The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Configuration drift occurs when managed infrastructure no longer matches its declared configuration. Detect it by comparing live resources with the state and configuration your tool tracks; then decide whether to update the configuration to keep an approved change or apply the declared configuration to revert it. In Terraform, terraform plan -refresh-only helps inspect remote changes, but it does not repair live infrastructure.
What is configuration drift?
Configuration drift is a mismatch between the intended settings in your infrastructure configuration and the settings of the real resources managed from it. A common cause is an edit made outside the usual version-controlled deployment process, such as a direct console or API change.
As an Amazon Associate I earn from qualifying purchases.
Drift is meaningful only within the scope a tool tracks. A tool cannot report an unmanaged resource or an attribute it does not inspect as a mismatch against declared configuration.
Configuration drift versus state drift
Configuration drift means the live infrastructure no longer matches the declared configuration, so the configuration no longer describes the environment as it exists. State drift is different: external changes are reflected in state without invalidating the configuration. HCP Terraform explicitly distinguishes the two and says its drift detection does not detect state drift.
#1 Best Overall
- WIFI ENABLED TO CONTROL FROM ANYWHERE – Transform your home into a smart home with the Feit Electric Smart Wi-Fi Plug. Remotely turn on or off lights, fans, coffee makers, or other home appliances from your smartphone or tablet. Works seamlessly with Alexa and Google Home, giving you effortless voice control without needing a separate hub. Manage your devices anytime, whether you’re at home, at work, or traveling.
- SIMPLE SETUP, NO HUB REQUIRED – Enjoy the convenience of smart home automation without extra equipment. The plug connects directly to your 2.4 GHz Wi-Fi network, making installation fast and easy. Plug it in, download the Feit Electric app, follow the simple steps, and your devices are instantly connected. Perfect for beginners or anyone looking to expand their smart home ecosystem with minimal hassle.
- SET YOUR ROUTINE & SAVE ENERGY – Save energy, stay organized, and automate daily routines with customizable schedules and timers. Set your lamps, heaters, or appliances to turn on and off automatically at specific times, ensuring your home is always comfortable and efficient. Ideal for morning routines, evening wind-downs, or holiday lighting, giving you peace of mind and energy savings without constant manual operation.
- ENHANCED SAFETY & CONVENIENCE – Protect your home and appliances with the Feit Electric Smart Plug’s durable design and safety features. Its compact size fits easily into standard indoor outlets without blocking other sockets. With real-time app control and notifications, you can monitor appliance activity and prevent energy waste. Ideal for families, pet owners, or anyone seeking a smarter, safer, and more convenient home setup.
- RELIABLE 2.4GHz WI-FI PERFORMANCE – Designed to work exclusively on 2.4 GHz networks, this smart plug provides stable connectivity for smooth operation of all your devices. Avoid interruptions caused by incompatible networks, ensuring your appliances respond instantly when controlled via the app or voice commands. Perfect for indoor home use, it supports up to 15 amps, handling heavy-duty appliances safely and reliably.
How do I detect configuration drift?
Start by identifying the source of truth, the resources under management, and the attributes that matter. Then use a detection method that compares those tracked resources with current infrastructure. A report is a signal to review, not proof that every difference is harmful or that every resource was covered.
Terraform CLI: inspect remote changes
- From the Terraform working directory, run
terraform plan -refresh-only. - Review the proposed state changes to see which observed remote values differ from Terraform’s recorded values.
- Decide whether the observation should be recorded in state, whether configuration should change, or whether the infrastructure should be restored to its declared settings.
Terraform normally refreshes its view of managed resources during plan and apply operations. The refresh-only plan makes the proposed state updates reviewable. HashiCorp’s drift tutorial recommends this over the older terraform refresh subcommand, which automatically overwrites state without showing the proposed updates.
HCP Terraform: health assessments
HCP Terraform health assessments compare current infrastructure settings with resources tracked in workspace state, using non-actionable refresh-only plans. They can provide periodic or on-demand visibility alongside health checks. Assessments do not change infrastructure or configuration. Check HashiCorp’s current documentation for workspace eligibility and edition prerequisites, which can change.
Recommended Free Tools
Rank #2
- equipped with atom n2600 d2700 processor, compatible with many freebsd based router systems, linux distros, or win.os supported, easy configuration and management
- Please note, this is a barebone only. A system memory, a storage drive and an operating system are needed to complete this system
- 13-19 inches 1u, 50w power, with power cord, make sure to use a big brand memory and ssd/hdd with quality assurance
- Designed with console, 2 x usb, 4 x lan, vga, power switch, size at 290 x 180 x 44mm
- There are 2 inside reserved fans on chassis, which could be removed freely or be turned on in a high temperature environment to ensure the best function of the product
AWS CloudFormation stacks: AWS Config rule
For CloudFormation stacks, AWS Config’s cloudformation-stack-drift-detection-check evaluates drift when configuration changes and periodically. AWS describes a stack as drifted when one or more resources differ from their expected configuration. Detection can take several minutes; broad scope can cause the rule to time out, so AWS recommends dividing stacks into groups with tags. The rule also has regional support exceptions, which operators should verify for their deployment region.
Review the signal before treating it as an incident
Check whether each difference is intentional, material, and within the tool’s coverage. Unset attributes and provider-assigned defaults can produce reported differences. Provider read behavior matters too: Terraform providers need to keep resource state current through their read operations, and incomplete synchronization can weaken the drift signal. Explicitly declare critical values and verify that the relevant resources and attributes are monitored.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do I fix Terraform drift?
For each meaningful difference, record who made or approved it, why it happened, its risk, and which setting should be authoritative. Then choose one of two outcomes for the live resource: retain the accepted change or restore the declared configuration.
Rank #3
- Shelly Plus 1 PM is a Wi-Fi smart relay switch with 1 channel, up to 16A with power metering that can be used also as a WiFi repeater and Bluetooth gateway. Shelly Plus 1PM can be used to monitor the consumption and take control of home appliances, electric circuits, and office equipment individually.
- Automate electrical appliance and control - With Shelly Plus 1PM you can automate any electrical appliance in your home and control it remotely. Shelly Plus 1PM can control appliances with a large load which makes it perfect for kitchen appliances and domestic systems monitoring and control. You can get precise measurements of the power consumption of each appliance and switch in on/off remotely, no matter where you are.
- Set and be prepared for everything - Reveal the full potential of Shelly Plus 1PM by combining it with other devices from your home network! Set Shelly Plus 1PM to activate custom scenes based on hour, light, or various occurrences. For example, you can set Shelly Door/Window sensor to report a porch door opening and activate Shelly Plus 1PM to turn on the hot tub heaters only in the hours after 8 pm.
- Shelly Customer Service - Shelly is one of the fastest-growing Smart Home brands in the world with devices, providing solutions for the automation of private homes, buildings and businesses. We provide our customers with professional support and a 3 years device warranty.
- Shelly Smart Control App will help you control your Shelly devices remotely and will send notifications for all automated events in your home. You can easily configure devices and manage their settings individually, or you can create personalized scenes by combining Shelly devices to trigger certain actions in your home automation.
Keep an approved out-of-band change
If the live change is legitimate, update Terraform configuration to express the accepted settings, then use the normal review and deployment workflow. That brings the declared configuration in line with the intended live settings and avoids a later apply reverting the change unexpectedly.
Free tools Windows power users keep installed
One-click scans. No signup required.
Restore the declared configuration
If the change was unauthorized or the declared settings remain the intended state, review a normal terraform plan and apply its reviewed actions. A normal plan can propose changes that bring remote resources back to the configuration; applying an approved plan performs that remediation.
Import a resource that should be managed
If a resource was created outside Terraform but should be managed going forward, define it in configuration and import it into Terraform state. HashiCorp’s tutorial demonstrates this approach for a manually created security group.
Rank #4
- Portable 100M/1G Network TAP Appliance for remote capture of data traffic
- Integrated with a Raspberry Pi 4 module (8GB RAM and 64GB Micro SD Card)
- Can be used as a standalone 100M/1G network TAP with the external monitor port
- Dual DC power inputs for enhancing overall system availability
Use refresh-only only to reconcile state
Applying a refresh-only plan records observed remote values in state without changing remote objects. It is appropriate when updating state is the intended operation, not as a way to repair live infrastructure. The configuration and live resource may still disagree afterward, so a later normal plan may propose changes to restore the declared settings.
Destructive, security-sensitive, or broad changes deserve review before execution. An AWS sample shows one possible pattern: classify drift by severity, automate lower-risk remediation, and require operator notification or approval for higher-risk cases. It is an example architecture, not evidence that automatic remediation is safe in every environment.
Quick Recap
How do drift-detection methods compare?
| Method | What it checks | Useful for | Limit or decision point |
|---|---|---|---|
Terraform CLI plan -refresh-only |
Observed remote values against Terraform state | Inspecting changes and deciding whether to update state | Does not restore live resources to configuration; review the proposed state updates before applying. (HashiCorp, “Manage resource drift”) |
| HCP Terraform health assessment | Infrastructure settings against resources tracked in workspace state | Periodic or on-demand visibility and health checks | Eligibility and edition prerequisites can change; assessments do not change infrastructure or configuration. (HashiCorp, “Use health assessments to detect infrastructure drift”; “Health assessments in HCP Terraform”) |
| AWS Config CloudFormation drift rule | CloudFormation stack drift status | AWS-native periodic and configuration-change checks | Detection may take minutes and broad scope can time out; group stacks with tags when needed. (AWS, “cloudformation-stack-drift-detection-check – AWS Config”) |
| Scheduled custom pipeline | Terraform plan output processed through classification, notification, and action stages | Tailoring check cadence and response logic | Requires operational ownership and security review; the AWS sample is illustrative. (AWS Samples, “Terraform Drift Detection and Auto-Remediation”) |
How can teams prevent recurring drift?
- Make reviewed configuration the normal change route. Keep infrastructure configuration under version control and use reviewed deployment workflows. Restrict or audit direct console and API changes where that fits operational needs.
- Declare critical values explicitly. Avoid relying on implicit provider or cloud defaults for security- and availability-critical attributes.
- Schedule checks to match risk and change rate. Run drift checks after deployments and at an interval chosen by the operating team. HashiCorp recommends continuous monitoring and CI/CD integration, but there is no single suitable frequency for every environment.
- Make alerts actionable. Set severity levels, name an owner, and document a response playbook. Distinguish high-impact security or availability changes from minor differences.
- Verify provider and resource coverage. Confirm that the resources and attributes in scope are tracked and that provider read operations keep state synchronized with remote resources.
- Check service health as well as configuration equality. Matching declared settings does not by itself prove an application is healthy. Use appropriate application and policy health checks in addition to drift detection.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
