---
title: "complyform remediate"
description: "Generate surgical Terraform patches for failing controls."
---

Generate surgical Terraform patches for failing compliance controls.

## Usage

```bash
complyform remediate [options]
```

## Options

| Flag | Type | Default | Description |
|---|---|---|---|
| `--controls` | string | all failing | Comma-separated control IDs to remediate (e.g., `CC6.1,CC6.7`) |
| `--output` | path | `./patches` | Output directory for `.tf` patch files |
| `--dry-run` | bool | `false` | Preview patches without writing |
| `--estimate-cost` | bool | `false` | Cost impact of remediation. Team+. |
| `--iam-analysis` | bool | `false` | Include IAM remediation patches (role narrowing). Team+. |
| `--open-pr` | bool | `false` | Create branch + commit patches + open PR on GitHub. Pro+. (SPEC-002) |
| `--pr-branch` | string | `complyform/{framework}-{timestamp}` | Override PR branch name |
| `--pr-repo` | string | inferred from git remote | Override GitHub repo (`owner/repo`) |
| `--pr-base` | string | repo default branch | PR target branch |
| `--pr-title` | string | auto-generated | Override PR title |
| `--pr-draft` | bool | `false` | Open as draft PR |
| `--interactive` | bool | `false` | Review each patch before writing. Requires TTY. Mutually exclusive with `--open-pr`. (SPEC-006) |

## Examples

Generate patches for all failing controls:

```bash
complyform remediate --frameworks=soc2 --output=./patches
```

Preview patches without writing:

```bash
complyform remediate --frameworks=soc2 --dry-run
```

Remediate specific controls:

```bash
complyform remediate --controls=CC6.1,CC7.5
```

Open a pull request with patches (Pro+):

```bash
complyform remediate --frameworks=soc2 --open-pr
```

Interactive review mode:

```bash
complyform remediate --frameworks=soc2 --interactive
```

## Related Commands

- [`validate`](/cli-reference/validate/) — Confirm patches pass compliance checks
- [`scan`](/cli-reference/scan/) — Discover resources before remediation
