Engineer Builds Auto-Remediation Pipeline That Reverts Unauthorized AWS Tag Changes

A developer built an automated drift detection and remediation system on AWS that detects and reverses infrastructure changes made outside of Terraform. The pipeline uses CodeBuild, SNS, and Lambda to detect configuration drift, classify its severity, and trigger a Terraform apply only for low-risk, in-place updates. A custom classifier was updated to factor in both resource type and action type, so that updates on medium-risk resources like EC2 instances are treated as low severity, while deletions and replacements escalate to high. Deletions are deliberately excluded from auto-remediation and routed to manual review, ensuring human oversight for potentially intentional removals. Detection and remediation run as separate CodeBuild projects with distinct IAM roles, keeping the read-only drift detector isolated from any write operations.