Runtime safety for
the Terraform your agents write
DriftGuard reviews every Terraform and OpenTofu pull request — written by humans or AI agents — for cost, security, drift, and compliance, recalls prior incidents, and gates the merge on your policy.
How it works
Run a governed PR review
Pick a scenario and step through what DriftGuard actually does when a Terraform pull request opens: parse the plan, run six analyses, evaluate your policy, and post a verdict — before the change reaches your cloud account.
resource "aws_s3_bucket" "assets" {
bucket = "acme-build-artifacts"
+ acl = "public-read"
}Press start to run the review
Architecture
Six analyses, one merge verdict
When a pull request opens, DriftGuard parses the Terraform or OpenTofu plan and runs its analyses in parallel — cost, security, drift, and semantic memory — then evaluates your policy and posts a single allow / warn / block result as a GitHub Check.
- Parallel analysis engines
- Semantic incident recall
- Deterministic policy gating
Continuous compliance
Evidence on every pull request
Each analysis DriftGuard runs on a Terraform or OpenTofu change emits control evidence, so DORA, NIS2, ISO 27001 and SOC 2 audit trails are a by-product of normal review — not a separate spreadsheet exercise.
| Check | DORA | NIS2 | ISO 27001 | SOC 2 |
|---|---|---|---|---|
| Security | Evidence emitted | Evidence emitted | Evidence emitted | Evidence emitted |
| Cost | Partial / advisory | Not applicable | Partial / advisory | Partial / advisory |
| Drift | Evidence emitted | Evidence emitted | Evidence emitted | Partial / advisory |
| IAM | Evidence emitted | Evidence emitted | Evidence emitted | Evidence emitted |
| Encryption | Partial / advisory | Evidence emitted | Evidence emitted | Evidence emitted |
| Network | Evidence emitted | Evidence emitted | Partial / advisory | Partial / advisory |
Evidence
Don’t trust the dashboard. Verify the evidence.
Below is the synthetic audit trail for the blocked PR from the simulator above, in the record shape documented at /docs/audit: each record commits to the hash of the one before it. This lab hashes every record with real SHA-256, via the Web Crypto API in your browser — it does not call DriftGuard’s servers and proves nothing about a live account’s audit log. It verifies chain integrity only; DriftGuard doesn’t currently claim cryptographic signatures on these records, and the export format is early access and may change.
Verification
- 1. Manifest loaded — 0 records
- 2. Each record re-hashed with SHA-256 in your browser
- 3. Hash compared against the record’s stored value
- 4. prev_hash continuity checked against the prior record
- 5. Result: not yet run
Pricing
Start free, scale with your fleet
Every plan includes cost, security, drift, and compliance checks on every pull request.
Self-host the analyzer. Community policies, 1 repo.
50 PR analyses / month, semantic memory, policy rules.
Self-hosted, air-gapped, SSO/SCIM, dedicated SLA.
Talk to the team
Schedule a technical briefing
Tell us about your environment and someone from the team will follow up to walk through DriftGuard for your Terraform, Kubernetes, or GitHub Actions workflows.
Common questions
What is DriftGuard?+
DriftGuard is a GitHub App that automatically reviews your Terraform and OpenTofu pull requests — checking for infrastructure drift, security misconfigurations, and cost impact before you merge.
How does DriftGuard detect Terraform drift?+
DriftGuard compares your Terraform state against the real state of your cloud resources on every pull request, flagging changes made outside your IaC pipeline — like a manual console edit — before they surface as a surprise terraform plan diff.
Does DriftGuard support OpenTofu as well as Terraform?+
Yes. DriftGuard reviews both Terraform and OpenTofu pull requests using the same drift, cost, security, and policy checks.
Is DriftGuard free to try?+
Yes — DriftGuard has a free plan for individual repositories. Team and Enterprise plans add multi-repo policies, SSO, and audit retention.
Ship Terraform your agents can't break.
Install the GitHub App and DriftGuard reviews your next infrastructure pull request — cost, security, drift, and compliance — before it merges.