Developer Builds Severity-Classifying Terraform Drift Alert Using AWS SNS, SQS, and Lambda
A developer overhauled a basic Terraform drift detection system after finding it only confirmed drift existed without identifying which resources changed or how critical the changes were. The updated pipeline uses CodeBuild to run terraform plan, extracts changed resource data via terraform show -json, and publishes a structured event through SNS. That event is simultaneously routed to an SQS queue for audit logging and a Lambda function that classifies each change as HIGH, MEDIUM, or LOW severity, with results stored in CloudWatch. To keep payloads lean, only the resource address, type, and action fields are extracted using jq, rather than publishing the full before-and-after plan. During testing, a region mismatch between the AWS CLI default and the queue's actual region caused a false NonExistentQueue error, resolved by explicitly specifying the correct region in the CLI command.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
Discussion (0)
Log in to join the discussion and vote.
Log in