Terraform Drift Detection
That Actually Catches Drift

What is Terraform drift?
(And why it's worse than you think)

Terraform drift is the gap between your code and your cloud. You write aws_security_group rules in HCL, apply them, and call it done. Three days later, a developer opens the AWS console to "quickly" test something. A week after that, an on-call engineer adds a port rule during an incident and forgets to back-port it to Terraform. A month later, a compliance audit finds a 0.0.0.0/0 rule that nobody can explain.

Each one of those changes is drift. Your Terraform says one thing. Your infrastructure is something else. And terraform plan only catches it when you actually run it.

The three most common drift sources — and there are more than three:

• Console clicks — Someone modifies a resource directly in AWS/GCP/Azure console. Terraform doesn't know until next plan run.
• Out-of-band scripts — An automation tool, Lambda function, or deployment pipeline modifies infrastructure outside Terraform's control.
• IAM policy edits — Security teams, compliance tools, or auto-remediation systems modify IAM roles and policies directly.
• Security group changes — Engineers add/remove inbound rules during incidents. Emergency fixes that never get committed back to IaC.
• Auto-scaling events — AWS Auto Scaling changes desired counts; RDS auto-scales storage; ECS adjusts tasks. Terraform state goes stale.
• Provider mutations — AWS normalizes values (lowercase enforcement, default settings applied) that differ from what you specified.

Why terraform plan alone isn't enough

terraform plan is reactive. It catches drift when you run it — which means it catches drift when you're about to apply changes, not when the drift happened. A security group opened to the internet at 2pm on Tuesday won't be caught until the next developer runs a plan on that workspace, which might be Friday afternoon, or next sprint, or never if nobody touches that module.

Three failure modes that plan doesn't cover:

How InfraGhost detects drift —
45 seconds, every time

InfraGhost runs a continuous scan cycle: poll live provider APIs, compare against desired state, surface deltas in real time. No terraform plan required. No state file mutations. No CI/CD pipeline to configure. Connect your cloud account, define your desired state baseline, and InfraGhost starts scanning immediately.

The scan cycle:

{
  "event_id": "drift_7f3a2b",
  "detected_at": "2026-05-05T18:42:03Z",
  "resource": {
    "type": "aws_security_group",
    "id": "sg-0a1b2c3d4e5f",
    "name": "prod-web-sg",
    "region": "us-east-1",
    "account": "prod-123456789"
  },
  "drift": {
    "attribute": "ingress_rules",
    "expected": [
      { "from_port": 443, "to_port": 443, "cidr": "10.0.0.0/8" }
    ],
    "actual": [
      { "from_port": 443, "to_port": 443, "cidr": "10.0.0.0/8" },
      { "from_port": 22,  "to_port": 22,  "cidr": "0.0.0.0/0"  }
    ],
    "severity": "critical",
    "delta": "unexpected_inbound_rule_added"
  },
  "action": {
    "status": "pending_approval",
    "reason": "security_group_to_public_internet",
    "requires_human_approval": true
  }
}

Auto-remediation: what gets fixed automatically
vs what waits for you

Not all drift is equal. A changed tag gets auto-fixed. A security group opened to 0.0.0.0/0 waits for your approval. InfraGhost applies this distinction automatically based on drift severity, resource type, and your configured approval gates.