> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infraudit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Remediation Workflow: From Finding to Fix

> How InfraAudit remediations work: from AI-suggested action to approval, cloud API execution, and rollback — step by step through the full lifecycle.

InfraAudit's remediation system provides a structured, auditable path from a finding to a fix. Every remediation action goes through a defined lifecycle with optional approval gates, a pre-execution snapshot for rollback, and a complete audit trail.

## Lifecycle overview

```
suggested
    │
    ├── [if approval required]
    │       ↓
    │   pending_approval ──[rejected]──→ (closed)
    │       │
    │   [approved]
    │       │
    ▼       ▼
executing
    │
    ├── completed ──[within rollback window]──→ rolled_back
    │
    └── failed
```

Every created action starts in `suggested` state. From there, it either awaits approval (the default) or moves directly to execution.

## Create a remediation action

You can create a remediation action from several places:

* **Recommendations** — click **Apply fix** in the Recommendations section
* **Drift findings** — click **Apply remediation** in the Drift detail panel
* **Compliance failures** — click **Create remediation** from a failing control

<Tabs>
  <Tab title="CLI">
    ```bash theme={null}
    infraudit remediation suggest --finding drift:<drift-id>
    ```
  </Tab>

  <Tab title="API">
    ```bash theme={null}
    curl -X POST http://localhost:8080/api/v1/remediation \
      -H "Authorization: Bearer $TOKEN" \
      -H "Content-Type: application/json" \
      -d '{"finding_type": "drift", "finding_id": 42}'
    ```
  </Tab>
</Tabs>

## Review the suggested action

Every suggested action includes the following before you approve it:

* A plain-language description of what change will be made (for example, "Enable S3 server-side encryption on bucket `my-data-bucket`")
* The affected resource and its current configuration
* A pre-execution snapshot of the configuration — used for rollback if needed
* An estimated risk level: Low, Medium, or High, based on the scope of the change

## Approve and execute

By default, `REMEDIATION_REQUIRE_APPROVAL=true` moves the action to `pending_approval`. An authorized user must review and approve it before execution proceeds.

```bash theme={null}
# Approve a remediation action
infraudit remediation approve <action-id>

# Execute after approval
infraudit remediation execute <action-id>
```

When executed, InfraAudit calls the cloud provider API directly to apply the change. The action moves to `executing` and then to `completed` or `failed`. Examples of what execution does:

| Finding type                   | Cloud API call                        |
| ------------------------------ | ------------------------------------- |
| S3 bucket encryption drift     | `PutBucketEncryption`                 |
| Security group over-permission | `RevokeSecurityGroupIngress`          |
| IAM key rotation               | `CreateAccessKey` + `DeleteAccessKey` |
| RDS backup disabled            | `ModifyDBInstance`                    |

## Roll back a completed action

Within the rollback window (default: 30 minutes after completion), you can reverse the change:

```bash theme={null}
infraudit remediation rollback <action-id>
```

InfraAudit uses the pre-execution snapshot to reconstruct and apply the original configuration. Not all action types support rollback — check the action detail panel before relying on this. After the rollback window closes, manual reversal in the cloud console is required.

## Enable auto-execution

For teams that want fully automated remediation without manual approve-and-execute steps, disable the approval requirement:

```env theme={null}
REMEDIATION_REQUIRE_APPROVAL=false
```

Individual high-risk action types can still require approval even when global approval is off. Configure per-type overrides under **Settings → Remediation**.

<Warning>
  Auto-execution means InfraAudit will call cloud provider write APIs without a human review step. Enable this only for action types and resources where you're confident in the recommendations.
</Warning>

## Audit trail

Every state transition — `suggested → pending_approval → approved → executing → completed → rolled_back` — is logged with the user who performed it, a timestamp, and any comments they added. The audit log is accessible from the remediation detail panel and is included in exported compliance reports.