drift-detector

Infrastructure Drift Detector

Detect, track, and resolve infrastructure drift between Terraform state and actual cloud resources to maintain Infrastructure as Code integrity.

Core Principle: Your cloud should match your code.

Note: This skill uses snyk iac describe CLI command (requires shell execution).

---

Quick Start

# Basic drift scan against a local Terraform state file
snyk iac describe --from=tfstate://terraform.tfstate

# Output as JSON for further analysis
snyk iac describe --from=tfstate://terraform.tfstate --json > drift-report.json

---

Prerequisites

• Terraform project with state file (local or remote)
• Cloud provider credentials configured
• snyk CLI installed
• Network access to cloud APIs

Supported Cloud Providers

Provider	Setup
AWS	AWS credentials (profile, env vars, or IAM role)
Azure	Azure CLI login or service principal
GCP	Application default credentials or service account

For a full list of supported resource types per provider, see SERVICES.md.

---

Phase 1: Setup

Goal: Configure drift detection environment.

Step 1.1: Verify Terraform State

Check for Terraform state:

Local state:

ls terraform.tfstate

Remote state (S3 backend):

terraform {
  backend "s3" {
    bucket = "my-terraform-state"
    key    = "state/terraform.tfstate"
    region = "us-east-1"
  }
}

Step 1.2: Verify Cloud Credentials

AWS:

aws sts get-caller-identity

Azure:

az account show

GCP:

gcloud auth application-default print-access-token

---

Phase 2: Run Drift Detection

Goal: Identify differences between IaC and actual cloud state.

Step 2.1: Basic Drift Scan

snyk iac describe --from=tfstate://terraform.tfstate

Step 2.2: Remote State Scan

For S3 backend:

snyk iac describe --from=tfstate+s3://my-bucket/state.tfstate

For Terraform Cloud:

snyk iac describe \
  --from=tfstate+tfcloud://organization/workspace \
  --tfc-token=$TFC_TOKEN