Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Detect and remediate infrastructure drift between IaC definitions and live state with continuous monitoring and automated remediation.
.claude/skills/williamzujkowski-infrastructure-drift-detection-and-remediation/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-09 | ✗→✓ | ▲ Improved | 115% | 0% |
| case-11 | ✗→✓ | ▲ Improved | 241% | 0% |
| case-14 | ✗→✓ | ▲ Improved | 230% | 0% |
| case-21 | ✗→✓ | ▲ Improved | 84% | 0% |
| case-24 | ✗→✓ | ▲ Improved | 225% | 0% |
Trigger this skill when:
Outputs: Drift detection report with changed resources, remediation plan with impact analysis, compliance status, optional auto-remediation execution with audit trail.
Time normalization:
NOW_ET = 2025-10-25T21:30:36-04:00 (NIST/time.gov semantics, America/New_York, ISO-8601)Input validation:
Source freshness:
Abort conditions:
Scope: Single stack/workspace, on-demand drift check, common 80% case
terraform plan -refresh-only -detailed-exitcode to preview state refreshaws cloudformation detect-stack-drift --stack-name <name> then poll DescribeStackDriftDetectionStatuspulumi refresh --preview-only to compare desired vs actualdriftctl scan --from tfstate://<path> --to <provider> for multi-resource scanjson { "drift_detected": true, "tool": "terraform", "timestamp": "NOW_ET", "drifted_resources": 3, "severity": "high", "resources": [ {"id": "aws_security_group.web", "change": "ingress_rules_modified", "severity": "high"} ], "recommended_action": "revert" }
Token budget: ≤2k (state comparison, basic drift report)
Scope: Multiple stacks, scheduled detection, compliance reporting, semi-automated remediation
cloudformation-stack-drift-detection-check for automated compliancedriftctl scan --filter "Type=='aws_s3_bucket'" for resource-type scopingyaml remediation_plan: strategy: semi-automated steps:
resource: aws_security_group.web reason: Unauthorized ingress rule added (port 22 from 0.0.0.0/0) severity: high method: terraform apply approval: required
resource: aws_instance.app reason: Instance type upgraded via console (approved change ticket CHG-123) severity: low method: terraform import + update code approval: auto
resource: aws_s3_bucket.logs reason: Tags modified by automation (exemption EXEMPT-456) severity: low method: add lifecycle ignore_changes approval: auto estimated_duration: 15min rollback_plan: "terraform state backup + manual revert if apply fails"
--auto-approve (if fully-automated) or prompt for approvalToken budget: ≤6k (multi-stack scan, impact analysis, remediation plan, notifications)
Authoritative sources used:
When to revert drift vs accept drift:
Remediation approval thresholds:
Escalation triggers:
Abort conditions:
Required fields:
typescriptinterface DriftDetectionOutput { timestamp: string; // ISO-8601, NOW_ET tool: "terraform" | "cloudformation" | "pulumi" | "driftctl"; scope: string; // stack/workspace name or "all" drift_detected: boolean; drifted_resources: number; resources: DriftedResource[]; severity_summary: { high: number; medium: number; low: number; }; remediation_plan?: RemediationPlan; compliance_impact?: string[]; // Array of violated controls trend?: { drift_frequency: string; // "increasing" | "stable" | "decreasing" most_drifted_resources: string[]; }; audit_log_id?: string; // Reference to remediation execution log } interface DriftedResource { id: string; // Resource identifier type: string; // Resource type (aws_security_group, etc.) change_type: "added" | "modified" | "deleted"; severity: "high" | "medium" | "low"; changed_attributes: { attribute: string; before: any; after: any; }[]; recommended_action: "revert" | "accept" | "ignore"; } interface RemediationPlan { strategy: "manual" | "semi-automated" | "fully-automated"; steps: RemediationStep[]; estimated_duration: string; rollback_plan: string; } interface RemediationStep { action: "revert" | "accept" | "ignore"; resource: string; reason: string; severity: "high" | "medium" | "low"; method: string; // terraform apply, import, etc. approval: "required" | "auto"; }
Example output: See /skills/devops-drift-detector/examples/drift-detection-example.txt
yaml# Terraform drift detection with semi-automated remediation input: tool: terraform workspace: prod-webapp remediation_policy: semi-automated output: timestamp: "2025-10-25T21:30:36-04:00" tool: terraform scope: prod-webapp drift_detected: true drifted_resources: 2 resources: - id: aws_security_group.web type: aws_security_group change_type: modified severity: high changed_attributes: - attribute: ingress before: [{cidr: "10.0.0.0/8", port: 443}] after: [{cidr: "0.0.0.0/0", port: 22}] recommended_action: revert severity_summary: {high: 1, medium: 0, low: 1} remediation_plan: strategy: semi-automated steps: - action: revert resource: aws_security_group.web approval: required
Token budgets enforced:
Safety checks:
Auditability:
Determinism:
Terraform Drift Detection:
Pulumi Drift Detection:
AWS CloudFormation Drift:
driftctl:
Drift Management Best Practices:
Resource files:
/skills/devops-drift-detector/resources/drift-detection-config.yaml - Sample drift detection configuration/skills/devops-drift-detector/resources/remediation-workflow.yaml - Remediation workflow template/skills/devops-drift-detector/resources/compliance-mapping.json - Drift to compliance control mapping| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-01 | fail→fail | 10,529 | 8,016 | -24% | 1 | 1 | 0% | 2,687 | 5,653 | +110% | 0 | 0 | — |
case-02 | fail→fail | 17,294 | 11,829 | -32% | 1 | 1 | 0% | 3,526 | 6,544 | +86% | 0 | 0 | — |
case-03 | fail→fail | 12,944 | 11,281 | -13% | 1 | 1 | 0% | 3,090 | 6,289 | +104% | 0 | 0 | — |
case-04 | fail→fail | 21,591 | 12,577 | -42% | 1 | 1 | 0% | 4,601 | 6,543 | +42% | 0 | 0 | — |
case-05 | pass→pass | 6,382 | 6,431 | +1% | 1 | 1 | 0% | 1,251 | 4,843 | +287% | 0 | 0 | — |
case-06 | fail→fail | 7,691 | 7,469 | -3% | 1 | 1 | 0% | 1,582 | 5,397 | +241% | 0 | 0 | — |
case-07 | pass→pass | 8,836 | 8,597 | -3% | 1 | 1 | 0% | 2,137 | 5,891 | +176% | 0 | 0 | — |
case-08 | pass→pass | 9,138 | 6,358 | -30% | 1 | 1 | 0% | 2,141 | 5,125 | +139% | 0 | 0 | — |
case-09 | fail→pass | 11,654 | 5,686 | -51% | 1 | 1 | 0% | 2,314 | 4,982 | +115% | 0 | 0 | — |
case-10 | pass→pass | 12,222 | 7,995 | -35% | 1 | 1 | 0% | 2,777 | 5,394 | +94% | 0 | 0 | — |
case-11 | fail→pass | 8,101 | 5,486 | -32% | 1 | 1 | 0% | 1,443 | 4,922 | +241% | 0 | 0 | — |
case-12 | pass→pass | 9,310 | 6,366 | -32% | 1 | 1 | 0% | 1,969 | 5,162 | +162% | 0 | 0 | — |
case-13 | pass→pass | 8,002 | 6,400 | -20% | 1 | 1 | 0% | 1,639 | 5,119 | +212% | 0 | 0 | — |
case-14 | fail→pass | 7,259 | 6,180 | -15% | 1 | 1 | 0% | 1,551 | 5,116 | +230% | 0 | 0 | — |
case-15 | pass→pass | 8,593 | 7,112 | -17% | 1 | 1 | 0% | 1,921 | 5,213 | +171% | 0 | 0 | — |
case-16 | fail→fail | 9,090 | 5,921 | -35% | 1 | 1 | 0% | 2,060 | 4,922 | +139% | 0 | 0 | — |
case-17 | pass→pass | 8,217 | 7,205 | -12% | 1 | 1 | 0% | 1,682 | 5,322 | +216% | 0 | 0 | — |
case-18 | pass→pass | 8,475 | 6,491 | -23% | 1 | 1 | 0% | 1,522 | 5,061 | +233% | 0 | 0 | — |
case-19 | pass→pass | 11,104 | 7,014 | -37% | 1 | 1 | 0% | 1,807 | 4,919 | +172% | 0 | 0 | — |
case-20 | pass→pass | 10,440 | 7,112 | -32% | 1 | 1 | 0% | 1,836 | 4,945 | +169% | 0 | 0 | — |
case-21 | fail→pass | 15,640 | 7,627 | -51% | 1 | 1 | 0% | 2,864 | 5,274 | +84% | 0 | 0 | — |
case-22 | pass→pass | 5,733 | 3,288 | -43% | 1 | 1 | 0% | 977 | 4,276 | +338% | 0 | 0 | — |
case-23 | pass→pass | 7,394 | 6,418 | -13% | 1 | 1 | 0% | 1,646 | 5,044 | +206% | 0 | 0 | — |
case-24 | fail→pass | 6,824 | 7,601 | +11% | 1 | 1 | 0% | 1,717 | 5,586 | +225% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 24 cases were attempted. The headline lift of +21 percentage points is the difference between those two pass rates over the 24 comparable cases.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.