Drift Detection: Refresh, Plan Diffs & Out-of-Band Changes

The Big Idea

In an ideal world, all changes flow strictly through git commits and pull requests. In reality, emergencies happen: a production outage occurs at 3:00 AM, and an on-call engineer opens port 22 in an AWS Security Group or scales an ECS service directly from the cloud console.

This discrepancy is called Configuration Drift. The state file records what was applied yesterday, but the real cloud has mutated out-of-band. If left unchecked, drift leads to catastrophic silent bugs during subsequent deployments.

During every terraform plan, Terraform automatically executes a refresh phase in memory. It queries the live cloud provider APIs, compares the live reality against the state file, and then compares both against your HCL code. It flags differences as updates-in-place, giving you complete power to either overwrite the drift or codify it into your repository.

Detecting and Resolving Drift with Plan Only

# 1. Speculative drift check without modifying state
terraform plan -refresh-only

# Sample output showing detected out-of-band console change:
# Note: Objects have changed outside of Terraform
#   ~ resource "aws_security_group" "web_firewall" {
#       ~ description = "Production Web Access" -> "Temporary SSH access by admin"
#     }

# 2. To accept the out-of-band changes into your state file:
terraform apply -refresh-only

# 3. Or to FORCE reality back to match your HCL code:
# (Overwrites the manual console change and restores original desired state)
terraform apply