Detecting Terraform Infrastructure Drift with AWS CodeBuild and SNS

Short summary

The author built a Terraform drift detector using AWS CodeBuild that runs terraform plan on a schedule and sends an SNS email alert when infrastructure changes are detected outside of Terraform. CodeBuild was chosen over Lambda to avoid the overhead of packaging Terraform in a container image. The solution uses -detailed-exitcode to distinguish between clean plans, errors, and drift, with IAM roles scoped to read-only S3, SSM, and SNS publish permissions.

• •CodeBuild runs terraform plan with -detailed-exitcode to detect infrastructure drift outside Terraform
• •SNS sends an email alert when exit code 2 indicates changes were found
• •Public SSH key moved from local file to SSM Parameter Store to remove laptop dependency

Generated with AI, which can make mistakes.