Any CI pipeline · Drop-in · 5 min setup

Your Terraform plan,
explained.

AI-narrated plan summaries with risk scoring — posted directly to your PR. Know what's changing. Know what it means. Apply with confidence.

Works with Atlantis, GitHub Actions, GitLab CI — or any pipeline that can POST JSON
terraform plan output
Terraform will perform the following actions:

  # aws_security_group.api will be updated in-place
  ~ resource "aws_security_group" "api" {
        id          = "sg-0a1b2c3d4e5f"
        name        = "api-sg"
      ~ ingress {
          ~ cidr_blocks      = [
              - "10.0.0.0/8",
              + "0.0.0.0/0",
            ]
            from_port        = 5432
            protocol         = "tcp"
            to_port          = 5432
        }
    }

  # aws_db_instance.primary must be replaced
  -/+ resource "aws_db_instance" "primary" {
      ~ engine_version       = "14.6" -> "15.4"
      ~ identifier           = "prod-db" -> "prod-db-v2"
      + deletion_protection  = true
        ...
        allocated_storage    = 100
        instance_class       = "db.t3.large"
    }

  # aws_ecs_service.api will be updated in-place
  ~ resource "aws_ecs_service" "api" {
      ~ desired_count = 2 -> 4
        id            = "arn:aws:ecs:..."
    }

Plan: 1 to add, 2 to change, 0 to destroy.
DriftWise analysis
Medium risk
3 changes · 1 needs immediate review before applying
One change opens database access to the public internet — likely unintentional and should be reviewed before apply. The RDS replacement will cause a brief outage during the upgrade window. The ECS scaling change is safe.

aws_security_group.api modified Review
Port 5432 (Postgres) ingress changed from internal VPC range to 0.0.0.0/0. This opens your database port to the public internet.
Confirm this is intentional — public database exposure is a common misconfiguration.
aws_db_instance.primary replace Downtime
Postgres upgrade from 14.6 to 15.4 requires instance replacement. Expect 2–5 minutes of downtime. Deletion protection will be enabled on the new instance.
aws_ecs_service.api modified Safe
Desired count doubled from 2 to 4. No replacement. Traffic will be served continuously during the update.
5min
to integrate any pipeline
5
risk levels scored
0
workflow changes required
plans on the Team tier
How it works

Three lines of config.
Instant intelligence.

Step 01
Add one step to your pipeline
Drop a single curl (or Python/Node) step into your existing workflow — Atlantis, GitHub Actions, GitLab CI, Jenkins, CircleCI, anywhere. No new tools, no new UI, no migration.
terraform show -json tfplan \
  | jq -Rs '{plan_json: .}' \
  | curl -sX POST \
  https://app.driftwise.ai/api/v2/orgs/$ORG/analyze \
  -H "x-api-key: $KEY" \
  -H "Content-Type: application/json" \
  -d @-
Step 02
Plan runs as normal
DriftWise receives the plan, parses the structured diff, and sends only what's relevant to the LLM. No secrets, no state files — just the change data.
Parsing plan...
Detected: 3 changes
Risk signals: 2 found
Generating narrative...
Step 03
Review the narrative
A plain-English summary with risk scoring is returned synchronously — printed in your pipeline logs, posted to the PR, or failed-on by risk level. Your team can review and decide in seconds.
DriftWise Analysis
Risk: Medium
3 changes · 1 flagged
→ View full analysis
The full picture

More than a plan analyzer.

DriftWise continuously scans your live cloud infrastructure, compares it to your Terraform state, and turns findings into actionable IaC — not just narratives.

Multi-cloud discovery

One scan enumerates every resource across AWS, GCP, and Azure using each provider's native inventory API. No per-type allowlist, no missed regions.

LLM remediation as Terraform

Drift doesn't just get described — DriftWise generates the HCL patch to bring state and reality back in sync. Every suggestion is validated against Terraform's parser before it's offered, and never auto-applied.

Risk policy you can override

Default classifiers catch the obvious problems. When your org knows better, custom policy rules pattern-match on attributes and rewrite the risk score — no fork, no pull request to us.

Plan noise filter

Known-benign Terraform plan churn — tags-only edits, default ordering swaps, provider version bumps — is structurally filtered before it ever reaches your PR review queue.

Scheduled scans with Slack

Run drift checks on a cron and post results straight to Slack. Catch manual console changes the morning after they happen — not in next quarter's audit.

Kubernetes operator

An optional in-cluster agent reports live Kubernetes resources to DriftWise, closing the loop between your Helm charts, your Terraform, and what's actually running.

Any CI, any runner

One HTTPS endpoint, one API key — works from Atlantis, GitHub Actions, GitLab CI, Jenkins, CircleCI, Buildkite, Azure Pipelines, or a shell script on a laptop. The GitHub App posts narratives back to the PR where reviewers already live; everywhere else, the response is yours to print, comment, or gate on.

Append-only audit log

Security-relevant mutations — API key creation and revocation, membership changes, billing events, SSO configuration — are written to an append-only audit log, scoped by org with RLS.

Identity: OIDC, SAML, SCIM

Authenticate via any OIDC provider. SAML 2.0 and SCIM user provisioning are available on Team and Enterprise through our Casdoor-backed identity layer. Email-domain allowlists fail closed — if the list is empty in production, the server refuses to boot.

Your model.
Your API key.

Anthropic
OpenAI
AWS Bedrock
Google Gemini
Azure OpenAI

Keys encrypted at rest

Your API key is stored per-organization, encrypted with AES-256-GCM before it ever hits the database. The master key lives in a KMS-protected Kubernetes secret, never in the repo. Keys are never logged, redacted from telemetry, and hard-deleted on removal.

Your data, your perimeter

Route LLM calls through your own cloud accounts. Plan data goes directly from DriftWise to your provider — no third-party relay.

Control your costs

Use your existing API credits and volume pricing. No markup on LLM usage — you pay your provider directly.

Configure once per org

Set your provider and key via PUT /api/v2/orgs/:id/llm-config. DriftWise handles prompt construction and response parsing. Provider errors surface directly — we never silently retry against our own account.

Data handling

What we send.
What we don't.

Plan data only. Sensitive values are redacted at the parser, before anything reaches the LLM. Your state files never leave your CI runner.

What reaches the LLM
  • Resource address (e.g. aws_security_group.web)
  • Action: create, update, delete, or replace
  • Resource type
  • Attribute diffs — with Terraform-marked sensitive values replaced by (sensitive) before the prompt is built
  • Risk flags from our static analyzer
What we never touch
  • Terraform state files (*.tfstate)
  • Cloud provider credentials
  • Raw HCL source and variable values
  • Sensitive attributes — we honor Terraform's sensitive = true markers natively
  • Hardcoded AWS access keys and Azure credential patterns — stripped from prompts as a second-layer defense, even if you forget to mark them sensitive

Retention

Scan history

Free: 24 hours · Team: 30 days · Enterprise: unlimited or custom.

LLM prompt traces

Debug records of the exact bytes sent to the model. Auto-deleted after 30 days for every plan.

BYOK direct path

If you bring your own key, prompts go straight from DriftWise to your provider — never relayed through a third-party model.

Risk scoring

Five levels.
Zero ambiguity.

None
No changes detected. Empty plan or no-op — nothing to review.
Low
Changes with no risk flags triggered. Routine config updates that don't trip our rules.
Medium
Side effects you should expect. Security group rule changes, logging disabled, deletion protection removed, backup retention reduced, cross-region moves.
High
Weakened security boundary or exposed data. Public ingress, public access enabled, encryption disabled, short KMS deletion windows, or forced replacement causing downtime.
Critical
Destructive or exposure-level changes. Stateful resource destruction (RDS, DynamoDB, S3, EFS, KMS, Secrets Manager), wildcard IAM permissions, or SSH open to the public internet.
Security posture

Hostile input in.
Safe actions out.

Every sensitive path assumes hostile input, fails closed on unexpected state, and is pinned by a regression test. These are in production today — not a roadmap item.

Isolated at the database

Every tenant query runs inside a Postgres transaction with a scoped session variable. Row-level security rejects cross-org reads at the database, not the application — even if the app layer forgets a WHERE org_id.

Hostile inputs, fenced at the boundary

User-supplied URLs are validated against a strict HTTPS + public-IP allowlist before any outbound request. Untrusted content sent to LLMs is wrapped in a typed envelope with fenced delimiters, and every call site has a regression test that plants injection sentinels. LLM output is never auto-applied to any system.

Secrets encrypted, telemetry scrubbed

Cloud credentials and BYOK keys are AES-256-GCM encrypted at rest; the master key lives in a KMS-protected Kubernetes secret. Emails, UUIDs, JWTs, API keys, and AWS key IDs are stripped from every telemetry event before it leaves the browser.

Start free.
Pay when it saves you.

Annual pricing: Team $1,490/yr (save 17%), +$120/yr per extra seat.

Free
$0
forever
  • 5 free AI analyses / week
  • Bring your own LLM for unlimited
  • 1 seat
  • 24-hour run history
  • Any CI pipeline (Atlantis, GHA, GitLab, Jenkins, …)
  • Risk scoring
  • PR comment output
  • SSO / SAML
  • Audit log
Get started free
Enterprise
Talk to us
custom contract
  • Everything in Team
  • Unlimited AI analyses (contract rate limit)
  • BYOK optional
  • Unlimited seats
  • Unlimited run history
  • Audit & compliance rules
  • SCIM provisioning
  • SLA + dedicated support
Contact us

Apply with confidence.

Add DriftWise to any CI pipeline in 5 minutes. Free forever, no card required.

Start free Read the docs