Terraform Drift: Catching Infrastructure Changes Before They Catch You
View source on GitHub- 1
The Security Group Change Terraform Never Told Me About
Terraform could reproduce my infrastructure, but it could not warn me when someone changed AWS manually. I built a CodeBuild job that runs Terraform plan, handles the drift exit code correctly, reads shared configuration from SSM, and sends an SNS email when the real infrastructure no longer matches the code.
- 2
My Terraform Drift Alert Could Not Explain the Drift
My Terraform drift detector could send an email, but it could not explain what changed or how serious it was. I changed the SNS message into structured JSON, delivered it to SQS for audit processing, and used Lambda to classify every resource change by severity.
- 3
I Added a Tag in AWS. Terraform Removed It Automatically.
I added a tag directly to an EC2 instance in AWS, then ran my Terraform drift detector. The change was classified as LOW, Lambda started a separate remediation build, and Terraform removed the tag automatically.
- 4
My Terraform Drift Pipeline Fixed the Change, Then Forgot It
My Terraform drift pipeline could detect an EC2 tag change and remove it automatically, but the evidence was scattered across temporary logs. I added a DynamoDB audit trail, a read only Lambda API, and a CloudFront dashboard so the system could remember and display every classified drift event.