Drift is a mismatch between what Terraform has recorded or configured and what is actually present. A common cause is an infrastructure change made outside Terraform, so the change never enters state. Drift can also appear when a Terraform-managed local file is missing on the next run. section 6.6 section 10.5.3
Terraform checks actual infrastructure during the refresh at the start of a plan. If it finds a difference, the resulting plan can propose changes that bring infrastructure back in line with configuration. To inspect changes without changing controlled infrastructure, use refresh-only planning mode; it refreshes state rather than following up with infrastructure changes. section 6.6 section 5.3.1
Before applying a plan, find out what changed and why. The right response depends on the cause:
- Investigate unexpected changes through system behavior, logs, and recent team activity. Correct the underlying cause rather than repeatedly repairing its effects. section 6.6
- Accept an expected change when appropriate. An automatic database minor-version upgrade, for example, may need only a refresh-only update to state. section 6.6.3
- Choose whether to redeploy after a new machine or container image appears, or keep an existing resource unchanged. For attributes that another system controls, consider Terraform’s ignore_changes lifecycle rule. section 6.6.3
Listing 6.18 Ignoring changes
resource "aws_instance" "main" {
tags = { #1
Name = var.name #2
Application = var.application #3
}
lifecycle {
ignore_changes = [tags] #4
}
}
The aws_instance example places tags in ignore_changes. This prevents changes to that attribute from driving an update, which can help when an external system adds tags; it also means intended tag changes need consideration. section 6.6.3
Some recurring differences come from how values are generated or where Terraform runs. A timestamp function returns a new value each run; time-provider resources instead retain recorded times until their defined trigger or rotation. Random-provider resources similarly persist generated values until their keepers change. A local_file resource can repeatedly appear missing if runs occur in different locations and the file is not restored. section 6.8.2 section 6.8.1 section 10.5.3
Detecting drift on pull requests alone can miss changes made between them. GitOps-style continuous reconciliation calls for a larger delivery system to check regularly and, when appropriate, run Terraform to correct drift; Terraform by itself does not run continuously. section 8.3.2
