DevOps & Cloud · Drift detection
DriftTrail
Know who changed production.
Every change made outside Terraform, with the person, the time and the channel from your cloud's audit log, how risky it is, and whether to revert it or adopt it into the code.
$ drift-trail check plans/ --cloudtrail cloudtrail.json
9 resources changed outside Terraform in 2 workspaces: 2 critical, 3 high; who found for 8
CRITICAL aws_security_group.api DT002 Opened to the internet
priya@acme.example via AWS console, AuthorizeSecurityGroupIngress
CRITICAL aws_s3_bucket_public_access_block.assets DT003 Made public, DT011 root account
MEDIUM aws_autoscaling_group.web desired_capacity: 3 -> 6 Adopt
The problem
Terraform shows that production no longer matches the code, but not who opened SSH to the internet from the console, whether that matters, or that the on-call engineer's 2 a.m. database resize will be undone by the next apply. Teams either ignore drift or spend an afternoon in CloudTrail for every change.
What it does
Reads refresh-only plans from any number of workspaces and lists every changed attribute, with policies compared statement by statement
Names who made each change from AWS CloudTrail, the Azure Activity Log or Google Cloud audit logs: the person or service account, the time, the API call and the source IP
Shows how it was done: the AWS, Azure or Google Cloud console, a CLI, a script, or another Terraform, CloudFormation or Pulumi run
Ranks drift by risk: opened to the internet, made public, encryption off, access policy widened, backups reduced, logging off, root account used
Says what to do: revert security-weakening changes, adopt capacity fixes with the Terraform code ready to paste
Nightly GitHub Action with a job summary, an HTML report, a CSV tracker and annotations on the resource block
Sensitive values are never shown; read-only CloudTrail lookups with your own credentials
How it works
- Run a refresh-only Terraform plan for each workspace
- DriftTrail finds who changed what in CloudTrail and ranks it
- Revert the risky changes, paste the code for the ones to keep
Works with
Runs in your CI
# Nightly drift check
terraform plan -refresh-only -out drift.plan && terraform show -json drift.plan > prod.json
drift-trail collect prod.json --out cloudtrail.json
drift-trail check prod.json --cloudtrail cloudtrail.json --format md --out drift.md --html drift.html --fail-on high
Your data
- Runs in your CI or on your laptop; nothing is uploaded.
- Values Terraform marks sensitive are never printed.
- Audit logs are read with read-only lookups only.
Who it's for
Questions
Doesn't terraform plan already show drift?
It shows that something changed. DriftTrail adds who changed it, how risky it is, and whether to revert or keep it, across all your workspaces in one report.
What if the change is older than 90 days?
Point it at your CloudTrail log files in S3 instead of the 90-day event history, and it reads those.
Related
Often used with DriftTrail
BlastRadar
Change impact analysisKnow what a change will touch. Before a release, see every service a change can affect and the line of code that links it. After the release, confirm those services are still healthy.
Free to start · quote on requestView product → DevOps & CloudSLOStudio
SLOs and error budgetsReliability you can measure. Define each SLO in a few lines and get correct burn-rate alerts, an error budget everyone understands, and a release gate, on the monitoring you already run.
Free to start · quote on requestView product → DevOps & CloudTestScope
Test impact selectionRun the tests that matter. Every pull request runs the tests its change can affect, each with a stated reason, and the full suite whenever a change is too broad to trust.
Free to start · quote on requestView product →See DriftTrail on your own data
A 30-minute call. We run the product on your export, repository or document and walk you through the results.