Developer Builds Terraform Drift Detector Using AWS CodeBuild and SNS Alerts

A developer identified a critical blind spot in Terraform: manual changes made to AWS infrastructure via the console go undetected until the next time 'terraform plan' is run, which could be months later. To address this, they built an automated drift detection system using AWS CodeBuild, which periodically runs 'terraform plan' against a three-tier AWS infrastructure project. CodeBuild spins up a clean Linux environment, installs Terraform, clones the repository, and executes a plan using the '-detailed-exitcode' flag to distinguish between no change, an error, or actual drift. When infrastructure drift is detected, an SNS notification is automatically sent via email to alert the team. CodeBuild was chosen over AWS Lambda due to its simpler setup, eliminating the need to package Terraform into a container image stored in ECR.