Detecting Terraform Drift Nightly with GitHub Actions and AWS OIDC, No Stored Keys

Infrastructure drift occurs when live cloud resources diverge from what Terraform state records, often through manual console edits, autoscaling changes, or applies from stale branches. The article proposes running terraform plan on a nightly schedule, using its exit code to flag differences, and opening or updating a GitHub issue when drift appears. Authentication to AWS uses OIDC so GitHub Actions obtains short-lived credentials through STS instead of storing long-lived access keys. The setup defines an IAM OIDC provider and a read-only role trusted only by the specific repository and branch, with a matrix strategy to check multiple environments in parallel. The author also explains that the role needs read access to the state backend in S3 and DynamoDB, and that the trust condition must be tightly scoped to prevent other repositories from assuming it.