# Terraform Drift Detection and Remediation [Guide] ![Terraform Drift Detection and Remediation [Guide]](https://spacelift.io/_next/image?url=https%3A%2F%2Fsecure.gravatar.com%2Favatar%2F06dd10199866e44768e6554d78e5391485421dc85dbfa3e72abdd0667df7ca1e%3Fs%3D48%26d%3Dmm%26r%3Dg&w=96&q=75) Organizations using Terraform to manage their infrastructure as code (IaC) need a reliable solution to ensure their infrastructure’s actual state aligns with its intended state. Terraform stores information about the infrastructure it manages in [state files](https://spacelift.io/blog/terraform-state), and any change to the infrastructure Terraform manages that Terraform has not triggered is called “drift.” In this post, we will explore the reasons why drift happens, its associated risks, and the options available to remediate it. ## What we will cover: 1. [What is Terraform drift?](https://spacelift.io/blog/terraform-drift-detection#what-is-terraform-drift) 2. [Common sources of infrastructure drift](https://spacelift.io/blog/terraform-drift-detection#common-sources-of-infrastructure-drift) 3. [Risks and impact of infrastructure drift](https://spacelift.io/blog/terraform-drift-detection#risks-and-impact-of-infrastructure-drift) 4. [Example: How does Terraform drift look in practice](https://spacelift.io/blog/terraform-drift-detection#example-how-does-terraform-drift-look-in-practice) 5. [How to detect Terraform drifts?](https://spacelift.io/blog/terraform-drift-detection#how-to-detect-terraform-drifts) 6. [Monitoring drifts with Spacelift](https://spacelift.io/blog/terraform-drift-detection#monitoring-drift-with-spacelift) 7. [How to fix Terraform drift with Spacelift](https://spacelift.io/blog/terraform-drift-detection#how-to-fix-terraform-drift-with-spacelift) 8. [Terraform drift detection tools](https://spacelift.io/blog/terraform-drift-detection#terraform-drift-detection-tools) ## TL;DR - Terraform drift is when real infrastructure no longer matches what your Terraform configuration/state expects (often due to manual changes or external automation). - Detect drift by running `terraform plan` (or `terraform plan -refresh-only` to update state from real resources without proposing changes to infra). Remediate it by either applying the desired config (`terraform apply`), importing/adopting the current reality (`terraform import`), or correcting state if needed. - Prevent recurrence by restricting manual changes and standardizing changes through PRs and Terraform runs, and automate detection with scheduled plans and alerts (and optionally automated reconciliation) using CI or a platform like Spacelift. ## What is Terraform drift? Terraform drift refers to the situation where the actual state of infrastructure in an environment diverges from the state defined in Terraform configuration files. Drift can happen due to changes outside of the Terraform workflow, such as manual modifications, automated external processes, or resource eviction. Drift is a significant concern that can lead to inconsistencies, complicating infrastructure management. ## Common sources of infrastructure drift Consistency is a key goal when managing infrastructure using Terraform. Infrastructure drift undermines that consistency. Here are some of its common sources: ### Manual changes Manual changes are a primary cause of infrastructure drift. These can be made either deliberately or unintentionally. - **Manual changes:** As a DevOps engineer, changes can be made in response to production incidents, leading to drift if not updated in Terraform. - **External processes:** Changes from cloud provider automation or external scripts can introduce drift. - **Resource eviction:** Cost-saving measures or policy violations can lead to resource changes affecting drift. ### Automation tools Automation tools can create overlaps that contribute to drift when not properly managed, such as when using Terraform alongside configuration management tools like Ansible. ### User scripts Scripts that are triggered by events (e.g., creating resources in cloud platforms) can lead to changes that are not tracked by Terraform, contributing to drift. ## Risks and impact of infrastructure drift Drift creates risks that can affect system security, compliance, performance, and operational costs. Some consequences include: - **Security vulnerabilities:** Drift exposes systems to potential attacks, such as unauthorized access from manual changes to configurations. - **Compliance violations:** Regulatory requirements may be breached due to unexpected configuration changes. - **Performance and operational difficulties:** Drift can impact system reliability, making issues harder to identify and resolve. - **Higher costs:** Untracked changes can lead to unnecessary cloud resource provisioning and increased maintenance costs. ## Example: How does Terraform drift look in practice Imagine deploying a production VPC with Terraform. A later on-call configuration change in the AWS console leads to drift when the Terraform state does not reflect these updates. 1. **Initial state:** Terraform sets the Auto Scaling Group. 2. **Out of band change:** An engineer modifies the max size directly in AWS. 3. **Drift appears:** Terraform now has a different configuration than AWS. 4. **Drift detection:** Running `terraform plan` shows discrepancies. 5. **Decision point:** Choose to update Terraform or revert to match the changed infrastructure. ## How to detect Terraform drifts? Drift can be identified by running: - **`terraform plan`** - checks differences between configuration, state, and real infrastructure. - **`terraform plan -refresh-only`** - refreshes state without proposing changes. ## Monitoring drift with Spacelift Spacelift provides built-in drift detection for Terraform, periodically checking for differences against your stable stack state. Options include automatic remediation and configurable schedules for drift checks. ## How to fix Terraform drift with Spacelift? When drift is detected, analyze the changes to determine if they are desirable or not and choose appropriate actions, such as importing configurations or running a `terraform apply` to revert changes. ## Terraform drift detection tools Here are the main options and supporting tools for Terraform drift detection: - **Terraform built-in workflows**: Regularly run `terraform plan` to detect drift. - **Drift-focused tooling**: Tools like [driftctl](https://github.com/snyk/driftctl) help detect unmanaged or out of sync resources with Terraform code. - **GitOps and CI based checks**: CI pipelines can alert on unexpected changes. ## Key points Managing infrastructure drift is complex, with changes potentially affecting security, cost, and reliability. Spacelift provides drift detection and remediation capabilities to help maintain desired infrastructure states.