Managing State Drift and Reconciliation
Detect, diagnose, and reconcile drift, the gap between your Terraform state and the real infrastructure, before it causes outages or surprise changes.
Managing State Drift and Reconciliation is a free DevOps Bootcamp lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the DevOps Bootcamp learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Is Drift?
Drift happens when real infrastructure changes outside Terraform, an engineer tweaks a setting in the console, or another tool modifies a resource. Now state and reality disagree, and the next apply may revert or clobber those changes unexpectedly.
Detecting Drift with plan
A plain terraform plan refreshes state and shows differences. If a resource drifted, the plan reports changes you did not make in code.
terraform planThe Refresh-Only Plan
To see drift without proposing config changes, use a refresh-only plan. It updates state to match reality and shows what differs.
terraform plan -refresh-onlyReading the Drift Report
Terraform marks drifted attributes with the change it detected. A tilde indicates an in-place change; a minus/plus pair indicates a value was added or removed outside Terraform.
# aws_instance.web has changed
~ instance_type = "t3.micro" -> "t3.small"Two Ways to Reconcile
When you find drift you choose a direction:
- Accept reality — update your code to match the new state.
- Restore code — apply to push infrastructure back to what the config says.
Accepting Drift into State
If the manual change was intentional, run apply -refresh-only to record reality in state, then update your code to match so future plans are clean.
terraform apply -refresh-onlyReverting Drift
If the change was unauthorized, a normal terraform apply pushes infrastructure back to the declared configuration, undoing the manual edit.
terraform applyTargeting a Single Resource
For a focused fix, -target limits the operation to one resource. Use sparingly; it can mask broader drift.
terraform apply -target=aws_instance.webPreventing Spurious Drift
Some attributes are managed by AWS or other tools. Use ignore_changes so Terraform stops fighting over them.
resource "aws_instance" "web" {
lifecycle {
ignore_changes = [tags["LastScanned"]]
}
}Continuous Drift Detection
Catch drift early by running a scheduled refresh-only plan in CI. Terraform Cloud offers built-in drift detection that alerts when state and reality diverge.
on:
schedule:
- cron: "0 6 * * *"Culture Beats Tooling
The best drift prevention is process: restrict console write access, route all changes through Terraform, and treat manual edits as incidents. Tooling detects drift; discipline avoids it.
Quick Check
Test your drift management knowledge.
Recap: Keeping State Honest
You can now handle drift:
- Detect it with
planorplan -refresh-only. - Accept it via
apply -refresh-onlyplus a code update. - Revert it with a normal
apply. - Use
ignore_changesand scheduled checks to stay ahead.
Frequently asked questions
Is the “Managing State Drift and Reconciliation” lesson free?
Yes — the full text of “Managing State Drift and Reconciliation” is free to read here on the web, and the DevOps Bootcamp course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the DevOps Bootcamp course, upgrade to CoddyKit PRO.
What will I learn in “Managing State Drift and Reconciliation”?
Detect, diagnose, and reconcile drift, the gap between your Terraform state and the real infrastructure, before it causes outages or surprise changes. You practise DevOps Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start DevOps Bootcamp?
No prior experience is required. DevOps Bootcamp on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Managing State Drift and Reconciliation” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this DevOps Bootcamp lesson?
Yes. Every DevOps Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Debugging Terraform Configurations
- Performance Optimization Strategies
- Disaster Recovery with Terraform
- Managing State Drift and Reconciliation