Infrastructure Drift Detection

Detect when your cloud infrastructure diverges from your IaC definitions using Terraform plan, driftctl, and CloudQuery. Set up automated drift alerts before manual changes cause incidents.

Method 1 — Terraform Plan as Drift Detector

# Run terraform plan in CI and parse for unexpected changes
cd terraform/

# Refresh state to pull latest cloud state, then plan
terraform init -reconfigure
terraform refresh  # or use -refresh=true in plan

# Generate machine-readable plan output
terraform plan -refresh=true -out=tfplan.binary -detailed-exitcode
EXIT_CODE=$?
# Exit code: 0 = no changes, 1 = error, 2 = changes detected (drift!)

terraform show -json tfplan.binary > tfplan.json

# Parse for changes using jq
jq '[.resource_changes[] | select(.change.actions | contains(["update"]) or contains(["delete"]))] |
  map({resource: .address, actions: .change.actions, before: .change.before, after: .change.after})' \
  tfplan.json

# Count drift by type
jq '[.resource_changes[] | .change.actions[]] |
  group_by(.) | map({action: .[0], count: length})' tfplan.json

# Exit 1 in CI if drift detected
if [ $EXIT_CODE -eq 2 ]; then
  echo "DRIFT DETECTED: $(jq '.resource_changes | length' tfplan.json) resources changed"
  exit 1
fi

Method 2 — driftctl for Unmanaged Resources

# Install driftctl
curl -L https://github.com/snyk/driftctl/releases/latest/download/driftctl_linux_amd64 \
  -o /usr/local/bin/driftctl && chmod +x /usr/local/bin/driftctl

# Scan AWS resources against Terraform state
export AWS_PROFILE=production
driftctl scan \
  --from tfstate+s3://my-terraform-state/prod/terraform.tfstate \
  --output json://drift-report.json

# View coverage and drift summary
driftctl scan \
  --from tfstate+s3://my-terraform-state/prod/terraform.tfstate \
  --output console

# Example output:
# Found 14 resource(s) not covered by IaC: (unmanaged)
#   - aws_s3_bucket.manual-uploads-2024
#   - aws_security_group.sg-0abc1234
#   - aws_iam_role.manual-role
# Coverage: 87.3% (127 managed / 14 unmanaged)

# Scan multiple state files (multi-env)
driftctl scan \
  --from tfstate+s3://state-bucket/prod/terraform.tfstate \
  --from tfstate+s3://state-bucket/staging/terraform.tfstate

# Ignore known unmanaged resources in .driftignore
cat > .driftignore <<EOF
# Intentionally unmanaged — created by EKS node group
aws_instance.*
aws_volume_attachment.*
# Managed by external team
aws_iam_role.external-team-role
EOF

Method 3 — CloudQuery SQL for Drift Analysis

# Install CloudQuery
curl -L https://github.com/cloudquery/cloudquery/releases/latest/download/cloudquery_linux_amd64 \
  -o /usr/local/bin/cloudquery && chmod +x /usr/local/bin/cloudquery

# cloudquery.yml — sync AWS to PostgreSQL
kind: source
spec:
  name: aws
  registry: cloudquery
  path: cloudquery/aws
  version: "v23.0.0"
  tables: ["aws_ec2_instances", "aws_ec2_security_groups",
           "aws_iam_roles", "aws_s3_buckets"]
  destinations: ["postgresql"]
---
kind: destination
spec:
  name: postgresql
  registry: cloudquery
  path: cloudquery/postgresql
  version: "v7.0.0"
  spec:
    connection_string: "postgresql://user:pass@localhost:5432/cloudquery"

# Run sync
cloudquery sync cloudquery.yml

# SQL: Find EC2 instances without required tags (drift from policy)
SELECT
  instance_id,
  instance_type,
  state_name,
  tags
FROM aws_ec2_instances
WHERE
  state_name = 'running'
  AND (tags ->> 'Environment' IS NULL
       OR tags ->> 'Team' IS NULL
       OR tags ->> 'Project' IS NULL);

-- Security groups with 0.0.0.0/0 inbound rules (unexpected open ports)
SELECT
  sg.group_id,
  sg.group_name,
  perm.from_port,
  perm.to_port,
  perm.ip_protocol
FROM aws_ec2_security_groups sg,
  jsonb_array_elements(sg.ip_permissions) AS perm,
  jsonb_array_elements(perm -> 'IpRanges') AS ip_range
WHERE ip_range ->> 'CidrIp' = '0.0.0.0/0'
  AND perm ->> 'IpProtocol' != '-1'
ORDER BY perm ->> 'FromPort';

CI Integration — GitHub Actions Drift Alert

# .github/workflows/drift-detection.yml
name: Infrastructure Drift Detection

on:
  schedule:
    - cron: '0 8 * * *'   # Daily at 8 AM UTC
  workflow_dispatch:

jobs:
  drift-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Terraform Init
        run: terraform init
        working-directory: terraform/

      - name: Detect Drift
        id: drift
        run: |
          terraform plan -refresh=true -detailed-exitcode \
            -out=tfplan.binary 2>&1 | tee plan_output.txt
          echo "exit_code=$?" >> $GITHUB_OUTPUT
        working-directory: terraform/
        continue-on-error: true

      - name: Alert on Drift
        if: steps.drift.outputs.exit_code == '2'
        uses: slackapi/[email protected]
        with:
          payload: |
            {
              "text": ":rotating_light: *Infrastructure Drift Detected*\nTerraform plan shows unexpected changes in production.\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Details>"
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_DRIFT_WEBHOOK }}

Drift Severity Classification