GitHub-native · Terraform & OpenTofu

Runtime safety for the Terraform your agents write

DriftGuard reviews every Terraform and OpenTofu pull request — written by humans or AI agents — for cost, security, drift, and compliance, recalls prior incidents, and gates the merge on your policy.

TLS 1.3 + AES-256 at rest
EU data residency (GDPR)
Least-privilege cloud access — STS / Workload Identity
SOC 2 Type II — in progress
Security & compliance →

How it works

Run a governed PR review

Pick a scenario and step through what DriftGuard actually does when a Terraform pull request opens: parse the plan, run six analyses, evaluate your policy, and post a verdict — before the change reaches your cloud account.

acme/platform#482 · demo PR, not a live tenant
Add S3 bucket for build artifacts
opened by octocat
main.tf
resource "aws_s3_bucket" "assets" {
  bucket = "acme-build-artifacts"
+ acl    = "public-read"
}

Press start to run the review

Architecture

Six analyses, one merge verdict

When a pull request opens, DriftGuard parses the Terraform or OpenTofu plan and runs its analyses in parallel — cost, security, drift, and semantic memory — then evaluates your policy and posts a single allow / warn / block result as a GitHub Check.

  • Parallel analysis engines
  • Semantic incident recall
  • Deterministic policy gating
Pull request opened
Plan parsed
terraform plan → typed resource graph
Cost delta
Infracost diff vs. current state
Security scan
Checkov policy checks
Drift check
plan vs. live cloud state
Semantic recall
related past incidents
Policy gate
.github/driftguard.yml verdict
GitHub Check posted
[ plan → analyses → policy → check ]

Continuous compliance

Evidence on every pull request

Each analysis DriftGuard runs on a Terraform or OpenTofu change emits control evidence, so DORA, NIS2, ISO 27001 and SOC 2 audit trails are a by-product of normal review — not a separate spreadsheet exercise.

Evidence coverage of DriftGuard's pull-request checks against DORA, NIS2, ISO 27001 and SOC 2
CheckDORANIS2ISO 27001SOC 2
SecurityEvidence emittedEvidence emittedEvidence emittedEvidence emitted
CostPartial / advisoryNot applicablePartial / advisoryPartial / advisory
DriftEvidence emittedEvidence emittedEvidence emittedPartial / advisory
IAMEvidence emittedEvidence emittedEvidence emittedEvidence emitted
EncryptionPartial / advisoryEvidence emittedEvidence emittedEvidence emitted
NetworkEvidence emittedEvidence emittedPartial / advisoryPartial / advisory
Evidence emitted
Partial / advisory
Not applicable
Illustrative coverage

Evidence

Don’t trust the dashboard. Verify the evidence.

Below is the synthetic audit trail for the blocked PR from the simulator above, in the record shape documented at /docs/audit: each record commits to the hash of the one before it. This lab hashes every record with real SHA-256, via the Web Crypto API in your browser — it does not call DriftGuard’s servers and proves nothing about a live account’s audit log. It verifies chain integrity only; DriftGuard doesn’t currently claim cryptographic signatures on these records, and the export format is early access and may change.

audit-record.json · acme/platform#482loading…

    Verification

    1. 1. Manifest loaded — 0 records
    2. 2. Each record re-hashed with SHA-256 in your browser
    3. 3. Hash compared against the record’s stored value
    4. 4. prev_hash continuity checked against the prior record
    5. 5. Result: not yet run

    Pricing

    Start free, scale with your fleet

    Every plan includes cost, security, drift, and compliance checks on every pull request.

    OSS
    Free forever

    Self-host the analyzer. Community policies, 1 repo.

    Team
    €29 / repo / mo

    50 PR analyses / month, semantic memory, policy rules.

    Enterprise
    Custom

    Self-hosted, air-gapped, SSO/SCIM, dedicated SLA.

    Talk to the team

    Schedule a technical briefing

    Tell us about your environment and someone from the team will follow up to walk through DriftGuard for your Terraform, Kubernetes, or GitHub Actions workflows.

    FAQ

    Common questions

    What is DriftGuard?+

    DriftGuard is a GitHub App that automatically reviews your Terraform and OpenTofu pull requests — checking for infrastructure drift, security misconfigurations, and cost impact before you merge.

    How does DriftGuard detect Terraform drift?+

    DriftGuard compares your Terraform state against the real state of your cloud resources on every pull request, flagging changes made outside your IaC pipeline — like a manual console edit — before they surface as a surprise terraform plan diff.

    Does DriftGuard support OpenTofu as well as Terraform?+

    Yes. DriftGuard reviews both Terraform and OpenTofu pull requests using the same drift, cost, security, and policy checks.

    Is DriftGuard free to try?+

    Yes — DriftGuard has a free plan for individual repositories. Team and Enterprise plans add multi-repo policies, SSO, and audit retention.

    Ship Terraform your agents can't break.

    Install the GitHub App and DriftGuard reviews your next infrastructure pull request — cost, security, drift, and compliance — before it merges.

    DriftGuard — AI runtime safety for Terraform agents