How Terraform Drift Silently Breaks Infrastructure and How to Manage It

Terraform drift occurs when real cloud infrastructure diverges from what Terraform's state file records, typically due to manual console edits, auto-scaling adjustments, or changes made by other tools. Common scenarios include emergency hotfixes applied directly in the cloud that get silently reverted on the next terraform apply, and cross-tool modifications where separate platforms alter resources Terraform believes it controls. Drift is particularly dangerous because it makes terraform plan output unreliable, leaving reviewers unable to distinguish intentional changes from unintended reversions. Security-sensitive resources face the highest risk, as manually altered IAM policies or security groups can represent compliance violations that persist undetected until an apply overwrites them. Running terraform plan with detailed exit codes is one of the simplest first steps teams can take to surface unexpected infrastructure differences.