How the remediation workflow works
1
Suggestion
A remediation action is created from a drift finding, vulnerability, or recommendation. The action describes exactly what change will be made — for example, “enable S3 bucket server-side encryption on
my-bucket”.2
Review
The action appears in the Remediation queue. You can see the full details: what will change, which resource is affected, and the severity of the underlying finding.
3
Approval
If approval is required (the default for actions affecting resources), an admin approves the action. You can leave a comment for audit trail purposes.
4
Execution
InfraAudit calls the cloud provider API to apply the fix. The status changes to
executing while the call is in progress, then to completed on success.5
Rollback window
After execution, a 30-minute rollback window opens. If the fix causes a regression, you can roll back within that window using the pre-execution configuration snapshot.
Remediation queue
In the sidebar, click Remediation. The queue shows:
Status values:
suggested, pending_approval, approved, executing, completed, failed, rolled_back.
Approving an action
Click the remediation action to review the full details, then click Approve.Executing a remediation
After approval, click Execute in the UI. If Auto-execute after approval is enabled in your settings, this step is skipped and execution begins automatically.Rolling back
Within the rollback window (30 minutes by default), click Rollback on a completed action. InfraAudit reverses the change using the configuration snapshot captured before execution.Approval settings
Configure remediation behavior under Settings → Remediation:Supported remediation types
CLI reference
Next steps
- Recommendations — the suggestions that generate remediation actions
- Drift detection — drift findings that can trigger remediations
- Alerts — configure notifications when remediations succeed or fail