Demo Drift Detection

Terraform Cloud’s Drift Detection feature, introduced in mid-2022, continuously monitors your infrastructure for out-of-band changes. By comparing your deployed resources against your version-controlled Terraform code, it helps ensure your environments stay in sync.

Prerequisites and Licensing

Overview of Workspaces and Health Status

From the Terraform Cloud UI, you can quickly see which workspaces are “Errored,” “Applied,” or have drift:

Enable Drift Detection

You can enable health assessments — including drift detection — either globally or per workspace.

1. Navigate to Settings in your organization.
2. Select Health and choose your preferred scope.

In this demo, we’ve enabled health checks at the workspace level. Open the Clumsy Bird workspace to confirm its current status. A recent plan and apply completed with no drift:

Once enabled, you’ll see a new Drift section in the workspace sidebar:

Verifying the Baseline State

Before simulating drift, confirm that your deployed infrastructure matches code. For example, check your AWS EC2 dashboard for the Clumsy Bird instance:

Simulate Drift

In the AWS Console, modify the Environment tag from development to production:

After saving, Terraform Cloud’s periodic health assessment will detect this change. You can filter by Drift on the workspace dashboard:

Detecting and Reviewing Drift

Once the assessment completes, Terraform Cloud will highlight any discrepancies. In the Clumsy Bird workspace, drift is detected and detailed under the Health tab:

Handling Detected Drift

Terraform Cloud offers two primary options:

Example of a detected drift diff:

aws aws_instance.clumsy_bird :
  iam_instance_profile :
    id : 
    public_ip : 
  tags :
    Environment : "development-manual-change"
  tags.all :
    Environment :
      "development" : "development-manual-change"

Accepting the Drift

Click Start New Run and select Refresh State. This updates the Terraform state to reflect the manual change.

Overriding the Drift

Select the usual Plan and Apply workflow to revert the tag back to development:

After completion, verify in the AWS Console that the Environment tag is back to development. The Health tab will now show No drift detected.

Configuring Drift Notifications

Stay informed by setting up notifications under Notifications. For example, send an email or Slack message whenever drift is detected:

Choose Health events and enable Drift detected:

Specify your email recipients or Slack channel:

Summary

Terraform Cloud Drift Detection (Business Tier) ensures your infrastructure matches your code by:

• Continuously checking for out-of-band changes

• Highlighting drift under the Health tab

• Providing options to accept or override detected drift

• Allowing notifications to alert your team immediately

• Terraform Cloud Health Assessment Scheduling

• Terraform Cloud Overview

• AWS EC2 Documentation