How to create and execute a remediation action

Roles and Guardrails

Allowed roles: Admin, FinOps, Security. Action requests go through conflict checks, and most actions default to manual approval mode.

Execution Workflow

1. 1. Open finding in `Findings` or `Cost Savings`.
2. 2. Confirm the impacted resource, detection context, and recommended action type.
3. 3. Submit action request (or execute now if policy allows).
4. 4. Approve request if pending approval chain.
5. 5. Track status in `Actions` until `completed` or `failed`.
6. 6. Re-scan the scope when the provider action changes cloud state.

Conflict Checks

Before execution, TurboFinOps checks for IaC ownership tags, freeze windows, policy protection flags and ticket requirements. If a conflict is detected, the action is blocked or sent back for explicit Admin review depending on organization policy.

Verification

• Action execution contains provider response metadata.
• Finding status updates according to remediation result.
• Audit logs include actor, correlation ID, and execution timestamps.
• Evidence artifacts or export records can be generated for audit review.

Rollback Path

For compatible actions, rollback plans are attached to execution records. Use rollback controls from `Actions` page to restore previous state when needed.