Terraform drift is easy to detect. Understanding it is the hard part.

Terraform can tell you that something changed, but that usually isn’t the full story. What I actually want to know is who changed it, whether it was changed manually in AWS, when it happened, which .tf file owns that resource, and whether there was a commit or pull request connected to it. That’s one of the things we’re working on in Kultarr: connecting the live AWS resource back to Terraform and GitHub, so you can see the AWS resource, the Terraform resource, the file, the repo, the commit, the pull request and the CloudTrail activity around the change. If AWS and Terraform no longer match, the useful part isn’t only knowing that drift exists, it’s understanding how it happened.

kultarr.io