Terraform Drift Detection
Maps live inventory to Terraform HCL resource types. For each resource type the platform knows how to match AWS IDs against Terraform state — surfacing resources created or modified outside Infrastructure-as-Code.
How it works
Three steps from state file to drift verdict.
Terraform state
Reads .tfstate files from S3 (or local). Each resource block contains the HCL type and the AWS resource ID stored under a configurable attribute (usually id).
ID matching
Each matcher normalizes both sides to a comparable form. For most resources the raw AWS ID matches directly; SQS queues and Lambda functions need a URL/name transform.
Unmanaged resources
Resources present in the inventory but absent from Terraform state are flagged as unmanaged — potential shadow infrastructure or forgotten resources.
Resource type mapping 20 types
One row per inventory resource type. Each row shows the Terraform HCL type(s) that map to it and the state attribute used to extract the AWS resource ID.
| Service | Resource type | Inventory type | Terraform HCL type(s) | ID attribute |
|---|---|---|---|---|
| Compute | EC2 Instances |
aws:ec2:instance
|
aws_instance
|
id (default) |
| Compute | Lambda Functions |
aws:lambda:function
|
aws_lambda_function
|
function_name
|
| Databases | Aurora Clusters |
aws:rds:cluster
|
aws_db_cluster
aws_rds_cluster
|
id (default) |
| Databases | DynamoDB Tables |
aws:dynamodb:table
|
aws_dynamodb_table
|
id (default) |
| Databases | ElastiCache Clusters |
aws:elasticache:cluster
|
aws_elasticache_cluster
|
id (default) |
| Databases | RDS Instances |
aws:rds:instance
|
aws_db_instance
|
id (default) |
| Databases | Replication Groups |
aws:elasticache:replication_group
|
aws_elasticache_replication_group
|
id (default) |
| Messaging | SQS Queues |
aws:sqs:queue
|
aws_sqs_queue
|
id (default) |
| Network | ALB / NLB |
aws:elbv2:load_balancer
|
aws_lb
aws_alb
aws_nlb
|
arn
|
| Network | Classic Load Balancers |
aws:elb:load_balancer
|
aws_elb
|
id (default) |
| Network | Elastic IPs |
aws:ec2:eip
|
aws_eip
|
id (default) |
| Network | Internet Gateways |
aws:ec2:internet_gateway
|
aws_internet_gateway
|
id (default) |
| Network | NAT Gateways |
aws:ec2:nat_gateway
|
aws_nat_gateway
|
id (default) |
| Network | Subnets |
aws:ec2:subnet
|
aws_subnet
|
id (default) |
| Network | VPCs |
aws:ec2:vpc
|
aws_vpc
|
id (default) |
| Security | KMS Keys |
aws:kms:key
|
aws_kms_key
|
id (default) |
| Security | Secrets |
aws:secretsmanager:secret
|
aws_secretsmanager_secret
|
id (default) |
| Storage | EBS Snapshots |
aws:ebs:snapshot
|
aws_ebs_snapshot
|
id (default) |
| Storage | EBS Volumes |
aws:ec2:volume
|
aws_ebs_volume
|
id (default) |
| Storage | S3 Buckets |
aws:s3:bucket
|
aws_s3_bucket
|
id (default) |