Support for multi-workspace remediation plans in a single file
• Severity filtering (--min-severity high to only remediate critical and high drift)
• GitHub PR generation — auto-open a PR with the remediation file

tfdrift is open source (Apache 2.0). If you're using it or have feedback, open an issue or drop a star on GitHub (https://github.com/sudarshan8417/tfdrift).