When to run it
Terraform plans that show unexpected changes, “do not run apply on this workspace” warnings, or an audit asking whether infrastructure matches its definition.
What is deployedshould match what is declared.
Reconciling infrastructure drift
The playbook in one paragraph
Hot-fixes in the console and manual changes pile up until Terraform plans become scary. Ana finds every drifted resource, decides with you whether code or cloud is right, and brings them back in line.
Works with
- Terraform, OpenTofu, Pulumi or CloudFormation
- State backends
- AWS, Azure and GCP (read-only)
- CI/CD pipelines
What Ana needs from you
- Workspaces and accounts in scope
- Which side wins by default for each resource type
- Change windows for applies
How Ana runs it
Step by step.
5 steps from trigger to done - each one visible to your team as it happens.
- 01
Detect drift everywhere
Ana runs plans across every workspace and compares state with live resources, including resources that exist in the cloud but in no state file.
- 02
Explain each difference
For every drifted attribute Ana finds who or what changed it and when, using cloud audit logs, so the decision is informed.
- 03
Decide the direction
Ana proposes whether to update the code to match reality or revert the cloud to match code; owners confirm per resource or per rule.
- 04
Reconcile
Ana opens IaC PRs, imports unmanaged resources, and schedules applies in your change windows through your pipeline.
- 05
Watch for new drift
Scheduled drift checks report new differences with their cause as soon as they appear.
Who approves what
Approval gates
- Code-vs-cloud direction
- Resource owner
- Apply
- Your pipeline and change window
- Importing resources
- Platform owner
What you get
Deliverables
- 01A drift inventory with root causes
- 02IaC PRs and imports
- 03Scheduled drift detection
- 04Clean, trusted plans
What usually goes wrong
And how Ana handles it.
Risk
Reverting a hot-fix that kept production up
Ana surfaces why a change was made before proposing to revert it.
Risk
State surgery gone wrong
Imports and moves are proposed as reviewed changes, never edited directly in state.
FAQ
Common questions.
No. Changes go through code, imports and your pipeline.
Keep going
Related playbooks.
SRE / DevOps
From a 3 a.m. page to root cause and fix
An alert pages the on-call engineer. By the time they open the laptop, Ana has correlated metrics, logs, traces and recent deploys, named the likely cause, and drafted the remediation for approval.
Read the playbook →Security
Fixing cloud misconfigurations at the source
Your CSPM tool flags public buckets, wide IAM policies and open security groups. Ana traces each one back to the infrastructure-as-code that created it, fixes it there, and stops it from coming back.
Read the playbook →Software
Upgrading a framework across dozens of services
A major framework or runtime version is going end-of-life and it touches every service. Ana plans the migration, upgrades each service in its own branch, fixes what breaks, and hands your team small, tested pull requests instead of one terrifying diff.
Read the playbook →See it in your stack
Run this playbook on your systems.
Thirty minutes, your repositories and cloud, one real instance of this job.