TerraDriftTerraDrift
INFRASTRUCTURE DRIFT DETECTION

Catch Terraform drift before it hits prod

TerraDrift continuously compares your Terraform state against live AWS, Azure, and GCP — then explains every change and generates the fix.

4.9/5· Loved by 40+ platform teams · No credit card
driftguard scan --workspace prod
▍

LIVE SCAN · PROD WORKSPACE · READ-ONLY IAM · 8.4s

Trusted by infrastructure teams

AWS
Terraform
GitHub
Docker
Kubernetes
SOC 2 Type II· AuditedGDPR· CompliantRead-only IAM· No write access
0+
Resources scanned
0+
Drift events detected
< 30s
Median scan time
0.0%
Detection accuracy
Problem → Solution

Drift is inevitable. Catching it shouldn't be manual.

TerraDrift turns invisible infra changes into visible, actionable signals — before they become incidents.

Silent configuration drift

Someone opens the AWS console, tweaks a security group, and never updates Terraform. Your state file still says "clean" while prod quietly diverges.

Every attribute compared

Security & cost blind spots

A public S3 bucket or oversized instance slips through code review. No PR, no alert — until the breach or the bill.

Severity-classified in seconds

Manual firefighting

`terraform plan` on every workspace is slow, noisy, and unaudited. Teams waste hours reconciling what actually changed.

Automated scans + AI fix
The core problem

Terraform State vs Live Infrastructure

Terraform knows what your infrastructure should look like. Your cloud account knows what it actually looks like. When someone makes a manual change outside Terraform, the two diverge — that divergence is drift.

Terraform State — Desired
What Terraform expects to exist
aws_instance.web
CLEAN
aws_security_group.app
ingress: 443 onlyCLEAN
aws_s3_bucket.logs
private + encryptedCLEAN
aws_vpc.main
CLEAN
COMPARE2 drifted
Live Infrastructure — Actual
What is really running in AWS
aws_instance.web
CLEAN
aws_security_group.app
extra: SSH 22 from 0.0.0.0/0MODIFIED
aws_s3_bucket.logs
public access enabledMODIFIED
aws_vpc.main
CLEAN
How it works

From state file to fixed PR in minutes

TerraDrift connects your existing Terraform setup and takes care of the rest — no migration, no agents, no configuration rewrites.

Connect your infrastructure

Securely link your Terraform state backend and a read-only cloud role. No agents, no permanent keys, no code changes.

s3://tf-state/prodConnected
✓ Read-only IAM role verified

Detect drift automatically

Scheduled scans compare your Terraform state against live AWS APIs. Every change is flagged, classified by severity, and attributed.

aws_security_group.appCRITICAL
aws_s3_bucket.logsHIGH
aws_instance.webCLEAN

Fix with AI assistance

Get a plain-English root cause, security and cost impact, plus the exact Terraform code to revert the drift in a one-click PR.

✨ AI suggested fix
Remove unmanaged ingress rule:
- SSH (22) from 0.0.0.0/0
✓ Terraform code generated for your PR
Features

Everything platform teams need

Trust & authority built in — not bolted on. From detection to auditable fix, without changing how you ship.

CRITICAL · HIGH · MEDIUM

Precise diff, not just "drift"

Every attribute before → after, resource by resource. Severity-ranked so critical misconfigs surface first.

DesiredLive
ingress: 443 only
+ SSH 22 · 0.0.0.0/0
4 providers · 1 API

Multi-cloud, one control plane

AWS, GCP, Azure, and Kubernetes — same severity model, same audit trail. No per-provider quirks.

AWSGCPAzureK8s
Hourly · <30s median

Scans on your schedule

Hourly, daily, or weekly. Event-driven on `terraform apply` — drift never waits until next morning.

Hourly · 60mNext: 12m
OpenAI-powered

AI that explains & fixes

Plain-English root cause, security + cost impact, plus the exact Terraform code to revert in a PR.

// AI root cause
Ingress 0.0.0.0/0 added outside TF
✓ Fix generated
Slack · Email · Webhook

Alerts where you work

Slack, email, webhooks — with severity routing so only what matters pings you.

Slack ✓Email ✓Webhook ✓
SOC 2 · AES-256 · Read-only

Audit-ready & secure by default

AES-256-GCM at rest, short-lived IAM roles, SOC 2 Type II, 90-day history with full diff snapshots.

#28412 drifted
#2840clean
Product tour

See TerraDrift in action

Built for the way DevOps teams already work — no new dashboards to learn, no configs to babysit.

Resources
1,247
Drift
3
Scans
2,841
Accuracy
99.9%
prod-aws scan #2841
2 drifted resources · sg.app + bucket.logs
12m
staging-aws scan #2913
All 148 resources in sync
38m
dev-gcp scan #104
Scanning 62 resources…
now
01

A dashboard that answers one question: is prod clean?

Every workspace's health at a glance. Spot drift the moment a scan completes and jump straight to the affected resources.

prod-awsprod
Drift
2
Last scan
12 min ago
staging-awsstaging
Drift
0
Last scan
38 min ago
dev-gcpdev
Drift
0
Last scan
Scanning…
02

Every workspace, every backend, in one place

Organize production, staging, and development workspaces across AWS, GCP, and Azure with per-environment status.

WorkspaceStatusTime
prod-aws
Drift
2h ago
staging-aws
Passed
3h ago
dev-gcp
Scanning
now
prod-gcp
Passed
5h ago
prod-aws
Drift
8h ago
03

A full audit trail of every scan

Every scan is recorded with status, duration, and drift counts. Prove compliance with a complete, searchable history.

aws_security_group.appCRITICAL
Before
ingress: 443 only
→
After
+ SSH (22) from 0.0.0.0/0
aws_s3_bucket.logsHIGH
Before
public access blocked
→
After
public access enabled
aws_instance.webMEDIUM
Before
instance_type: t3.micro
→
After
instance_type: r5.xlarge
04

Pinpoint exactly what changed — before and after

Each drift item shows the precise attribute diff, a severity classification, and the resource address you can act on.

AI Analysis

An ingress rule allowing SSH (22) from 0.0.0.0/0 was added to aws_security_group.app outside Terraform.

Risk: CRITICALCost impact: ~$0/mo
# terraform fix — revert drift
resource "aws_security_group" "app" {
ingress {
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
# SSH rule removed — unmanaged
}
Copy fixOpen PR
05

AI that explains drift in plain English

Root cause, security risk, and cost impact — plus the exact Terraform code to fix it. Ready to paste into a pull request.

Trusted by infra teams

Teams that ship fast, stay in sync

Built for platform engineers who can't afford silent drift.

4.9/5 from 40+ teams·SOC 2 Type II & GDPR

“We caught a public S3 bucket drift on prod within 8 seconds of the manual change. Before TerraDrift that would have sat for weeks.”

Sarah Chen
Platform Lead · Fintech · 40 engineers
8s detection

“Finally a drift tool our SREs trust. Read-only IAM, clean diffs, and the AI fix actually matches our module structure.”

Marcus Reid
SRE Manager · Healthcare · SOC 2
99.9% accuracy

“Hourly scans across 12 workspaces replaced a flaky cron of terraform plans. Audit history alone saved us during our SOC 2 review.”

Priya Nair
DevOps Engineer · SaaS · 200k resources
12 workspaces
Integrates withAWSTerraform CloudGitHubSlackDatadog
Pricing

Simple, transparent pricing

Start free, upgrade as you scale. No hidden fees, no per-seat surprises.

Free

For evaluation — 1 workspace, weekly

$0/mo
  • 1 workspace
  • Weekly scans (10080m)
  • Email alerts
  • 7-day history
Get started
Most popular

Pro

For teams shipping daily — hourly

$49/mo
  • 10 workspaces
  • Hourly scans (60m)
  • All alert channels
  • 30-day history
  • AI explanations
Start trial

Business

For orgs with 10+ workspaces — hourly + API

$149/mo
  • Unlimited workspaces
  • Hourly scans (60m)
  • All alert channels
  • 90-day history
  • AI + API access
  • Team seats
  • Audit logs
Contact us
FAQ

Frequently asked questions

Terraform drift occurs when the actual state of your cloud infrastructure differs from the desired state defined in your Terraform configuration. This happens when changes are made manually outside of Terraform — through the AWS console, CLI, or automated processes — without updating the Terraform code. Drift can cause deployment failures, security vulnerabilities, and unexpected costs.

TerraDrift compares your Terraform state file against live cloud provider APIs. We pull your state from any backend (S3, GCS, Terraform Cloud), then query AWS, Azure, or GCP for every resource. Each attribute is compared — if anything differs, we flag it as drift, classify its severity, and generate a detailed report.

Yes. We encrypt all credentials at rest using AES-256-GCM, and they are only decrypted in memory during scans. We use short-lived IAM role assumptions (never storing permanent keys). Our infrastructure is SOC 2 compliant, and all access is logged and audited. We never have access to your production environments beyond read-only API calls.

We currently support AWS, Azure, Google Cloud Platform, and Kubernetes. Our provider-agnostic architecture means we can add support for new providers on demand. Each provider is monitored with the same severity classification and AI analysis pipeline.

Absolutely. Our Free tier includes 1 workspace with weekly scans, email alerts, and 7-day history — no credit card required. If you need more workspaces, faster scans, or AI explanations, you can upgrade to Pro or Business at any time. All plans include a 14-day money-back guarantee.

Most teams are live in under 15 minutes. Connect your Terraform state backend (S3, GCS, or Terraform Cloud), add a read-only IAM role ARN, and we'll run your first scan immediately. No agents to install and no changes to your existing Terraform code.

Start monitoring in minutes

Connect your Terraform state and read-only cloud role. Your first scan runs immediately — no agents, no code changes.

Read-only IAMSOC 2 Type IIGDPR
Get started freeNo credit card · 14-day free trial · Cancel anytime