Terraform Drift Detection

Terraform drift detection identifies differences between the configuration you declare, the state Terraform records, and the infrastructure that actually exists. It helps detect changes made outside Terraform so they can be reviewed and reconciled.

Terraform compares configuration and state with the remote infrastructure during planning and refresh-related operations. If someone changes a resource directly through a cloud console, CLI, or another automation system, Terraform can discover that the real resource no longer matches what its state expects.

A useful distinction is between configuration, state, and reality. Configuration is the desired definition in `.tf` files; state records Terraform's understanding of managed resources; the provider reads the remote system to determine current attributes. Drift exists when the remote object has changed independently of the declared configuration.

A normal `terraform plan` can expose many forms of drift because Terraform refreshes resource information and then calculates the changes required to reach the configuration. For example, if a managed database's instance size was changed manually, the plan may propose changing it back to the configured value.

Drift is not necessarily an error. An organization might intentionally change infrastructure outside Terraform, but that creates a reconciliation decision: update the Terraform configuration, allow Terraform to restore the declared configuration, or deliberately adopt the externally changed value into the IaC workflow. The important engineering concern is that the source of truth remains explicit.

For a Java backend engineer, the operational lesson is similar to configuration management in application systems: externally modifying a managed resource can create an undocumented state transition. Reliable infrastructure workflows therefore use plans, controlled applies, review, and appropriate state management rather than assuming the deployed environment always matches source control.

Key points

• Drift is a difference between Terraform's declared/recorded model and the actual remote infrastructure.
• `terraform plan` can detect many out-of-band changes by reading current resource attributes through providers.
• State is Terraform's recorded representation of managed resources; it is not the same thing as the `.tf` configuration.
• A detected drift can be reconciled by changing configuration, applying the existing configuration, or intentionally adopting the external change.
• Regular plan/review workflows help expose infrastructure changes that bypass IaC.

Interview questions

What is Terraform drift?

Terraform drift occurs when infrastructure changes outside the Terraform workflow and no longer matches the desired configuration. Terraform can discover many such changes when it refreshes information from the provider. A subsequent plan can then show the changes needed to reconcile the resource. The key is that the remote infrastructure has diverged from the IaC-managed definition.

How does `terraform plan` help detect drift?

Terraform evaluates the declared configuration against its state and information obtained from the provider about the remote resources. During this process, externally changed attributes can become visible. Terraform then constructs a proposed set of changes needed to make the infrastructure conform to configuration. The resulting plan should be reviewed before applying it.

Suppose an engineer changes a cloud resource manually. What should the team do when Terraform detects it?

First, determine whether the manual change was intentional and why it happened. If Terraform should remain authoritative, the existing configuration can be applied to restore the declared value. If the new value is intentional, the Terraform configuration should generally be updated so source control reflects the intended infrastructure, followed by the normal review process. The team should also consider why the out-of-band change was possible and whether ownership or operational controls need improvement.

What is the difference between Terraform state and the real infrastructure?

Terraform state is Terraform's persisted record of resources it manages and the attributes it knows about. The real infrastructure exists in the external platform and can change independently of Terraform. Providers allow Terraform to read relevant information from that platform. Therefore, state can become stale relative to reality, which is one reason refresh and planning are important.

How would you design a CI workflow to surface Terraform drift?

A common approach is to run Terraform initialization and validation followed by a plan against the appropriate environment, with credentials that can read the managed resources. The resulting plan can be inspected or reported when unexpected changes appear. Teams can schedule plans independently of deployment pipelines if they want periodic drift visibility. Strong controls also establish resource ownership so multiple systems do not continually overwrite one another.