Feature
Drift Detection & Reconciliation
Detect configuration drift and unmanaged resources across clouds, then reconcile with governed plans.
Drift is the difference between declared IaC state and what exists in connected clouds.
Left unmanaged, drift quietly increases operational risk: security settings change outside of IaC, network rules diverge, and teams lose confidence in “the truth.”
Detection workflow
OrchesTerra compares:
- Terraform/OpenTofu declared resources,
- against live cloud inventory and configuration signals,
- and classifies findings by severity and remediation type.
Reconciliation workflow
When reconciliation is required, OrchesTerra creates a governed plan that reviewers can understand:
- import unmanaged resources into IaC when appropriate,
- reconcile configuration drift back to declared state,
- or route “accept drift” decisions with expiry and justification.
Governance connection
Reconciliation is only safe when it’s reviewable.
OrchesTerra ties drift remediation into approval workflows so risky fixes aren’t executed blindly.
Related: governed reconciliation use case.
FAQ
What if drift is expected?
Some drift is normal (autoscaling patterns, expected operational changes). OrchesTerra classifies drift so expected deviations don’t drown out true risk.