Drift detection is the process of identifying when actual infrastructure state has diverged from the desired state defined in code, enabling remediation before issues occur.
Drift occurs when the actual state of infrastructure diverges from the desired state defined in code. Common causes include:
terraform plan compares state against actual infrastructure and reports differencesWhen drift is detected, teams have two options: reconcile by applying the desired state from code (overwriting manual changes), or adopt by updating the code to match the current state (preserving manual changes).
The right choice depends on context. Unauthorized changes should be reconciled. Legitimate changes made outside of Terraform should be adopted into code.
The best drift detection is drift prevention. Restrict console access to read-only for production accounts, route all changes through pull requests, and use Service Control Policies to enforce guardrails at the AWS Organizations level.
The companion to 'Terraform the Hard Way.' Same twenty-one crossroads, framed against what each one looks like under a framework that's already made the decisions. With concrete Atmos snippets at every step.
A guided checklist of every decision you'll make on the road from `terraform apply` to production. Not a recommendation — an education. Borrowed in spirit from Kelsey Hightower's 'Kubernetes the Hard Way.'
An internal developer platform is the icing on the cake — the reward for getting the foundation underneath into shape. Here's what I've learned about when the icing actually delivers, and why a framework matters more than the portal.
Teams keep telling themselves infrastructure is simple. 'It's just Terraform.' 'A contractor can clean it up.' Here's what those assumptions actually cost.
Open source Terraform module libraries are infrastructure's equivalent of npm and PyPI—battle-tested foundations that become even more critical when AI enters the picture.