Terraform Auto-Removes Manual AWS EC2 Tag

A developer tested an automatic remediation control loop that detects Terraform drift in AWS, classifies the severity, and runs a separate remediation pipeline to restore declared infrastructure. The pipeline uses a drift detector CodeBuild job that runs terraform plan, publishes structured changes via SNS, a Lambda that classifies changes (LOW/MEDIUM/HIGH) and, for eligible LOW non-deletion updates, starts a remediation CodeBuild job that runs terraform apply. The author adjusted the classifier to treat in-place updates on MEDIUM resources as LOW, separated detector and remediation IAM roles, ensured the correct Git commit is cloned for remediation, and observed that a manually added EC2 tag was removed when Terraform applied the Git-declared state.