TerraDriftTerraDrift
Infrastructure drift detection

Catch Terraform drift before it hits prod

TerraDrift continuously compares your Terraform state against live AWS, Azure, and GCP infrastructure — then explains every change, estimates the impact, and generates the fix.

No credit card · Free tier includes 1 workspace

driftguard scan --workspace prod
▍

Trusted by infrastructure teams

AWSTerraformKubernetesGitHubSlackDatadogDockerPagerDuty
0+
Resources scanned
0+
Drift events detected
< 30s
Median scan time
0.0%
Detection accuracy
How it works

From state file to fixed PR in minutes

TerraDrift connects your existing Terraform setup and takes care of the rest — no migration, no agents, no configuration rewrites.

Connect your infrastructure

Securely link your Terraform state backend and a read-only cloud role. No agents, no permanent keys, no code changes.

s3://tf-state/prodConnected
✓ Read-only IAM role verified

Detect drift automatically

Scheduled scans compare your Terraform state against live AWS APIs. Every change is flagged, classified by severity, and attributed.

aws_security_group.appCRITICAL
aws_s3_bucket.logsHIGH
aws_instance.webCLEAN

Fix with AI assistance

Get a plain-English root cause, security and cost impact, plus the exact Terraform code to revert the drift in a one-click PR.

✨ AI suggested fix
Remove unmanaged ingress rule:
- SSH (22) from 0.0.0.0/0
✓ Terraform code generated for your PR
Product tour

See TerraDrift in action

Built for the way DevOps teams already work — no new dashboards to learn, no configs to babysit.

Resources
1,247
Drift
3
Scans
2,841
Accuracy
99.9%
prod-aws scan #2841
2 drifted resources · sg.app + bucket.logs
12m
staging-aws scan #2913
All 148 resources in sync
38m
dev-gcp scan #104
Scanning 62 resources…
now
01

A dashboard that answers one question: is prod clean?

Every workspace's health at a glance. Spot drift the moment a scan completes and jump straight to the affected resources.

prod-awsprod
Drift
2
Last scan
12 min ago
staging-awsstaging
Drift
0
Last scan
38 min ago
dev-gcpdev
Drift
0
Last scan
Scanning…
02

Every workspace, every backend, in one place

Organize production, staging, and development workspaces across AWS, GCP, and Azure with per-environment status.

WorkspaceStatusTime
prod-aws
Drift
2h ago
staging-aws
Passed
3h ago
dev-gcp
Scanning
now
prod-gcp
Passed
5h ago
prod-aws
Drift
8h ago
03

A full audit trail of every scan

Every scan is recorded with status, duration, and drift counts. Prove compliance with a complete, searchable history.

aws_security_group.appCRITICAL
Before
ingress: 443 only
→
After
+ SSH (22) from 0.0.0.0/0
aws_s3_bucket.logsHIGH
Before
public access blocked
→
After
public access enabled
aws_instance.webMEDIUM
Before
instance_type: t3.micro
→
After
instance_type: r5.xlarge
04

Pinpoint exactly what changed — before and after

Each drift item shows the precise attribute diff, a severity classification, and the resource address you can act on.

AI Analysis

An ingress rule allowing SSH (22) from 0.0.0.0/0 was added to aws_security_group.app outside Terraform.

Risk: CRITICALCost impact: ~$0/mo
# terraform fix — revert drift
resource "aws_security_group" "app" {
ingress {
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
# SSH rule removed — unmanaged
}
Copy fixOpen PR
05

AI that explains drift in plain English

Root cause, security risk, and cost impact — plus the exact Terraform code to fix it. Ready to paste into a pull request.

The core problem

Terraform State vs Live Infrastructure

Terraform knows what your infrastructure should look like. Your cloud account knows what it actually looks like. When someone makes a manual change outside Terraform, the two diverge — that divergence is drift.

Terraform State — Desired
What Terraform expects to exist
aws_instance.web
CLEAN
aws_security_group.app
ingress: 443 onlyCLEAN
aws_s3_bucket.logs
private + encryptedCLEAN
aws_vpc.main
CLEAN
COMPARE2 drifted
Live Infrastructure — Actual
What is really running in AWS
aws_instance.web
CLEAN
aws_security_group.app
extra: SSH 22 from 0.0.0.0/0MODIFIED
aws_s3_bucket.logs
public access enabledMODIFIED
aws_vpc.main
CLEAN
Pricing

Simple, transparent pricing

Start free, upgrade as you scale. No hidden fees, no per-seat surprises.

Free

For personal projects and evaluation

$0/mo
  • 1 workspace
  • Weekly scans
  • Email alerts
  • 7-day history
Get started
Most popular

Pro

For small teams that need speed

$49/mo
  • 10 workspaces
  • Hourly scans
  • All alert channels
  • 30-day history
  • AI explanations
Start trial

Business

For scaling infrastructure orgs

$149/mo
  • Unlimited workspaces
  • Hourly scans
  • All alert channels
  • 90-day history
  • AI + API access
  • Team seats
  • Audit logs
Contact us
FAQ

Frequently asked questions

Terraform drift occurs when the actual state of your cloud infrastructure differs from the desired state defined in your Terraform configuration. This happens when changes are made manually outside of Terraform — through the AWS console, CLI, or automated processes — without updating the Terraform code. Drift can cause deployment failures, security vulnerabilities, and unexpected costs.

TerraDrift compares your Terraform state file against live cloud provider APIs. We pull your state from any backend (S3, GCS, Terraform Cloud), then query AWS, Azure, or GCP for every resource. Each attribute is compared — if anything differs, we flag it as drift, classify its severity, and generate a detailed report.

Yes. We encrypt all credentials at rest using AES-256-GCM, and they are only decrypted in memory during scans. We use short-lived IAM role assumptions (never storing permanent keys). Our infrastructure is SOC 2 compliant, and all access is logged and audited. We never have access to your production environments beyond read-only API calls.

We currently support AWS, Azure, Google Cloud Platform, and Kubernetes. Our provider-agnostic architecture means we can add support for new providers on demand. Each provider is monitored with the same severity classification and AI analysis pipeline.

Absolutely. Our Free tier includes 1 workspace with weekly scans, email alerts, and 7-day history — no credit card required. If you need more workspaces, faster scans, or AI explanations, you can upgrade to Pro or Business at any time. All plans include a 14-day money-back guarantee.

Most teams are live in under 15 minutes. Connect your Terraform state backend (S3, GCS, or Terraform Cloud), add a read-only IAM role ARN, and we'll run your first scan immediately. No agents to install and no changes to your existing Terraform code.

Start monitoring in minutes

Connect your Terraform state and read-only cloud role. Your first scan runs immediately — no agents, no code changes.

Get started freeNo credit card · 14-day free trial · Cancel anytime