What is drift in Terraform and how do you detect and fix it?
Understand what drift is in Terraform, how terraform plan detects out-of-band changes, and how to fix drift by reapplying, updating code, or importing.
Expected Interview Answer
Drift is when the real infrastructure no longer matches what Terraform state and configuration describe, usually because someone changed a resource outside of Terraform through a console, CLI, or another tool.
Terraform detects drift by refreshing state against the live provider and comparing it to your configuration during terraform plan. The plan shows what has changed and what it would do to reconcile. You fix drift either by re-applying to bring reality back in line with code, by updating the configuration to accept the intentional change, or by importing and adjusting when a resource was created outside Terraform. Preventing drift relies on discipline: make all changes through Terraform and restrict manual console access.
- Reveals unauthorized or manual changes
- Keeps code as the single source of truth
- Prevents surprises during future applies
- Supports auditing and compliance
- Enables safe, predictable reconciliation
AI Mentor Explanation
Drift is like a groundskeeper quietly moving the boundary rope after the captains agreed the field placement. The official field map now disagrees with the actual ground. Terraform's plan is the umpire walking the boundary to spot the mismatch, and reapplying is putting the rope back where the agreed map says it should be.
Step-by-Step Explanation
Step 1
Refresh state
Terraform queries the live provider to learn the current real-world attributes of each managed resource.
Step 2
Run terraform plan
Compare refreshed reality against your configuration; any differences surface as proposed changes, revealing drift.
Step 3
Diagnose the cause
Determine whether the change was accidental, malicious, or an intentional out-of-band fix that should be kept.
Step 4
Reconcile
Apply to revert reality to code, or update the configuration to codify the intended change.
Step 5
Handle unmanaged resources
Use terraform import for resources created outside Terraform so state reflects them going forward.
What Interviewer Expects
- Defining drift as config vs reality mismatch
- Knowing plan and refresh detect drift
- Multiple valid fixes: apply, update code, or import
- Understanding the root cause is out-of-band changes
- Prevention through process and access control
Common Mistakes
- Confusing drift with a Terraform bug rather than external change
- Always reverting without checking if the change was intentional
- Forgetting that manual console edits are the main cause
- Not using import for resources created outside Terraform
Best Answer (HR Friendly)
“Drift happens when the actual infrastructure stops matching what Terraform expects, usually because someone changed something by hand. You spot it by running a plan, then either let Terraform put things back or update the code to accept the change.”
Code Example
# Refresh state and show any differences without applying
terraform plan -refresh-only
# A standard plan also surfaces drift as proposed changes
terraform plan -out=tfplan# Option 1: revert reality back to match the code
terraform apply
# Option 2: bring an externally created resource under management
terraform import aws_s3_bucket.logs my-existing-bucketFollow-up Questions
- What is the difference between terraform plan and terraform plan -refresh-only?
- How do you bring a manually created resource under Terraform management?
- How can you prevent drift in a team environment?
- What role does state locking play in avoiding drift?
- How do tools like Terraform Cloud help detect drift automatically?
MCQ Practice
1. What causes drift in Terraform?
Drift arises when resources are modified outside Terraform, so state and configuration no longer match reality.
2. Which command surfaces drift without making changes?
terraform plan refreshes and compares real state to configuration, showing drift as proposed changes.
3. How do you accept an intentional out-of-band change?
If a manual change was intended, you update the code so it matches, making Terraform treat it as the desired state.
Flash Cards
What is drift? — A mismatch between real infrastructure and what Terraform state and configuration describe.
How is drift detected? — By refreshing state and running terraform plan, which shows differences as proposed changes.
Two ways to fix drift? — Reapply to revert reality to code, or update the configuration to accept the change.
Main cause of drift? — Out-of-band changes made through the console, CLI, or other tools.