Free tools Windows power users keep installed
One-click scans. No signup required.
A Terraform plan can show that a remote resource changed, but it cannot tell you whether the change was intentional, whether Terraform queried the right account or region, or whether you should keep it. Before applying anything, identify what changed, verify the provider context, and decide whether the remote change or the configuration represents the intended outcome.
What Terraform drift means
Terraform plans using three inputs: your written configuration, Terraform state, and information returned by providers about remote objects. State is Terraform’s record of the resources it manages. It is neither the desired configuration nor a guarantee that a remote object still matches it. HashiCorp explains this model in its resource drift tutorial.
As an Amazon Associate I earn from qualifying purchases.
A difference in a plan is evidence of a mismatch, not a diagnosis or approval to change infrastructure. HashiCorp distinguishes two kinds of drift:
- Configuration drift: an outside change makes a remote object no longer match the configured intent. The usual choice is whether to restore the configured value or update configuration to represent the accepted change.
- State drift: a remote change is reflected differently in state but does not invalidate the configuration. It may be a state-recording issue rather than a conflict with the desired configuration.
That distinction matters because not every refresh difference calls for the same response. The practical question is whether the remote value conflicts with the desired and authorized outcome.
#1 Best Overall
How to inspect a reported change safely
A regular terraform plan refreshes observations from providers in memory before calculating proposed actions. terraform apply also refreshes as part of planning. To inspect which state values Terraform would update from its observations without asking it to change the infrastructure, use a refresh-only plan:
terraform plan -refresh-only
This is a reviewable plan. It shows Terraform’s proposed state updates; it does not itself modify remote resources or commit those updates to state. If the observations are correct and you have decided to record them, approve the state update with:
terraform apply -refresh-only
A refresh-only apply changes Terraform state, not remote objects. HashiCorp describes the operation this way: “A refresh-only operation does not attempt to modify your infrastructure to match your Terraform configuration — it only gives you the option to review and track the drift in your state file.” See the HashiCorp tutorial and the plan command reference.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteCheck the provider’s scope before interpreting absence
A resource that appears missing may not have been deleted. It may simply be outside the configured provider context. For example, HashiCorp’s provider-region tutorial shows Terraform proposing to remove an EC2 instance from state after the configured region changed and the instance could no longer be found there.
Rank #3
Before accepting a plan that proposes disappearance, broad changes, or unexpected replacements, verify the credentials and provider settings used by this run—including account and region. A refresh-only diff tells you what Terraform observed in that context; it does not establish that the context was correct or that an operator intended the difference.
Why not use terraform refresh?
The terraform refresh command is deprecated. HashiCorp warns that it applies refresh behavior automatically and can remove tracked objects from state if incorrect credentials or provider configuration make resources appear deleted. Prefer a refresh-only plan, inspect its proposed state changes, and decide whether to apply them afterward. See the refresh command reference.
Likewise, avoid making -target a routine drift-management method. HashiCorp warns that targeting can leave drift undetected and make relationships between resources harder to understand; see the plan command reference.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Choose whether to keep the outside change or revert it
Once you have confirmed the provider context, establish who made the change and why. Then choose based on desired intent, authorization, operational risk, and the plan’s proposed impact—not simply on the fact that Terraform reported a difference.
| Decision | What to do | What to review |
|---|---|---|
| Keep the outside change | Update configuration or its variable inputs so the accepted value is represented declaratively. Review and apply a refresh-only plan to record observed values in state, then run a normal plan. | Confirm the remote value is correct and authorized, and that the normal plan shows configuration, state, and remote resources converging without unintended actions. |
| Revert the outside change | Run a normal terraform plan to see how Terraform would restore the configured intent. Apply only after reviewing the plan. |
Check for destructive actions, removals, and replacements, along with their operational risk and blast radius. |
These workflows do different things: refresh-only apply records observations in state, while a normal plan followed by apply can change infrastructure toward the configuration. A plan explains proposed actions; deciding whether they are authorized and safe remains an operator’s responsibility. HashiCorp documents the distinction in its drift tutorial and plan reference.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Manual CLI review versus HCP Terraform assessments
HCP Terraform health assessments can periodically report differences between provider-reported resources and workspace state. They are non-actionable refresh-only plans: they report findings but do not update state, change configuration, or remediate infrastructure. The documented choices for configuration drift are to overwrite it by planning and applying configured values, or to change configuration so it represents the accepted remote change. See HashiCorp’s drift detection tutorial and workspace health documentation.
| Aspect | Manual CLI review | HCP Terraform health assessment |
|---|---|---|
| When it runs | On demand, when an operator runs a plan. | The tutorial describes assessments running about every 24 hours after enablement; cadence may change. |
| Execution context | The selected CLI environment, configuration, credentials, and provider settings. | A workspace assessment; the tutorial lists remote or agent execution mode among its prerequisites. |
| What it does | Shows a plan the operator can review; a separately approved refresh-only apply can update state. | Reports findings without applying state or infrastructure changes. |
| Requirements and availability | Requires a working Terraform CLI and valid provider context for the intended resources. | The tutorial lists Terraform 0.15.4 or later and a prior successful run; feature availability depends on HCP Terraform edition and current product terms. |
HashiCorp’s health documentation says HCP Terraform drift detection concerns configuration drift, not state drift. Automated findings still need a person to assess intent, risk, and whether the workspace is looking at the right provider scope. Check the current health documentation for applicable editions, prerequisites, and behavior.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
