Epic: Auto-remediate governance bypass and IaC drift via Terraform

TL;DR: Detect unmanaged/drifted AWS resources on a schedule and reconcile them by running Terraform itself, so policy violations (like an open port 22) don't stay live between manual syncs.

User story

As a security engineer, I want out-of-band changes and config drift auto-detected and reverted, so governance bypasses don't sit unresolved until someone notices.

Acceptance criteria

• Sync runs automatically on a schedule
• Attribute-level drift on managed resources is detected
• Backend can run terraform apply/import/destroy unattended
• Policy-violating resources are auto-reconciled via Terraform, not direct AWS API calls

How to verify

Hand-create a security group rule opening port 22 to 0.0.0.0/0 directly via AWS API (bypassing Terraform). Wait one scheduled cycle. Confirm it's destroyed with no human action.

Out of scope

• Direct AWS API mutation (e.g. RevokeSecurityGroupIngress) — remediation always goes through Terraform

Sub-tickets

• #31 Run Sync automatically on a schedule
• #32 Detect attribute-level drift on managed resources
• #33 Add unattended terraform apply/import/destroy execution
• #34 Auto-reconcile policy violations via Terraform

Start by reading sub-tickets #31–#34, then use the acceptance criteria and the port-22 verification scenario to understand the required behavior. Done means scheduled drift detection reconciles violations through unattended Terraform operations, without direct AWS API mutation.