> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infraudit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Approve and apply automated infrastructure remediations

> Use InfraAudit's remediation queue to approve and apply automated fixes to drift and vulnerability findings, with a configurable rollback window.

Remediation lets InfraAudit apply fixes to your cloud infrastructure on your behalf. Every remediation action goes through a defined lifecycle — suggested, reviewed, approved, executed — with a rollback path if something goes wrong after execution.

## How the remediation workflow works

<Steps>
  <Step title="Suggestion">
    A remediation action is created from a drift finding, vulnerability, or recommendation. The action describes exactly what change will be made — for example, "enable S3 bucket server-side encryption on `my-bucket`".
  </Step>

  <Step title="Review">
    The action appears in the Remediation queue. You can see the full details: what will change, which resource is affected, and the severity of the underlying finding.
  </Step>

  <Step title="Approval">
    If approval is required (the default for actions affecting resources), an admin approves the action. You can leave a comment for audit trail purposes.
  </Step>

  <Step title="Execution">
    InfraAudit calls the cloud provider API to apply the fix. The status changes to `executing` while the call is in progress, then to `completed` on success.
  </Step>

  <Step title="Rollback window">
    After execution, a 30-minute rollback window opens. If the fix causes a regression, you can roll back within that window using the pre-execution configuration snapshot.
  </Step>
</Steps>

## Remediation queue

In the sidebar, click **Remediation**. The queue shows:

| Column       | Description                                                 |
| ------------ | ----------------------------------------------------------- |
| **Action**   | What the remediation will do                                |
| **Resource** | The affected resource                                       |
| **Source**   | The drift, vulnerability, or recommendation that created it |
| **Severity** | Severity of the underlying finding                          |
| **Status**   | Current status in the lifecycle                             |
| **Created**  | Timestamp                                                   |

Status values: `suggested`, `pending_approval`, `approved`, `executing`, `completed`, `failed`, `rolled_back`.

## Approving an action

Click the remediation action to review the full details, then click **Approve**.

```bash theme={null}
infraudit remediation approve <action-id>
```

## Executing a remediation

After approval, click **Execute** in the UI. If **Auto-execute after approval** is enabled in your settings, this step is skipped and execution begins automatically.

```bash theme={null}
infraudit remediation execute <action-id>
```

## Rolling back

Within the rollback window (30 minutes by default), click **Rollback** on a completed action. InfraAudit reverses the change using the configuration snapshot captured before execution.

```bash theme={null}
infraudit remediation rollback <action-id>
```

<Warning>
  After the rollback window expires, the action is locked and cannot be rolled back through InfraAudit. You'll need to reverse the change manually in the cloud console.
</Warning>

## Approval settings

Configure remediation behavior under **Settings → Remediation**:

| Setting                         | Description                                                               |
| ------------------------------- | ------------------------------------------------------------------------- |
| **Require approval**            | Enable or disable approval gates. Enabled by default.                     |
| **Auto-execute after approval** | Skip the manual execute step. The fix runs immediately after approval.    |
| **Rollback window**             | Duration of the rollback window: 5 to 120 minutes. Default is 30 minutes. |

## Supported remediation types

| Resource       | Actions                                                                      |
| -------------- | ---------------------------------------------------------------------------- |
| **S3**         | Enable server-side encryption, block public access, enable versioning        |
| **EC2**        | Remove overly permissive security group rules, enable termination protection |
| **IAM**        | Rotate access keys, remove unused access keys                                |
| **RDS**        | Enable Multi-AZ, enable automated backups, enable encryption                 |
| **Kubernetes** | Set resource limits and requests, enable pod security policies               |

## CLI reference

```bash theme={null}
# List pending remediations
infraudit remediation list

# Filter by status
infraudit remediation list --status pending_approval

# Approve
infraudit remediation approve <id>

# Execute
infraudit remediation execute <id>

# Rollback
infraudit remediation rollback <id>
```

## Next steps

* [Recommendations](/platform/recommendations) — the suggestions that generate remediation actions
* [Drift detection](/platform/drift-detection) — drift findings that can trigger remediations
* [Alerts](/platform/alerts) — configure notifications when remediations succeed or fail