Terraform Sovereign Drift Auditor
Stop Guessing. Start Auditing Your Infrastructure-as-Code Integrity
Modern cloud architectures are built on “Sovereign Baselines,” but they are often compromised by manual “Console Drift.” Whether you are migrating away from Broadcom/VMware or hardening your hybrid-cloud, our auditor exposes non-deterministic risks hidden within your Terraform plans before they are deployed.
Key Features
- Deterministic Integrity Engine: Analyzes the calculated
plan.jsonto catch drift before it hits production. - Sovereign Compliance Check: Automatically identifies public databases, unencrypted storage, and open-world network ports.
- Instant Remediation Library: Don’t just find problems—fix them. Get the exact Terraform code required to align drifted resources.
- Privacy-First Auditing: Your infrastructure data never leaves your browser. All analysis happens locally for maximum security.
FAQ
- Is my plan.json data secure? Yes. The auditor uses a local JavaScript engine. No data is sent to Rack2Cloud servers or any third-party APIs.
- Which cloud providers are supported? Currently, the auditor is optimized for AWS-based Terraform plans, with Azure and GCP rules coming in Rule Set 04.
Technical FAQ
Q: How is my data handled during the audit?
A: We follow a “Local-Only” processing model. When you upload a plan.json, the analysis is performed entirely within your browser’s client-side memory. No infrastructure data is transmitted to our servers or any third-party APIs.
Q: Why audit the plan.json instead of the live environment?
A: Auditing the live environment is reactive. By auditing the plan.json, you catch drift before it is applied to production. This allows you to correct non-sovereign configurations in the code rather than manually rolling back changes in the console.
Q: What specific drift patterns does the auditor currently detect?
A: Version 2.7 focuses on high-risk Sovereign violations, including:
- Publicly Accessible RDS Instances: Flagging databases exposed to the public internet.
- S3 Bucket ACL Drift: Identifying buckets with
public-readpermissions that bypass sovereign data privacy standards.
Q: How does the “Remediation Library” generate HCL?
A: The engine parses the resource address and the faulty attribute from the JSON. It then maps these to a pre-validated HCL template, providing you with the exact block needed to overwrite the drifted state.
Q: Can this tool be integrated into a CI/CD pipeline?
A: The current version is a manual “Architect’s Workstation” utility designed for high-touch sovereignty reviews. For automated pipeline enforcement, we recommend utilizing our logic as a baseline for Open Policy Agent (OPA) or Sentinel policies.