Terraform Drift Detection AI

Terraform Drift Detection

Initialising…

resources

Select a resource to inspect drift
and ask the AI assistant about it.

Insights

Loading…

Logs

All environments

Loading…

Add Terraform environment

Environment name

Terraform directory (absolute path on the server)

Folder on your computer

No folder selected

Reads .tf / .tfvars / .hcl / .tfstate files from the chosen folder in your browser and uploads them to the server so it can run terraform plan there. Nothing else in the folder is read or sent.

Git URL (https://) Access token

Branch Subdirectory (optional)

The token is stored on the server (never in this browser) and used only to clone/pull this repo. Each git-backed environment can use a different token, so repos in different accounts or orgs all work independently.

Create a fix PR on GitHub?

This asks Claude to rewrite the actual drifted resources in your .tf files to match live state, pushes a new branch with those real changes, opens a draft pull request on GitHub (github.com repos only), and posts the result to Slack if configured. Git-backed environments use their own stored token; other environments need GITHUB_TOKEN/GITHUB_REPOSITORY configured on the server.

Install the GitHub Action?

This opens a draft pull request on the environment's own repo, adding .github/workflows/drift-fix.yml and its helper script. The PR description lists which repo secrets (ANTHROPIC_API_KEY, cloud provider credentials, optionally SLACK_WEBHOOK_URL) need to be configured before it can run. The workflow itself only runs when manually triggered — nothing runs automatically once merged.

Run the GitHub Action now?

This triggers the repo's drift-fix.yml workflow on GitHub — it runs terraform plan there using the repo's own secrets, and if drift is found, asks Claude to fix it and opens a draft PR (independent of this server). Requires the workflow to already be installed on the repo's default branch.

GitHub Action run status —

Loading…

Environment variables —

Extra environment variables injected only when terraform runs for this environment — e.g. ARM_CLIENT_ID/ARM_CLIENT_SECRET/ARM_SUBSCRIPTION_ID/ARM_TENANT_ID for Azure, or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY for AWS. Lets each environment use a different cloud account.

Add or update (one KEY=VALUE per line — a blank value deletes that key; existing keys not listed here are left untouched)

Remove ?

This only removes from this dashboard's list of environments. It does not delete the cloned repo or uploaded files on this server, and does not touch anything on GitHub (the repo itself, any branches/PRs, or an installed workflow). You can re-add it later the same way you added it originally.

Running…

Waiting for output…