Infrastructure drifting from its Terraform configuration

When a plan shows changes nobody made in code, applying it is the quick way to make the drift go away, but it can undo a change someone made on purpose. 2501 works out why the infrastructure drifted, and reconciles it only when Terraform is clearly the source of truth.

Someone changed a setting by hand during an incident, a script adjusted a resource, or a second stack manages the same one. Whoever runs the next plan has to decide which side is right.

What 2501 does

The Terraform specialty establishes what drifted and why before anything changes. When Terraform is clearly the source of truth, it reconciles by applying exactly the plan it reviewed. When the change looks deliberate, or the answer is ambiguous, it stops and escalates with its findings. The report lists what drifted, the likely cause and what, if anything, was applied. Terraform and OpenTofu stacks are handled alike.

You stay in control

• You choose the level: investigate only, act after a person confirms, or act on its own within your rules. The level is set per specialty, not per ticket.
• Replacements wait for a person: a plan that would replace or delete a database, load balancer or other stateful resource is held for a decision however the ticket is worded, with what to back up first.
• State is never forced: it never edits state by hand, never forces a lock another run still holds and never tears down a whole stack.
• Your access is the hard limit: give the agent its own credentials, scoped to the stacks it handles, and your rules decide which stacks may change unattended.

Frequently asked

Why not just apply the plan? Applying it puts back whatever the code says, including over a fix someone made by hand during an incident. The cause decides whether the code or the infrastructure should change.

Can it check for drift without changing anything? Yes. In investigate-only mode it reports each drifted resource and the likely reason, and applies nothing.

Related

• Terraform Operator
• Failed CI run: flaky or real?
• Guardrails: what an agent may never touch