devops-drift-detector_skill

Overview

This skill detects and remediates infrastructure drift between IaC definitions and live cloud state with continuous monitoring and optional automated remediation. It produces drift reports, impact analysis, remediation plans, and an audit trail suitable for compliance and post-incident review. The skill supports Terraform, CloudFormation, Pulumi, and driftctl workflows.

How this skill works

The skill loads IaC state and compares it to live provider state using tool-native commands or driftctl. It classifies changes (added, modified, deleted), computes severity (high/medium/low) based on security, compliance and dependency impact, and generates a remediation plan (accept, revert, ignore). For policy-allowed cases it can execute remediation with pre-flight checks, post-validation scans, and audit logging.

When to use it

• You detect manual changes outside the IaC workflow or suspect untracked modifications
• Scheduled or pre-deployment drift scans (daily, weekly, or on-demand)
• Continuous compliance monitoring in regulated environments
• After provider API or IaC tool changes that may desynchronize state
• Post-incident investigations to identify unauthorized configuration changes

Best practices

• Always backup state files and take pre-flight snapshots before any automated remediation
• Classify remediation policy per environment: manual for prod, semi-auto for staging, auto for dev
• Map drifted resources to compliance controls to prioritize fixes by impact
• Require approval for high-severity network or IAM changes; auto-remediate low-severity tag changes
• Track drift trends and correlate with change tickets to find recurring root causes

Example use cases

• Quick single-workspace scan: terraform plan -refresh-only to detect and recommend reverting an unauthorized security group change
• Multi-stack scheduled scans: run driftctl across accounts, generate compliance report and trend dashboard
• Semi-automated remediation: require approval for high-risk steps, auto-apply low-risk fixes and log actions
• Incident response: produce timestamped drift report mapping violations to NIST/PCI controls for audit
• Targeted scans: filter by resource type or tags to monitor critical services (IAM, network, encryption)