What TerraDrift is
TerraDrift continuously compares your Terraform state against live AWS, Azure, and GCP infrastructure. When someone changes a security group in the console, an autoscaler adds capacity outside Terraform, or a resource is deleted by hand, TerraDrift detects it, explains it in plain language, estimates cost and security impact, and generates the Terraform fix.
Detect
Scheduled + on-demand scans diff desired state vs. live cloud APIs.
Explain
AI summaries turn raw diffs into what changed, why it matters, and blast radius.
Fix
One-click remediations generate import blocks and corrected HCL.
How drift detection works
A scan is a four-stage pipeline. TerraDrift never shells into your instances and never needs long-lived cloud credentials with write scope — every stage runs least-privilege and is logged.
Step 1 — Parse desired state
We parse your Terraform state (S3, GCS, Terraform Cloud, or uploaded .tfstate) to build the desired-state inventory. State is encrypted at rest with AES-256 and decrypted only in memory during a scan.
Step 2 — Read live infrastructure
Using the read-only IAM role you created, we call Describe/List cloud APIs (e.g. EC2 DescribeInstances, S3 ListBucket). No agents, no SSH, no write calls — ever.
Step 3 — Diff & classify
Resources are matched by ID/ARN and diffed attribute-by-attribute. Each drift is classified by severity (critical / high / medium / low) and category: added, removed, or modified outside Terraform.
Step 4 — Explain, score & notify
AI generates a plain-language explanation with impact and a suggested fix. Results land in the dashboard and fan out to Slack, webhooks, and CI gates — with severity routing so on-call only pages on what matters.
First scan in under 10 minutes
You need three things: a TerraDrift account, a read-only cloud role, and a pointer to your Terraform state. No agents, no code changes, no pipeline rewrites.
- Least-privilege by construction. The Trust policy pins our external ID and your workspace ID — the role cannot be assumed by anyone else.
- No static keys required. Prefer short-lived OIDC / role assumption. Static keys are supported only for locked-down legacy setups and are encrypted immediately.
- Validate before prod. Run the first scan against staging, open the diff viewer, then promote the same role pattern to production.
Built for the people who carry the pager
Drift is the silent cause of failed deploys, widened security groups nobody approved, and 3 a.m. pages. TerraDrift slots into existing DevOps/SRE workflows instead of inventing new ones.
SRE golden signals for infra
Track drift rate, mean-time-to-remediate, and repeat-offender resources per workspace. Export to Datadog / Grafana via webhooks for SLO dashboards.
On-call friendly alerting
Severity routing: critical drift (public S3, 0.0.0.0/0 SG) pages PagerDuty/Opsgenie; low drift (tags, descriptions) becomes a Slack thread. No alert fatigue.
CI/CD gates
Fail `terraform apply` pipelines when pre-apply scans find unacknowledged critical drift. `terradrift scan --fail-on critical` exits non-zero — works in GitHub Actions, GitLab CI, Jenkins.
Multi-env, multi-cloud
Separate workspaces per env/account/region with per-workspace schedules. One pane for AWS + Azure + GCP — stop tab-hopping across three consoles.
Secure by design — what your security team will ask
Connecting a third party to production infrastructure is a trust decision. Here is exactly what TerraDrift can and cannot do, and the controls that enforce it. This is the section to forward to your security review.
The one-sentence guarantee
TerraDrift holds read-only access to your cloud, cannot modify or delete anything in your accounts, encrypts everything with AES-256 at rest + TLS 1.2+ in transit, isolates every customer with org-scoped queries on every row, and records who did what, when in a tamper-evident audit log.
Read-only IAM — enforced, not promised
You create the role with ReadOnlyAccess (or narrower). TerraDrift never requests iam:PassRole, write, or admin actions, and the scanner's API allowlist contains only Describe/List/Get calls. Even a full backend compromise cannot escalate into your cloud because the capability simply isn't granted.
Encryption everywhere
TLS 1.2+ in transit. AES-256 at rest for Terraform state, scan snapshots, credentials, and AI summaries. Short-lived JWT access tokens (httpOnly cookies, never localStorage) + rotating refresh tokens. Database backups are encrypted with separate keys.
Strict tenant isolation
Every API query is scoped by organization ID at the data layer — workspaces, scans, drifts, and findings from org A are unreachable from org B even with a valid session. IDs in URLs are re-validated against membership on every request; guessing a UUID yields 404, never data.
Credentials you can rotate in one click
Cloud credentials and state-bucket keys are stored encrypted, shown once, and rotatable per workspace. Revoke the IAM role on your side and TerraDrift loses access instantly — scans fail closed with a clear 'access revoked' status instead of stale green.
Compliance posture
SOC 2 Type II audited controls, GDPR data-processing terms with EU data residency options, and data-retention policies (auto-purge scan snapshots on request). Audit exports (CSV/JSON) map drift events to SOC 2 CC7/CC8 change-monitoring evidence.
No agents, no inbound access
There is nothing to install in your VPC and no inbound firewall rules. All connections are outbound from TerraDrift to your cloud APIs — your network perimeter never opens. Supply-chain surface stays minimal: one SaaS integration instead of agents on every host.
How we handle Terraform state and secrets
State files famously contain secrets. TerraDrift treats state as sensitive by default — which is why SREs ask about this first.
- Secrets are redacted before display and before AI. Values matching secret patterns (passwords, private keys, tokens, connection strings) are masked in the diff viewer, API responses, and AI prompts.
- AI sees structure, not secrets. Explanations are generated from redacted diffs. State contents are never used to train shared models, and per-customer retention windows apply.
- Prefer remote state, keep it that way. S3/GCS/Terraform Cloud backends are read through short-lived credentials. Direct uploads are scanned in memory and the raw file is discarded after parsing.
- Bring your own bucket policy. Scope the state-read principal to GetObject on the exact state prefix — sample least-privilege policies are provided per backend.
RBAC, SSO, and audit logging
Not everyone on the team needs to rotate credentials or delete workspaces. Roles keep production boring.
- SSO (GitHub + Google) with enforced MFA. Sessions are httpOnly cookies — tokens never touch localStorage or URLs. Idle + absolute timeouts included.
- Audit log on everything. Logins, role changes, credential rotations, scan triggers, acknowledgements, and exports — actor, timestamp, IP, and before/after — exportable for SIEM.
- API keys are scoped and expirable. Service keys carry workspace scope + expiry, are shown once, hashed at rest, and revocable instantly.
CI/CD gates, Slack, and webhooks
CI gate
terradrift scan --fail-on critical blocks apply on unacknowledged drift. Exit codes your pipeline already understands.
Slack
Per-workspace channels with severity filters. Critical drift threads include the diff, owner, and one-click acknowledge.
Webhooks
Signed (HMAC) JSON events — scan.completed, drift.critical — for PagerDuty, Datadog, or your own runbooks.
Security FAQ
Can TerraDrift change or delete my infrastructure?
No. It operates exclusively with the read-only role you create. There is no code path that issues mutating cloud API calls, and remediation is delivered as Terraform HCL for you to apply — TerraDrift never applies it.
What happens if I revoke the IAM role?
Scans fail closed immediately with an 'access revoked' status and an alert to workspace admins. No stale green dashboards. Re-grant the role to resume — no re-onboarding needed.
Do you store my cloud credentials?
Only the minimum needed to assume your role (role ARN + external ID), encrypted at rest. Prefer OIDC-style short-lived assumption so there is no static secret at all.
How is my Terraform state protected?
Encrypted with AES-256 at rest, decrypted only in memory during a scan, with secrets redacted before display, API responses, and AI processing.
Can other customers see my data?
No. Every query is organization-scoped at the data layer, IDs are re-authorized per request, and penetration-tested tenant isolation is part of our SOC 2 controls.