VocalHyre
Sign up

Terraform · Infrastructure as code

How do you detect and handle infrastructure drift?

MediumdriftrefreshreconciliationUpdated Oct 2026
Quiz this track

Short answer

Drift is the difference between real infrastructure and Terraform state. Detect it with scheduled plans or refresh-only runs, then decide whether to codify the manual change or revert it.

Drift happens when someone changes a resource outside Terraform, when another automation modifies it, or when a provider changes defaults. Terraform compares configuration, state and the refreshed remote object during plan, so a diff is the first signal.

sh
terraform plan -refresh-only
terraform apply -refresh-only
terraform plan -detailed-exitcode
A refresh-only run updates state to match reality without changing infrastructure. Use it to inspect drift deliberately.

Causes and responses

  • Console changes: either codify them or revert them through Terraform
  • Other automation: define ownership and remove the competing writer
  • Provider default changes: pin providers and review upgrade plans
  • Resource deletion: decide whether to recreate or remove the block

The response depends on intent. If the manual change is correct, update the configuration and apply so the code matches. If it is wrong, apply the original configuration to restore it. Never use refresh-only as a substitute for fixing the configuration; it only updates state.

Run scheduled plans against production on a cadence and alert on non-empty diffs. Drift detection only works if someone owns the alert and the remediation.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

  1. 1What is the difference between a normal plan and a refresh-only plan?
  2. 2How do you decide whether to codify or revert drift?
  3. 3Why can pinning providers help with drift?
  4. 4How would you alert on drift in production?

Say it in the interview

Drift is any difference between what Terraform recorded, what the configuration says, and what actually exists. I detect it with scheduled plans or a refresh-only run, then decide whether the manual change should be codified or reverted. Refresh-only updates state but not configuration, so it is an inspection tool, not the fix. The alert needs a clear owner, otherwise drift reports get ignored.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Related questions

MediumWhat is Terraform state and why is it needed?MediumHow do you safely review and apply a Terraform plan?HardHow do you design a safe Terraform CI/CD pipeline?

Reading is step one

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Terraform mock interview and get scored feedback on depth, clarity and confidence.

Start a free Terraform interviewBrowse all questions