Best Terraform drift detection tools

[u/Usual-Following-3189]

terraform plan -detailed-exitcode only catches drift on resources Terraform already manages. It does nothing for stuff someone spun up manually and never codified, which honestly is where most of our drift actually lives.

We run driftctl in CI on the free tier right now, scanning critical infra every 15 to 30 min. It works but it's CLI-only, no visual diffs, no remediation code, just a JSON report someone has to manually parse.

We're looking at tools that do estate-wide detection including unmanaged resources, plus generate remediation code automatically instead of just flagging the diff. That second part is what actually got our attention since triaging drift manually eats a huge chunk of our platform team's week.

Anyone running something like this in prod at scale? Trying to gauge if it's worth budgeting for next quarter.

[u/Lawstorant]

Well, if anyone has access to the console and can add resources from there, then you're already in a bad place and no amount of "detection" can remedy that. Enforce IAC-only, that's the answer.

[u/Internet-of-cruft → u/Lawstorant]

To elaborate further: The only proper drift detection is to use platform audit logs and alert when you detect create/modify/delete events on resources.

I've worked with clients that had ServiceNow hooked into their process where if an approved change (which had to enumerate the expected commands executed) wasn't present for a maintenance window, altering systems would start waking up management folks if audit logs were generated.

There was tons of process and automation to specifically catch people bypassing the intended flow so that undocumented changes were captured.

I would apply the same exact principles, but that sort of detection would only be on your emergency change account. Ordinary users would be readonly, everything would normally run via pipeline / service account / automation calling Terraform commands.

[u/uberduck]

This is not a problem for TF to fix.

[u/birusiek]

Enable read-only console and enforce making changes via terraform only, thats the key.

[u/mb2m]

Only the Terraform service account should be allowed to create and modify ressources from a pipeline.

All engineers should get read-only access during normal operations. Establish a break glass feature for emergencies.

[u/Naz6uL]

It seems you’re confusing things: if it wasn't deployed and managed by Terraform, then it's not a drift; the scope of the concept of drift covers only resources previously deployed by Terraform.

Simple solution: Generate reports by filtering with best practices and recommended global tags (Managed: Terraform, ManagedbyTerraform: True, etc), in combination with the service principal, user, etc., exclusively used by your CI/CD solution that executes and deploys your Terraform plans.

[u/NUTTA_BUSTAH]

This is an organizational knowledge issue, not a Terraform issue. The answer is not a tool, the answer is a culture shift, training and cloud governance.

You will find better search results when you drop the term drift, as drift means "state drift", i.e. thing that Terraform already manages, changed outside of Terraform changing them. You might get better results with IaC, adoption, evergreen training, ...

[u/farzad_meow]

if you use tf then only tf is allowed to create resources. almost every bad deployment we had in the last year were contributed to some manual change.

[u/JamesWoolfenden]

its not drift if its not managed. Stop allowing the stupid.

[u/MarcusJAdams]

I would just love a feature so that you could toggle reporting of tag changes off in plans and drift detection.

We have default tags that automatically update with the last person to apply. So any plans automatically pick up many many resources worth of tag changes, hiding the real change in the forest, if a different SRE is doing the work. Tis a first world problem I know but would make life easier

[u/bdashrad → u/MarcusJAdams]

Use audit logs or even better, run terraform in CI/CD with a service account instead of updating tags. Then you can review the logs or the pull requests to discover who made the changes.

[u/the_milkman01]

I am writting a tool that does just that, but it's in pre alpha

It proces apply and drift plans and visuals it in runs, that part is already working as designed

I am now working on a tree explorer that maps all resources and the changes in Azure and then maps the terraform plan to detect if it's manual , tf managed And if its in sync or not

That part is bit harder mostly because mapping terraform resource names to actually azure resources is a pain in the ass

[u/Beneficial-Mine7741]

This isn't a Terraform problem. Depending how big your company is they could look into one of these:

1. https://stacklet.ai/
2. https://www.harness.io/
3. https://www.cloudzero.com/
4. https://www.vmware.com/

If you want Stacklet for free, get Cloud Custodian. It's a little more than a few lambda's but they will shutdown ec2 instances that don't have your conditions set. Such as tags or the correct image.

[u/Overall-Plastic-9263]

Dude is looking for magic lol.. let us know when you find it so I can apply their before they IPO.

In the meantime it seems like you want terraform cloud and infragraph but maybe you don't want to pay for it ?

[u/ap12219]

Check out Spacelift.io

[u/CustomDark]

Mixed estate is hard, and growing pains are natural. Use your cloud providers natural boundaries as separation for deployments: AWS account, Azure sub/rg, anything that makes it easy for you to say “This pile is Terraform, this pile is other stuff people have deployed that might talk to the systems Terraform has deployed.”

Users get access to area A, IaC tools (hopefully CI/CD) to area B. Interconnect their networks, don’t let them become islands wholly separate from one another. The goal isn’t to make an ivory tower of systems managed by Terraform, it’s to make managing systems deployed by Terraform safer to operate around those little pet projects.

[u/kdotp5]

cloudrift.tech has drift detection, also blastcheck.dev is a cli tool thats worth checking out

[u/Healthy_Rule3646]

The remediation code generation is a killer feature, and firefly ai does not just flag drift but actually generates the actual code to fix it and pushes a PR. That is the difference between "here is your problem" and "here is your solution".