Infrastructure Drift Detection and Reconciliation Script Engine

Role: Cloud Infrastructure Operations Lead & GitOps Specialist

Context

• Cloud Provider Target: {{cloud_provider_target}}
• IaC Tooling Framework: {{iac_framework}}
• Drift Telemetry Source: {{drift_detection_log}}
• Remediation Execution Mode: {{reconciliation_mode}}
• Scheduled Window: {{maintenance_window_utc}}
• Notification Webhook: {{slack_alert_webhook}}

Task

Develop an idempotent automation script that parses drift signals from {{drift_detection_log}}, reconciles out-of-band resource modifications using {{iac_framework}} on {{cloud_provider_target}}, and posts real-time audit manifests to {{slack_alert_webhook}} during {{maintenance_window_utc}}.

Method

1. Authenticate with {{cloud_provider_target}} using temporary STS/IAM assume-role credentials.
2. Ingest and validate the schema of the {{drift_detection_log}} to catalog affected resource IDs and attribute deltas.
3. Verify that the current execution timestamp falls strictly inside {{maintenance_window_utc}} before mutating infrastructure.
4. Initialize {{iac_framework}} state locking to prevent concurrent pipeline deployments.
5. Generate a non-destructive speculative execution plan focused exclusively on the drifted resource identifiers.
6. Evaluate plan deltas against security guardrails; abort execution immediately if destructive replacements (e.g., database recreation) are detected.
7. Execute {{iac_framework}} targeted reconciliation according to {{reconciliation_mode}} (e.g., auto-remediation or dry-run validation).
8. Collect state checksums post-remediation to prove complete synchronization with Git main branch declarations.
9. Format a structured Markdown payload detailing reconciled resources and post it to {{slack_alert_webhook}}.

Constraints

• MUST halt execution immediately if destructive resource drops or recreating mutations are scheduled in plan.
• MUST NOT bypass state locking mechanisms during execution under any circumstance.
• Script operations must remain fully non-interactive and support headless CI/CD runner execution.
• All cloud credential interactions must use short-lived tokens without disk persistence.

Output format

Structure the deliverable into two mandatory segments:

1. PRE_REQUISITES: Execution engine prerequisites, IAM permission boundaries, and environment variable requirements.
2. RECONCILIATION_SCRIPT: Fully formatted, executable Bash/CLI script (under 260 lines) containing defensive checks, drift isolation logic, and Slack webhook payloads.

Self-review

• Verify that the maintenance window validation logic correctly parses UTC timestamps.
• Ensure the plan parser catches destroy/replace actions and triggers an early zero-mutation exit.
• Check that the Slack webhook payload handles special JSON characters without malforming the POST body.