Drift Detection

Terraform Drift Detection

Maps live inventory to Terraform HCL resource types. For each resource type the platform knows how to match AWS IDs against Terraform state — surfacing resources created or modified outside Infrastructure-as-Code.

Resource types covered

Terraform HCL types tracked

Terraform state

Reads .tfstate files from S3 (or local). Each resource block contains the HCL type and the AWS resource ID stored under a configurable attribute (usually id).

ID matching

Each matcher normalizes both sides to a comparable form. For most resources the raw AWS ID matches directly; SQS queues and Lambda functions need a URL/name transform.

Unmanaged resources

Resources present in the inventory but absent from Terraform state are flagged as unmanaged — potential shadow infrastructure or forgotten resources.

Resource type mapping

One row per inventory resource type. Each row shows the Terraform HCL type(s) that map to it and the state attribute used to extract the AWS resource ID.

20 types

Service	Resource type	Inventory type	Terraform HCL type(s)	ID attribute
Compute	EC2 Instances	`aws:ec2:instance`	`aws_instance`	id (default)
Compute	Lambda Functions	`aws:lambda:function`	`aws_lambda_function`	`function_name`
Databases	Aurora Clusters	`aws:rds:cluster`	`aws_db_cluster` `aws_rds_cluster`	id (default)
Databases	DynamoDB Tables	`aws:dynamodb:table`	`aws_dynamodb_table`	id (default)
Databases	ElastiCache Clusters	`aws:elasticache:cluster`	`aws_elasticache_cluster`	id (default)
Databases	RDS Instances	`aws:rds:instance`	`aws_db_instance`	id (default)
Databases	Replication Groups	`aws:elasticache:replication_group`	`aws_elasticache_replication_group`	id (default)
Messaging	SQS Queues	`aws:sqs:queue`	`aws_sqs_queue`	id (default)
Network	ALB / NLB	`aws:elbv2:load_balancer`	`aws_lb` `aws_alb` `aws_nlb`	`arn`
Network	Classic Load Balancers	`aws:elb:load_balancer`	`aws_elb`	id (default)
Network	Elastic IPs	`aws:ec2:eip`	`aws_eip`	id (default)
Network	Internet Gateways	`aws:ec2:internet_gateway`	`aws_internet_gateway`	id (default)
Network	NAT Gateways	`aws:ec2:nat_gateway`	`aws_nat_gateway`	id (default)
Network	Subnets	`aws:ec2:subnet`	`aws_subnet`	id (default)
Network	VPCs	`aws:ec2:vpc`	`aws_vpc`	id (default)
Security	KMS Keys	`aws:kms:key`	`aws_kms_key`	id (default)
Security	Secrets	`aws:secretsmanager:secret`	`aws_secretsmanager_secret`	id (default)
Storage	EBS Snapshots	`aws:ebs:snapshot`	`aws_ebs_snapshot`	id (default)
Storage	EBS Volumes	`aws:ec2:volume`	`aws_ebs_volume`	id (default)
Storage	S3 Buckets	`aws:s3:bucket`	`aws_s3_bucket`	id (default)