Terraform State Drift Detection: Complete Guide

What is Terraform state drift?

State drift occurs when the actual infrastructure differs from what Terraform's state file records. This happens when changes are made outside Terraform (manual console edits, other automation tools, or provider-side auto-scaling). Without drift detection, teams operate on stale assumptions about their infrastructure, which leads to failed deployments, security gaps, and compliance failures.

Method 1: Refresh-only plans

The most direct way to detect drift is a refresh-only plan: `terraform plan -refresh-only`. This reads the current state of all resources from the provider without proposing any changes, then compares the refreshed state against the recorded state. Differences appear as 'in-place update' modifications in the output. The advantage is simplicity: it uses built-in Terraform functionality. The disadvantage is that it only detects drift at the time you run it; there's no continuous monitoring unless you schedule it.

terraform plan -refresh-only ──▶ reads live state                              │              compares ───────┼──▶ state file                              │              outputs diff ───┘ ──▶ flags drifted attributes

Method 2: Automated drift reporting

For continuous monitoring, schedule refresh-only plans in CI/CD pipelines. Run them on a cadence (daily or weekly depending on environment sensitivity) and report differences to your team. Tools like Devopsify automate this by running scheduled drift audits, classifying each drift finding, and producing structured reports that distinguish operator-managed drift from unauthorized changes.