NSync: Automated Cloud Infrastructure-as-Code Reconciliation with AI Agents

Abstract

Cloud infrastructure is managed through a mix of interfaces—traditionally, cloud consoles, command-line interfaces (CLI), and SDKs are the tools of choice. Recently, Infrastructure-as-Code/IaC frameworks (e.g., Terraform) have quickly gained popularity. Unlike conventional tools, IaC frameworks encode the infrastructure in a ”source-of-truth” configuration. They are capable of automatically carrying out modifications to the cloud—deploying, updating, or destroying resources—to bring the actual infrastructure into alignment with the IaC configuration. When IaC frameworks are used together with consoles, CLI, or SDKs, IaC is unaware of changes through these non-IaC interfaces, and the IaC configuration no longer captures the intended state. This is called infrastructure drift. IaC frameworks will revert non-IaC changes based on the outdated IaC configuration, leading to misconfigurations or failures. We propose NSync, an automated system for IaC reconciliation, which aims to propagate out-of-band changes back to the IaC program in the form of an update. Our key insight is that infrastructure changes via IaC, consoles, CLI, or SDK eventually all occur via cloud API invocations—the lowest layer for cloud management operations. Hence, NSync gleans insights from API traces to detect drift (i.e., non-IaC changes) and reconcile it (i.e., update the IaC configuration to capture the changes). This is a challenging task—identifying the intended change from low-level, noisy API traces is not easy; moreover, because of the criticality of cloud infrastructure, NSync cannot directly test the synthesized updates in a live environment. NSync addresses these challenges using an agentic design. It infers high-level infrastructure change intent from cloud API sequences with the help of LLMs, and synthesizes targeted IaC updates using domain-specific context management with customized agent tooling; it further maintains an evolving knowledge base of past successful reconciliation runs, reusing prior insights to achieve higher accuracy on future tasks. In addition to system design, we contribute a novel evaluation pipeline for injecting drift into cloud infrastructure and assessing reconciliation attempts, by sourcing scenarios from authoritative cloud operation examples and transplanting them into an IaC-centric framework. Experiments across five real-world Terraform projects and 372 drift scenarios show that NSync outperforms the baseline both in terms of accuracy (from 0.71 to 0.97 pass@3) and token efficiency (1.47× improvement).