IaC + AI Agents: Your CMDB Finally Alive

August 14, 2026 · Baoss
BAOSS IT consulting: live CMDB with IaC and AI agents on hybrid infrastructure

IaC + AI Agents: Your CMDB Finally Alive in 2026 (and Not an Excel Graveyard)

January 2021. Back then, we published on BAOSS how to use ansible_facts to dump package and hardware inventory to JSON and version it in Git. Clever, artisanal and, let’s be honest, insufficient for 2026. Today, an average client of ours manages 1,200+ workloads across AWS, Azure, GCP, on-prem and edge. The traditional CMDB is static, manual and disconnected from reality. That is why it has become the biggest brake on SOC2 audits, incident response (AI cybersecurity) and FinOps. That is why, at BAOSS IT consulting, we solve it by combining IaC and AI agents so that the CMDB lives in real time.

The real 2026-2027 problem is not “collecting data”. In other words, it is about maintaining a living, queryable and actionable source of truth. Meanwhile, infrastructure mutates every 11 minutes (average deployment rate across our enterprise clients). The solution is no longer a cron playbook, however. It is a configuration intelligence pipeline where IaC, GitOps and autonomous agents (LangGraph, CrewAI, AutoGen) feed a knowledge graph. Teams then query that graph through LLMs (GPT-4o, Claude 4, local vLLM/Ollama models) via RAG and MCP.

Why Your CMDB Smells of Mothballs: the BAOSS IT Consulting Lesson (2025 data)

  • Invisible drift: 68% of severe incidents at BAOSS clients in 2026-2027 had a root cause in configuration not reflected in the CMDB (source: anonymized Post-Incident Reviews, n=47).
  • Audit cost: for example, preparing SOC2/ISO27001 evidence consumes 320 h/quarter/team without intelligent automation.
  • Blind FinOps: moreover, 23% of cloud spend is “zombie” (orphaned resources, silent overprovisioning) due to the lack of owner/environment attribution in the CMDB.
  • Inflated MTTR: +41 minutes on average searching for “what changed” and “who owns it” without a live dependency graph.

The 2021 CMDB (JSON in Git) answered “what is there”. The 2026 CMDB, by contrast, must answer “what changed, why, who approves it, what impact it has and how much it costs” — in natural language, in Slack/Teams, in <5 s.

BAOSS 2026 Architecture: IaC + Agents = Living CMDB

For example, for banking, retail and public sector clients we deploy a repeatable three-layer pattern in production:

1. Continuous collection layer (IaC-native)

First, forget cron + ansible-playbook. Instead, we use OpenTofu/Terraform + Ansible Execution Environments (EE) triggered by GitOps (ArgoCD/Flux) or event-driven (EventBridge → Step Functions → AAP/Controller). This way, every infrastructure change (merged PR, detected drift, autoscaling) launches idempotent jobs that extract:

  • Hardware/virtual: CPU, RAM, disks, NICs, GPUs, firmware (via community.general.hardware_facts + redhat.rhel_mgmt).
  • Software SBOM: Packages (rpm/deb/apk), containers (Syft/Grype), Python/Node/Go dependencies (CycloneDX/SPDX).
  • Living configuration: sshd_config, sysctl, systemd units, firewall rules, rendered cloud-init.
  • Identity and access: IAM roles, policies, SSH keys, certificates, service accounts (AWS IAM Access Analyzer, Azure PIM, GCP Recommender).

As a result, we generate a normalized output to OpenTelemetry Attributes + CloudEvents → Kafka/Redpanda topic cmdb.raw.events. P95 latency is 3.2 s from merge to event available.

2. Intelligence layer: autonomous AI agents (LangGraph + CrewAI)

In fact, this is where 2026 breaks with 2021. That is, we no longer store JSON in Git. That is why we orchestrate agents that process the stream:

  • Agent Normalizer (LangGraph): Maps heterogeneous schemas (AWS EC2, Azure VM, VMware, bare-metal) to a Canonical Configuration Model (CCM) based on ITIL 4 + Cloud Asset Inventory. Validates referential integrity (does the owner exist? the VPC? the cost_center tag?).
  • Agent DriftHunter (CrewAI): Compares desired state (Terraform/OpenTofu state + Git) vs actual state (freshly arrived facts). Classifies drift: authorized (approved PR), emergency (break-glass), malicious (outside the window, no ticket), config-rot (gradual drift). Generates a remediation PR or SOAR alert.
  • Agent DependencyMapper (AutoGen + Neo4j): Builds a real-time dependency graph: workload → instance → SG → NACL → VPC → TGW → DNS → certificate → owner → cost. Updates vector embeddings (text-embedding-3-large) for RAG.
  • Agent FinOpsEnricher (MCP + Focus 1.0): Enriches each node with unit cost, amortization, recommended rightsizing, commitment coverage. Exposes GET /cmdb/node/{id}/cost via MCP server.

3. Consumption layer: RAG + MCP + conversational UI

In other words, the CMDB is no longer “queried”. It is asked:

  • Slack/Teams Bot (GPT-4o + RAG over Neo4j + Chroma): “Which workloads use the wildcard.baoss.es certificate expiring in 14 days, and who owns them?” → Answer in 2.1 s with a navigable graph, associated cost and a “Create renewal ticket” button.
  • MCP Server (Model Context Protocol): Exposes cmdb.query, cmdb.drift, cmdb.impact so that Cline, Cursor, Claude Desktop or internal agents can reason about infrastructure without leaving the IDE.
  • Self-service portal (Backstage + BAOSS plugin): Developers see their resources, dependencies, cost, drift and compliance without asking Ops.

Real BAOSS case (anonymized): retail banking, 2,400 hybrid workloads

Context: for example, a legacy ServiceNow CMDB (manual monthly update), 34% of CIs inaccurate, a SOC2 Type II audit in 90 days and a team of 6 SREs stretched thin.

8-week deployment (phases)

  1. Weeks 1-2: first, automated discovery with ansible.builtin.setup + community.general.packages + syft on 100% of nodes (standardized EE, 0 extra agents).
  2. Weeks 3-4: next, in this phase, GitOps pipeline (ArgoCD) + Kafka + LangGraph/CrewAI agents on EKS Fargate (infra cost: $0.18/node/month).
  3. Weeks 5-6: in addition, in this phase, historical migration from ServiceNow to Neo4j (Cypher scripts + 5% human validation). Training of domain-specific embeddings (fine-tuned bge-m3 model).
  4. Weeks 7-8: finally, in this phase, Slack bot + MCP server + Backstage plugin. SOC2 audit dry run: evidence generated in 4 min vs 320 manual hours.

Results at 6 months (real metrics)

  • CMDB accuracy: 99.2% (vs 66% initially) measured by a weekly random reconciliation job (n=500 CIs).
  • Malicious drift detected: 17 events (3 credentials rotated without a ticket, 14 SG changes outside the window). Drift MTTR: 8 min (before: 4.3 h).
  • FinOps savings: €340k/year (zombie resources + automatic rightsizing applied via PR).
  • Audit preparation time: -98% (320 h → 6 h/quarter).
  • ROI: 3.4x in 6 months (investment of €185k across tooling, BAOSS hours and cloud).
  • Developer adoption: 78% query the CMDB via Slack/IDE weekly (before: 0%).

Real BAOSS case (anonymized): multi-cloud e-commerce, Black Friday 2024

Challenge: now, guaranteeing PCI-DSS 4.0 compliance in an ephemeral environment (K8s + serverless) during a 12x traffic peak. In other words, the static CMDB was useless.

3-week ad-hoc solution: we deployed a PCI-Scanner agent (AutoGen) that validates, every 15 min, 217 PCI controls against the live graph. It reviews encryption in transit/at rest, network segmentation, IAM least privilege, secret rotation and immutable logging. We then expose the results via MCP to a Grafana dashboard + PagerDuty alerts.

Result: therefore, zero critical findings in the external audit. In fact, 23 findings auto-remediated by the agent (PRs with terraform apply -auto-approve in a pre-approved change window). Security team: “First time we slept soundly on Black Friday”.

2026 code pattern: from ansible_facts to a CloudEvent

Prefer to talk to us directly? Contact the BAOSS team and tell us about your challenge.