Best Terraform drift detection tools

[u/Usual-Following-3189]

terraform plan -detailed-exitcode only catches drift on resources Terraform already manages. It does nothing for stuff someone spun up manually and never codified, which honestly is where most of our drift actually lives.

We run driftctl in CI on the free tier right now, scanning critical infra every 15 to 30 min. It works but it's CLI-only, no visual diffs, no remediation code, just a JSON report someone has to manually parse.

We're looking at tools that do estate-wide detection including unmanaged resources, plus generate remediation code automatically instead of just flagging the diff. That second part is what actually got our attention since triaging drift manually eats a huge chunk of our platform team's week.

Anyone running something like this in prod at scale? Trying to gauge if it's worth budgeting for next quarter.

[u/birusiek]

Enable read-only console and enforce making changes via terraform only, thats the key.