# Drift Reconciliation

### What is drift?

In Infrastructure as Code (IaC) and cloud operations, **drift** is when the *actual* state of your environment diverges from the *expected* state defined by your intended configuration. Whether that configuration lives in code, policy, or an approved baseline. Drift usually happens when changes occur outside the normal change-management path. Over time, drift increases the risk of surprises, inconsistent environments, failed deployments, and security or compliance gaps because what’s running no longer matches what teams think is running.

### What Gomboc Drift Reconciliation does

Gomboc can reconcile drift when it’s notified and provided access to a Terraform plan file. Gomboc will show the exact code changes needed to make your Terraform configuration match what is deployed. This helps you:

* Keep your code in sync with manual changes
* Preserve “break-glass” updates made during incident response so they don’t get overwritten later
* Clearly demonstrate what needs to change back if the drift is unwanted (revert-to-code)

***

### HCP Terraform integration

HCP Terraform (Terraform Cloud) can run health assessments on a workspace to determine whether drift exists. When drift is detected, a webhook notification is sent to Gomboc. Gomboc then uses the plan output to determine the exact updates needed in your IaC and provides the deterministic fix to reconcile the drift.

### Integration setup

***

#### Step 1: Create an HCP Terraform team token

In [HCP Terraform](https://app.terraform.io/app/YOUR_ORG/settings/authentication-tokens), go to Organization Settings → Authentication Tokens and create a Team Token.

* Save the token value somewhere secure—you won’t be able to view it again.

<figure><img src="https://3084082483-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9X3GhAYjoqbnAMyhHhAr%2Fuploads%2FGcgbBUrvzGYpetAUa3Re%2FScreenshot%202026-03-05%20at%2011.22.52%E2%80%AFAM.png?alt=media&#x26;token=376e1f2a-18fb-485f-a568-a7679b948c5f" alt=""><figcaption></figcaption></figure>

***

#### Step 2: Create the integration in the Gomboc portal

In the [Gomboc Portal](https://auth.app.gomboc.ai/oauth/account/login), navigate to:

Settings → Integrations → Drift

Create a new drift integration and paste the HCP Terraform Team Token from Step 1.

<figure><img src="https://3084082483-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9X3GhAYjoqbnAMyhHhAr%2Fuploads%2FEi8R0rXHcgEi4DRHKMUu%2FScreenshot%202026-03-05%20at%2011.25.12%E2%80%AFAM.png?alt=media&#x26;token=d8f08be4-f5e5-4e51-b7b8-7236af7f6a4a" alt=""><figcaption></figcaption></figure>

***

#### Step 3: Copy the Webhook URL and HMAC token from Gomboc

After creating the integration, Gomboc will provide:

* A Webhook URL
* An HMAC token (shared secret used to sign webhook requests)

You’ll paste both into HCP Terraform in the next steps.

<figure><img src="https://3084082483-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9X3GhAYjoqbnAMyhHhAr%2Fuploads%2FLfLTGwnPEBZCtJLKr48o%2FScreenshot%202026-03-05%20at%2011.26.23%E2%80%AFAM.png?alt=media&#x26;token=bc143f6c-8760-4be7-b238-0b616ab2aea7" alt=""><figcaption></figcaption></figure>

***

#### Step 4: Enable health assessments on the HCP Terraform workspace

In HCP Terraform, open the target workspace and navigate to:

Workspace Settings → Health → Enable Health Assessments → Save

This is required for drift detection and drift notifications.

<figure><img src="https://3084082483-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9X3GhAYjoqbnAMyhHhAr%2Fuploads%2Fc7qjPMHKKwUEwsYjn6qn%2FScreenshot%202026-03-05%20at%2011.27.49%E2%80%AFAM.png?alt=media&#x26;token=cff84a83-8370-4b17-b5fc-992f5200873e" alt=""><figcaption></figcaption></figure>

***

#### Step 5: Create the HCP Terraform notification (webhook)

In the target workspace, navigate to:

Workspace Settings → Notifications → Create a Notification

Configure:

* Destination: Generic webhook
* Webhook URL: paste the Gomboc Webhook URL
* Token (optional): paste the Gomboc HMAC token (HCP Terraform uses this token to sign webhook payloads).

Under Workspace Events, choose Only certain events, then select:

* ✅ Drift detected

Under Run Events, select No events (unless you also want run lifecycle notifications).

Click Create a notification.

<figure><img src="https://3084082483-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9X3GhAYjoqbnAMyhHhAr%2Fuploads%2F4IkYckuTULKJilYCLT4G%2FScreenshot%202026-03-05%20at%2011.29.01%E2%80%AFAM.png?alt=media&#x26;token=881be7d3-6bcd-4ef4-b704-3b1ee44ab287" alt=""><figcaption></figcaption></figure>

***

### Reconciliation steps

***

#### **Step 1: Find the drift event in the Gomboc Portal**

In Gomboc:

* Go to **Drift**  page
* Open the workspace associated with the drift

<figure><img src="https://3084082483-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9X3GhAYjoqbnAMyhHhAr%2Fuploads%2FxzytNwNGsevNuNU5gBY9%2FScreenshot%202026-03-07%20at%2010.07.54%E2%80%AFAM.png?alt=media&#x26;token=3a619587-5546-49cb-82ac-05bfbdd5686a" alt=""><figcaption></figcaption></figure>

* Select the most recent drift run from the workspace details page run history

<figure><img src="https://3084082483-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9X3GhAYjoqbnAMyhHhAr%2Fuploads%2FUuJZ02ny4n94CORW4F5d%2FScreenshot%202026-03-07%20at%2010.15.32%E2%80%AFAM.png?alt=media&#x26;token=c3e45ff6-9a62-4f98-bdf4-7b4c2b2aa283" alt=""><figcaption></figcaption></figure>

***

#### **Step 2: Review the proposed reconciliation changes**

* Click on the drift run and Gomboc will show the exact IaC edits needed to make your Terraform configuration match what’s deployed

<figure><img src="https://3084082483-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9X3GhAYjoqbnAMyhHhAr%2Fuploads%2FeUd9z1hOBsM2mcpoKe02%2FScreenshot%202026-03-07%20at%2010.20.27%E2%80%AFAM.png?alt=media&#x26;token=73be1e70-55e7-4dc8-8d22-7c0fd4279eb5" alt=""><figcaption></figcaption></figure>

***

#### **Step 3: Generate a PR with “Deliver fixes”**

* Click **Deliver fixes** to create a side PR containing the reconciliation changes&#x20;

<div><figure><img src="https://3084082483-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9X3GhAYjoqbnAMyhHhAr%2Fuploads%2FeQEi3IDxcuThezjRGVQz%2FScreenshot%202026-03-07%20at%2010.25.11%E2%80%AFAM.png?alt=media&#x26;token=eb9a1075-857c-4499-8654-5811c0dc14db" alt=""><figcaption></figcaption></figure> <figure><img src="https://3084082483-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9X3GhAYjoqbnAMyhHhAr%2Fuploads%2FPAhp2XsvF1Al4JKmIUNT%2FScreenshot%202026-03-07%20at%2010.25.29%E2%80%AFAM.png?alt=media&#x26;token=99748fe2-cc4c-4154-bd32-d6919d936b46" alt=""><figcaption></figcaption></figure></div>

***

#### **Step 4: Verify drift is resolved**

Run Start health assessment again in HCP Terraform and confirm the workspace returns to a healthy/no-drift state