Lion Cipher Lab
Detect and reconcile Terraform drift
- Cloud Security
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Infrastructure as Code only holds its promise while the code and the real infrastructure agree. The moment someone reaches past the code — clicks a fix in the cloud console at 2 a.m., runs a one-off script, lets another tool touch the same resource — the two quietly diverge. That gap is called drift, and it is dangerous precisely because it is invisible until it bites: your next deploy silently reverts an emergency fix, a security setting someone tightened by hand gets loosened back to what the code says, or an audit finds the running system does not match the reviewed, version-controlled…
What you'll learn
- understanding configuration drift
- reading a terraform plan diff
- refreshing Terraform state against reality
- using terraform plan -refresh-only and apply -refresh-only
- choosing between code-as-truth and world-as-truth reconciliation
- inspecting state with terraform state list and terraform show
- recognising manual changes as an IaC anti-pattern
- designing scheduled drift detection
Steps in this lab
- The words first: Terraform, state, provider, resource, drift
- Install Terraform and confirm it runs
- Write a tiny configuration that manages one local file
- Initialize and apply: create the file, record it in state
- Introduce drift on purpose: change the file by hand
- Detect the drift: terraform plan and the refresh step
- See drift alone with -refresh-only (detect without proposing changes)
- Reconcile, path A — world is truth: apply -refresh-only
- Reconcile, path B — code is truth: apply to heal the drift
- Judgment: when each reconciliation is right — and when NOT to