drift-detector

Infrastructure Drift Detector

Detect, track, and resolve infrastructure drift between Terraform state and actual cloud resources to maintain Infrastructure as Code integrity.

Core Principle: Your cloud should match your code.

Note: This skill uses snyk iac describe CLI command (requires shell execution).

Quick Start

# Basic drift scan against a local Terraform state file
snyk iac describe --from=tfstate://terraform.tfstate
 
# Output as JSON for further analysis
snyk iac describe --from=tfstate://terraform.tfstate --json >

Prerequisites

• Terraform project with state file (local or remote)
• Cloud provider credentials configured
• snyk CLI installed
• Network access to cloud APIs

Supported Cloud Providers

For a full list of supported resource types per provider, see SERVICES.md.

Phase 1: Setup

Goal: Configure drift detection environment.

Step 1.1: Verify Terraform State

Check for Terraform state:

Local state:

Remote state (S3 backend):

Step 1.2: Verify Cloud Credentials

AWS:

Azure:

GCP:

Phase 2: Run Drift Detection

Goal: Identify differences between IaC and actual cloud state.

Step 2.1: Basic Drift Scan

Step 2.2: Remote State Scan

For S3 backend:

For Terraform Cloud:

Step 2.3: Specific Service Scan

To focus on specific AWS services:

Step 2.4: JSON Output for Analysis

Phase 3: Analyze Results

Goal: Understand and categorize drift.

Step 3.1: Drift Categories

Step 3.2: Generate Report

Step 3.3: Risk Assessment

Prioritize Critical issues first (e.g. SSH opened to 0.0.0.0/0, production HA disabled), then High risk issues (e.g. unmanaged IAM users or security groups). Document the affected resource, the risk, and the intended remediation action for each finding.

Phase 4: Remediation

Goal: Resolve drift and restore IaC integrity.

Step 4.1: Import Unmanaged Resources

For resources that should be in Terraform:

Step 4.2: Remove Unauthorized Resources

For resources that shouldn't exist:

Step 4.3: Revert Changes

For resources modified outside Terraform:

Step 4.4: Update Terraform (Adopt Changes)

If the manual change should be kept:

Phase 5: Prevention

Goal: Prevent future drift.

Step 5.1: Generate Exclude Policy

For expected drift (auto-scaling, etc.):

This creates a .snyk policy file:

Step 5.2: CI/CD Integration

Add drift detection to CI/CD:

Step 5.3: Regular Audits

Schedule regular drift audits:

Common Scenarios

For detailed worked examples, see EXAMPLES.md. Brief references:

• Post-Incident Audit: Run drift detection with JSON output, filter for security-related resources, identify unauthorized changes, generate incident report, remediate and document.
• Pre-Deployment Check: Run drift detection, fail deployment if drift exists, resolve drift first, then proceed with deployment.
• Shadow IT Discovery: Run drift detection, filter to unmanaged resources, categorize by owner/purpose, import or remove as appropriate.

Error Handling

State Access Error

Cloud Credential Error

Service Not Supported

Constraints

1. Read-only: This skill only detects drift, doesn't modify resources
2. Credentials required: Needs cloud provider access
3. Service coverage: Not all resource types supported
4. State required: Must have Terraform state to compare
5. Network required: Needs access to cloud APIs