A Terraform drift detector that runs in CI
Ended up ~80 lines of Go plus a GitHub Action. The interesting part was ignoring managed-by-someone-else tags.
I want CI to fail when someone changes infra in the console instead of Terraform. `terraform plan` exits 0 even when there is drift. How do I detect it properly?
`terraform plan -detailed-exitcode` is the piece you're missing: - `0` — no changes - `1` — error - `2` — changes present ```bash terraform plan -detailed-exitcode -out=tfplan ``` Exit 2 in a scheduled run means drift, because nothing in the repo changed. The subtlety is that you'll get false positives from anything mutated outside Terraform by design — autoscaling group sizes, tags applied by AWS Config, `aws:` prefixed tags. Parse the JSON plan and filter those out rather than failing the build on them.