Files
magnus919_agent-skills/terraform/references/04-drift-detection.md
T
Magnus HedemarkGitHubfactory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
00abbf90a4 feat(skill): add Terraform operational skill (#263)
* feat(skill): add Terraform operational skill

Add a single tool skill for Terraform and OpenTofu operations: module
structure, state backends and locking, plan/apply workflow, drift detection,
remote state, upgrade and refactor flows, and evidence-based diagnostics.
Ships the agent-first tfops wrapper (JSON output, direct state-file analysis,
--dry-run/--yes/--force mutation gate), a fixture-tested suite, six eval
cases, dated references, and routing up to platform-engineering. Closes #243.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

* fix(skill): clarify missing-binary report in tfops doctor

When the TERRAFORM env override names a binary that cannot be found,
doctor now reports the env value with a (not found) marker instead of
falling back to the generic default name.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

---------

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
2026-08-03 17:38:46 -04:00

2.7 KiB

Drift detection

Drift is the difference between declared configuration and actual infrastructure. The plan is the drift probe: a plan that shows changes against a supposedly stable environment is drift, whether intended or not.

Proving the diff is real

Before remediating, prove the diff is real:

  1. Check the state serial and lineage (tfops state --state FILE --json shows both): a stale serial means the local state is behind the backend, not that the world changed.
  2. Compare against the previous known-good plan for the same workspace.
  3. Check git history and change records: was the config touched? Was a plan applied that CI never recorded?
  4. Only then classify the cause:
    • Out-of-band manual change: someone changed the live resource (console, another tool). Config is the desired state — reconcile with a reviewed apply.
    • Unapplied config change: config was edited but never applied. Apply it deliberately after review.
    • State/config desync: resource was created outside Terraform and never imported, or state was edited. Import the resource (terraform import / tfops import) instead of delete-and-recreate.

Cadence and automation

  • Schedule periodic plans (CI cron or a drift-detection run) and treat unexpected diffs as incidents with owners.
  • Cloud-hosted runs (Terraform Cloud/OpenTofu Cloud) can run drift detection on a schedule and notify; self-managed teams build the cron equivalent with plan -refresh-only or plain plans.
  • After any remediation, re-plan to confirm the diff is gone; a clean plan is the drift-free proof.

Remediation rules

  • Reconcile with plan + reviewed apply. Never delete-and-recreate as a default reflex — a resource's data may be irreplaceable.
  • Import-before-manage: adopt pre-existing resources with import rather than deleting and rebuilding.
  • Tainted resources (tfops lists them under tainted) force replacement on the next apply: review why they were tainted before applying, and never apply them blind.
  • Distinguish intended drift (deliberate out-of-band action with a record) from incidents; both still end with a clean plan or a documented, reviewed exception.

Sources

Last Updated: 2026-08-03