How does ops0 detect drift?

ops0 compares live cloud state, resource context, state files, and code expectations to surface changes that happened outside the expected workflow.

How does ops0 remediate drift safely?

ops0 helps teams understand blast radius, classify risk, and route remediation through Git, policy checks, and approval paths when needed.

How often does ops0 check for drift?

ops0 compares live state against Terraform state and code on a schedule, so drift is caught on a recurring basis rather than only when someone runs a plan by hand.

Can ops0 show exactly what changed when drift is found?

Yes. ops0 surfaces field-level before and after values, so you see the specific attributes that moved instead of just a resource flagged as changed.

How does ops0 prioritize which drift to fix first?

ops0 classifies each drift finding by severity and blast radius, so teams can act on the changes that put production at risk before the cosmetic ones, and route reconciliation through governed review.

Drift Prevention

Catch drift when reality stops matching code.

Name: ops0
Author: ops0

ops0 compares live infrastructure against state and code on a schedule, classifies what changed and why it matters, and routes reconciliation through review instead of guesswork.

Live state vs code

Scheduled scans

Before and after values

Blast radius before reconciling

ops0.ai/use-cases/drift-prevention

Compared

sources checked

Drifted

resources

Scans

this week

Unmanaged

found

Live statecheckout-prod-eks

Compared againstTerraform state + code

Last scan14 minutes ago

Reality Check

Drift starts when production stops matching the record.

Live state compared against Terraform state and code.

Catches console changes and hotfixes.

Field-level before and after values.

Drift detailHigh severity

Classified by what changed and what it touches, not just that it changed

ChangeSecurity group rule added outside review

ClassificationSecurity-sensitive

Blast radius3 dependent services

Recommended pathReview before reconciling

→ Review dependency graph before reconciling

Severity

Not every drift event deserves the same response.

Security-sensitive changes classified separately.

Blast radius uses dependency context.

Cost-impacting drift stays visible.

Policy

Attached

Cost impact

+$210 /mo

Approval

Required

Remediation pathGit review, not console

EvidenceAttached to change record

Review Path

Fixes go through review, not the dark.

Remediation runs the governed path.

Policy and approval attached.

Stays visible to owners.

How it works

From live change to reviewed fix.

Scan on schedule

Runs between deploys, not just at release, so drift cannot hide until the next ship.

Classify severity

Security-sensitive changes are separated from routine, expected drift.

Compute blast radius

Dependency-aware context shows what else a change touches before anyone reacts.

Route to review

Reconciliation carries policy and approval, not a silent one-off fix.

Scheduled

Scans

between deploys

Field-level

Diffs

before and after

Classified

Severity

security vs routine

Aware

Blast radius

dependency context

Governed

Reconciliation

policy and approval

Common questions

Infrastructure drift happens when live cloud resources no longer match the code, state, or expected configuration used to manage them.

Keep production
honest against code.

Drift gets caught early. The reviewed reconciliation path is what keeps it from coming back.

Explore Resource Graph