HashiCorp : Terraform Cloud
Advanced Topics
Demo Drift Detection
Terraform Cloud’s Drift Detection feature, introduced in mid-2022, continuously monitors your infrastructure for out-of-band changes. By comparing your deployed resources against your version-controlled Terraform code, it helps ensure your environments stay in sync.
Prerequisites and Licensing
Warning
Terraform Cloud Drift Detection requires a Business Tier license. If you’re evaluating this feature, ensure your organization has the correct plan.
Overview of Workspaces and Health Status
From the Terraform Cloud UI, you can quickly see which workspaces are “Errored,” “Applied,” or have drift:
Enable Drift Detection
You can enable health assessments — including drift detection — either globally or per workspace.
- Navigate to Settings in your organization.
- Select Health and choose your preferred scope.
In this demo, we’ve enabled health checks at the workspace level. Open the Clumsy Bird workspace to confirm its current status. A recent plan and apply completed with no drift:
Once enabled, you’ll see a new Drift section in the workspace sidebar:
Verifying the Baseline State
Before simulating drift, confirm that your deployed infrastructure matches code. For example, check your AWS EC2 dashboard for the Clumsy Bird instance:
Simulate Drift
In the AWS Console, modify the Environment tag from development
to production
:
After saving, Terraform Cloud’s periodic health assessment will detect this change. You can filter by Drift on the workspace dashboard:
Note
The first health assessment typically runs 24 hours after your last active Terraform run. Learn more in the Health Assessment Scheduling documentation.
Detecting and Reviewing Drift
Once the assessment completes, Terraform Cloud will highlight any discrepancies. In the Clumsy Bird workspace, drift is detected and detailed under the Health tab:
Handling Detected Drift
Terraform Cloud offers two primary options:
Method | Description |
---|---|
Accept the drift | Run a Refresh State plan to update Terraform’s state file without changing code. |
Override the drift | Execute a standard Plan and Apply to revert the infrastructure back to match your code. |
Example of a detected drift diff:
aws aws_instance.clumsy_bird :
iam_instance_profile :
id :
public_ip :
tags :
Environment : "development-manual-change"
tags.all :
Environment :
"development" : "development-manual-change"
Accepting the Drift
Click Start New Run and select Refresh State. This updates the Terraform state to reflect the manual change.
Overriding the Drift
Select the usual Plan and Apply workflow to revert the tag back to development
:
After completion, verify in the AWS Console that the Environment tag is back to development
. The Health tab will now show No drift detected.
Configuring Drift Notifications
Stay informed by setting up notifications under Notifications. For example, send an email or Slack message whenever drift is detected:
Choose Health events and enable Drift detected:
Specify your email recipients or Slack channel:
Summary
Terraform Cloud Drift Detection (Business Tier) ensures your infrastructure matches your code by:
Continuously checking for out-of-band changes
Highlighting drift under the Health tab
Providing options to accept or override detected drift
Allowing notifications to alert your team immediately
Watch Video
Watch video content
Practice Lab
Practice lab