Terraform Can Detect Infrastructure Drift, But Fixing It Safely Remains Unsolved

Modern infrastructure tools like Terraform, kubectl, and Argo CD reliably detect configuration drift by comparing intended state with actual state, but the industry has yet to solve what comes next. The core challenge is that a diff cannot distinguish an accidental change from a deliberate emergency hotfix made by an engineer at 3am to prevent an outage. Remediation itself carries high risk, as re-applying Terraform plans against drifted infrastructure can destroy and recreate critical production resources like databases and load balancers. Compounding the problem, failed partial applies create noisy plan outputs that engineers learn to ignore, and drift findings pile up in dashboards with no clear ownership or triage process. Teams are left choosing between three imperfect responses: reverting to source-of-truth at the risk of breaking live fixes, updating the code to match reality and silently encoding undocumented changes, or simply ignoring the finding altogether.