Auto-remediation

For 124 recommendation rules (28 fully automatic + 96 guided with type-to-confirm), ZopNight can apply the suggested fix for you; no console-hopping, no scripts to copy. Click Remediate, walk through the wizard, and ZopNight runs the cloud API call, validates the result, and writes a row to the audit log.

The rules that aren’t auto-remediable still get a numbered “How to fix” playbook on the same card. Either way, you finish the loop inside ZopNight.

What’s auto-remediable today

124 rules across several families:

Family	Provider(s)	Flow	What ZopNight does
Start / Stop	AWS, GCP, Azure	Auto	Toggle a resource’s running state
Pause	Azure (Synapse Pool, ML Compute, Data Factory, Cognitive Services, Databricks Cluster), GCP Dataproc	Guided	Move the resource to its paused billing tier
Resize / Rightsize	AWS, GCP, Azure	Guided	Apply a smaller instance type or scaling configuration
Lifecycle setting	AWS, GCP, Azure (incl. Azure Hybrid Benefit)	Guided	Flip a reversible cost/licensing setting or storage lifecycle policy
K8s manifest patch	EKS, GKE, AKS	Guided	Scale a single-replica production Deployment 1→2 (never auto; ZopNight never auto-scales a workload you chose as a singleton)
Delete (orphan)	AWS (orphan snapshots), GCP (orphan disks)	Guided	Remove resources that have no attachment and no recent state

The remaining rules render as advisory: the recommendation card shows a “How to fix” playbook with explicit steps for your cloud console or Terraform.

The Remediate wizard

Clicking Remediate on any auto-remediable card opens a three- or four-step wizard.

1. Precondition

   ZopNight verifies the cloud-side state matches what the recommendation assumed. If the resource has changed since the recommendation was computed (manually restarted, terminated, moved to a different account), the wizard surfaces the drift and asks you to refresh the recommendation before proceeding.

2. Approval (destructive operations only)

   For Pause and Delete operations, an admin must approve via the wizard or via an email link before ZopNight runs the cloud API call. The Start/Stop operations skip this step when an admin initiates them; a non-admin initiator still hits the admin-approval gate. Approval emails go through the central notification service with a stable step UUID, so deep-links survive future template changes.

3. Execute

   ZopNight calls the cloud API. The wizard shows the call status in real time. If the call fails, you get a typed error; see Error categories below.

4. Validate

   ZopNight reads the resource back from the cloud API and confirms the change took effect. A successful Validate flips the recommendation to Optimised.

Auto vs Guided

Of the 124 auto-remediable rules, 28 run end-to-end with no human in the wizard (Auto) and 96 ask for a type-to-confirm gate before the destructive step (Guided).

• Auto: Start/Stop on dev/test resources with low blast radius. Wizard shows progress, you watch. (A non-admin initiator still hits an admin-approval gate.)
• Guided: Pause, Delete, Resize, lifecycle changes, and K8s manifest patches on production-shape resources. Wizard adds a type-to-confirm modal with an impact preview before executing.

Both flow types render the same Remediate button. The difference is what happens after you click it.

Error categories

If the cloud API call fails, ZopNight categorises the error and renders the wizard accordingly.

Subscription IDs, AWS account IDs, GCP project IDs, and Azure SDK divider lines are stripped from error messages before persistence so audit logs don’t carry sensitive identifiers.

Rollback

For reversible operations, ZopNight stores the previous configuration in the workflow row. If you need to roll back, the recommendation’s audit row gives you the exact state to restore; minimum/maximum capacity, instance type, scheduled actions, policy names, and provider-specific raw spec for autoscaler policies.

Operation	Reversible?
Start	Yes. Stop
Stop	Yes. Start
Pause (Azure Synapse, ML Compute, Data Factory, Cognitive Services, Databricks)	Yes. Restore
Pause (GCP Dataproc)	No. Dataproc pause is terminal; ZopNight surfaces this explicitly before you confirm.
Delete	Generally no; undeleting orphan disks is cloud-provider-specific

Notifications

The remediation flow integrates with the notification service:

• Approval-required emails go to the configured admin channel via remediation_approval_required; subject [ZopNight] Remediation approval needed. Guarded by NotifiedAt so a reconciler-replayed step never re-sends.
• Terminal success/failure emails are gated behind an environment-level toggle to avoid noise. Ask support to enable if you want them.

Where to see remediation history

Every remediation workflow is in two places:

1. provisioning_jobs table (the workflow row): kind, subject, status, start/end timestamps, error category
2. remediation_audit table: append-only mirror of every state transition for compliance/SOC-2 evidence

The audit log surfaces a row per state transition, including who approved and who rejected. CSV export is available from the Audit Logs page in the app.

Advisory rules

For the rules that aren’t auto-remediable (the balance of the 490-rule catalogue), the recommendation drawer renders a numbered “How to Fix” playbook. Steps are written for the cloud console where possible, with Terraform / CLI variants when they exist.

The playbook is the same content that would have driven an auto-remediation if one existed; the only difference is whether ZopNight runs the call or you do.