Drift detection
Checking whether live infrastructure still matches its version-controlled definition, so manual changes do not stay hidden.
What it is
Drift detection compares declared infrastructure with what is actually running and reports the difference. If Terraform says a security group has one rule but someone added another in the AWS console, that extra rule is drift. A refresh and plan exposes it before the next ordinary deployment discovers it by surprise.
Reach for it when infrastructure is managed as code but emergency console changes, provider defaults, or outside automation can still alter live resources. Run it on a schedule and after incidents, and send the diff to the team that can either revert reality or update the declaration.
Gotcha: not every difference is unauthorized. Autoscalers and managed services legitimately change some values, while provider APIs may reorder sets or fill computed fields. Ignore only attributes with a named external owner; broad ignore rules turn drift detection into a green light that means nothing.
Ask AI for it
Add Terraform drift detection to GitHub Actions. Run a read-only `terraform plan -refresh-only -detailed-exitcode` for each production workspace every six hours and on workflow_dispatch, using the existing remote backend and a cloud identity obtained through GitHub OIDC. Treat exit code 0 as no drift, 1 as an execution error, and 2 as detected drift. Never apply from this workflow. Redact sensitive values, upload the plan as a short-lived artifact, and open or update one issue per workspace with the resource addresses and plan summary. Close the issue automatically when a later run returns 0.