How to Build a Terraform Drift Detection and Remediation Pipeline in CI

Terraform drift occurs when real cloud infrastructure diverges from the declared configuration, often due to manual console changes, third-party automation, or cloud provider-assigned defaults. Left undetected, drift can cause a scheduled terraform apply to silently revert emergency fixes or generate noisy, untrustworthy plan diffs that engineers begin to ignore. The proposed solution is a scheduled CI job that runs a plan, classifies detected drift, and opens a pull request or issue for human review before taking any action. For low-risk, narrowly scoped cases, the pipeline can also remediate automatically, but only after meeting strict prerequisites such as remote state with locking, pinned CLI versions, and read-only cloud credentials. Key technical requirements include using a supported locking backend like S3 native locking or Terraform Cloud, committing the lock file, and ensuring CI credentials are properly scoped to prevent false positives and state corruption.