Detecting and Managing Terraform Drift

Short summary

Terraform drift occurs when actual cloud infrastructure diverges from the declared state file, creating risks of silent overwrites and security violations. The post explains why drift is dangerous, why manual terraform plan checks don't scale, and covers detection approaches: scheduled CI pipelines, the -refresh-only flag, and structured monitoring. For ops teams, the key takeaway is that drift detection must be automated and scheduled to catch cross-tool modifications, auto-scaling changes, and manual fixes before they cause incidents.

• •Terraform drift = gap between declared state and actual infrastructure; terraform apply silently reverts manual fixes without warning
• •Manual drift checks don't scale due to lock contention, unstructured output, and alert fatigue; require scheduled CI automation
• •Terraform 1.1's -refresh-only flag separates real-world changes from code changes, reducing false positives in drift detection

Generated with AI, which can make mistakes.